DOJ Advisers Flag Privacy Gaps in Character.AI Chat Data Sale

Key points

• Justice Department representatives and U.S. Trustee officials alerted a court to risks around selling AI conversation records.
• Character.AI user chats are at the center of the privacy concern.
• A privacy ombudsman is pressing for stronger controls on data transfers.
• No CVE or technical exploit is involved; this is a governance and privacy issue.

Justice Department representatives and the U.S. Trustee program have put a court on notice that the proposed sale of conversation records tied to Character.AI deserves closer scrutiny. The filing is not a technical alert and does not cite a software flaw; it is a warning that the handling and transfer of AI chat data can create serious privacy exposure. A privacy ombudsman is also involved, arguing that any transaction involving these records needs clearer safeguards and oversight.

The people most directly affected are users who have interacted with Character.AI, including any students or school staff who may have used the service. Chat logs can contain personal disclosures, emotional content, identifiers, and details about minors. If those records are treated as ordinary assets and moved to a new owner without limits, the result is not just a policy problem; it is a potential loss of control over sensitive conversations.

The broader issue is governance. AI chat platforms generate rich behavioral and conversational data, and buyers may see value in that corpus. The advisory asks the court to consider how such a sale should be regulated, including whether notice, consent, retention limits, and independent review are needed before records change hands. For public-sector organizations, the case is a reminder that vendor terms and data-transfer clauses matter as much as the model itself.

Watch for court orders that set conditions on the sale, statements from the privacy ombudsman, and any guidance from DOJ or U.S. Trustees on how AI conversation data should be handled in legal proceedings. K-12 leaders should use the moment to inventory AI tools in use, confirm what conversation data vendors retain, and prepare to restrict or renegotiate services that permit unconstrained data sales.

What to do now

1. Inventory any staff or student use of Character.AI and other consumer AI chat tools; document accounts and approved use cases.
2. Suspend or block unapproved AI chat services until privacy, legal, and records-retention reviews are complete.
3. Review vendor contracts and terms for clauses allowing sale, transfer, or secondary use of conversation data; require written notice and approval rights.
4. Classify chat logs by sensitivity and minimize retention; prohibit entry of student PII, health details, or confidential school information into unapproved tools.
5. Require vendor attestations on data ownership, deletion, subprocessors, and sale restrictions; keep evidence for procurement files.
6. Enable logging and egress monitoring for AI services, and route suspected data transfers to the privacy office and legal counsel.
7. Brief staff on safe AI use and establish a review path before any new AI tool is adopted.

Original source

The Record