⚠ Key Privacy Concerns
Under the policy, Character.AI collects your chat communications, voice recordings (if you use voice features), device identifiers, and data from ad platforms, and may use all of it to train its AI models, tailor advertising, and generate inferences about you. The policy states no universal training opt-out; your rights depend on regional law. The most unusual clause: if a Character you created has been made available to other users, the company reserves the right to keep it active even after you delete your data and account. On a product where people talk about their feelings, treat every message as retained, trainable data. Automated assessment, as of July 8, 2026.
What Should I Do?
Pick the row that matches you. References reflect the policy effective July 1, 2026; menu labels move, so look for the closest equivalent in your account.
👤 Everyday user
- Assume chats are retained and trainable. The policy lists chat communications as collected content and AI/ML training as a use, with no universal opt-out stated.
- Follow the policy's own advice: it says sensitive personal information is not required and asks you not to include any. Take that literally.
- Skip voice features if voice data bothers you; recordings of your voice are a listed data category.
- Manage cookies and ad tracking via the Cookie Policy controls and your device settings, and check the Regional Privacy Disclosures for opt-outs of targeted advertising where you live.
- Exercise rights through your account profile page,
privacy@character.ai, or the support portal.
💼 Parent / guardian
- Know the baseline: the policy states the Services are not designed for under-13s; 13-17 use is within the published documents' scope, and teen data gets the same training, ad, and retention treatment unless regional law adds protection.
- The company announced that under-18 accounts lost open-ended chat as of November 25, 2025, with age-assurance rollout. If your teen still has open-ended access, the age systems may have them marked as an adult; correct the account age.
- Submit an access request to see what is held, then a deletion request, through the support portal or privacy@character.ai. State the user is a minor.
- If a public Character was created, ask specifically about it: the policy reserves the right to keep popular public Characters active after account deletion.
- California residents: SB 243 (effective January 1, 2026) adds companion-chatbot duties for known minors, and the CCPA gives deletion rights; both are fact-dependent, so document everything first.
⚠ Already affected
- Document first: screenshots, dates, the account email, and the specific data or Character involved.
- File a written access and deletion request (support portal or privacy@character.ai) and keep the confirmation; that starts the clock under many state privacy laws.
- Expect the carve-outs: legal-compliance retention, security retention, and the popular-Character exception. Ask the company to identify which exemption it relies on if it declines.
- Mind the contract deadlines from the Terms: a one-year claims bar and, unless you opted out, JAMS arbitration. See the ToS review.
- If a rights request is ignored or data was exposed, a written demand letter citing your state's privacy statute is often the next lever.
⚠ The companion-chat reality
A companion chatbot invites the kind of disclosure people would never type into a search bar: feelings, relationships, health, identity. Under this policy those messages are ordinary collected content: usable to train models, analyzed for inferences, and part of an advertising-supported data model. The gap between how private the product feels and what the policy permits is the single biggest reason for the low score. Automated assessment, as of July 8, 2026.
Want the formal-demand route? See my AI training-data-use demand letter templates and CCPA/CPRA privacy-rights demand letters.
Data They Collect
Everything the policy says Character.AI gathers about you and your conversations.
What they collect: the policy lists identifiers (name, email, phone, username), date of birth, general geolocation, interests and preferences (from which inferences can be created), payment and transaction data, chat communications, posted images and videos, shared Characters, voice recordings, device and network data (IP address, device IDs such as IDFA and Android ID, User ID, Chat ID, Session ID), data from ad interactions on platforms like YouTube, TikTok, and Reddit, third-party login data, referral data, and publicly available internet data.
Who the policy says can get your data: affiliates and subsidiaries; vendors and service providers (storage, payment, analytics, fraud prevention, content moderation, marketing and advertising services); advertising and analytics providers for tailored advertising; other users and the public for content you make public; law enforcement and regulators on legal process; and a buyer or successor in a merger, financing, or acquisition. Read the policy's Section 3 for the operative list.
How long: as long as necessary for the purposes described, with no fixed schedules, plus legal-compliance and dispute-resolution retention. The standout carve-out: popular public Characters can be preserved and kept active even after you delete your data and account. And once chats have trained a model, that influence is not cleanly reversible by any deletion request.
Your control: account deletion and profile edits in-app; a rights menu (access, correction, deletion, portability, restriction, objection, opt-out of sales or targeted advertising, consent withdrawal) that applies "depending on where you live"; cookie controls via the Cookie Policy; unsubscribe for marketing email. No universal training opt-out is stated in the policy.
Security: the policy describes identity verification for rights requests and standard protective disclosures; it does not detail a security program or breach-notification commitments beyond applicable law. The methodology scores on whether the design limits the blast radius; an intimate-chat dataset raises the stakes of any incident.
Clarity: the policy is short and readable, with regional disclosures and a training-data documentation article linked. It is candid that inferences are created and that public Characters may persist. Less clear: which specific training uses apply to which users, and any concrete retention periods.
Analysis