Character AI New Terms of Service: What Actually Changed, in Plain Language

If you use Character.AI, or your kid does, you were probably greeted by a popup sometime in late 2025 asking you to accept updated policies. Most people clicked "agree" without reading. That is, roughly speaking, the point. The character ai new terms of service update touched privacy, advertising, arbitration, data collection, and the entire experience for anyone under 18. Below is what the legal text actually says, translated into specifics you can act on.

Key Takeaways

• Character.AI's privacy policy now explicitly permits sharing user data with third parties for targeted advertising. Under California law, this counts as a "sale" of personal data, even though no money changes hands.
• Users under 18 lost access to open-ended chat entirely. What remains for minors is a limited creative toolset (video, stories, streams), not conversational AI.
• A mandatory arbitration clause means you waive your right to sue in court. You have 30 days from account creation to opt out by email. Almost nobody does.
• Age verification now includes face-scan estimation and ID checks, creating a new biometric data surface that the FTC has specifically warned platforms not to misuse.
• There is no way to opt out of general data collection while keeping your account. The only full opt-out is deletion.

What Changed in the Privacy Policy?

Character.AI's August 2025 policy update expanded the privacy policy to cover targeted advertising explicitly. The company had always collected data. The change was in acknowledging, in writing, that it shares certain data with third parties for ad targeting, and in adding a Regional Privacy Disclosures document alongside a new Cookie Policy.

The categories of data the company collects are broad. A detailed review of the policy found it covers identifiers (names, emails), user-generated content, voice recordings, financial data, interests, demographic information, and what the policy calls "sensitive personal information." Tracking technologies and third-party data aggregation round it out.

What makes this different from a typical social app's privacy policy: the "user-generated content" on Character.AI is conversation. People vent. They roleplay. They process grief, anxiety, loneliness. The data being tracked and potentially shared for ad targeting overlaps directly with what users consider private thoughts. A generic ad-tech privacy framework was built for clickstream data (pages visited, buttons clicked). Applying the same framework to conversational AI is a category error that the terms do not acknowledge.

Does Character.AI Sell Your Data?

Technically, the company says it does not sell personal information for monetary consideration and is not a data broker. Practically, under laws like the California Consumer Privacy Act, disclosing user data to third parties for targeted advertising qualifies as a "sale" regardless of whether money changes hands. Character.AI's own privacy choices page acknowledges this framing.

So the answer depends on your definition. If "sell" means exchanging data for cash, the company says no. If "sell" means what California's privacy law says it means, the company's own disclosures say yes.

Can You Opt Out of Data Collection?

Not while keeping your account. There is no explicit opt-out mechanism for general data collection. Deleting the account is the only way to prevent future data use. A separate privacy-choices page does let you limit targeted-ad sharing specifically, which is a narrower control than most users probably assume when they hear "opt out."

This is a design pattern worth naming: giving users a single, nuclear option (delete everything) instead of granular controls. It makes the product easier to build but makes consent less meaningful.

What Is the Arbitration Clause, and Why Should You Care?

The updated terms include a mandatory arbitration provision. If you have a dispute with Character.AI, you agree to resolve it through private arbitration rather than in court. You also waive your right to participate in a class-action lawsuit.

There is an opt-out. You have 30 days from account creation to email an opt-out request. After that window closes, you are bound.

The practical problem: almost nobody knows this exists. The opt-out is buried in legal text that most users never open, and the 30-day clock starts ticking the moment you create the account, not the moment the terms change. This is consent theater. The mechanism exists so the company can say "you had a choice." The design ensures that almost no one exercises it.

If you have a Character.AI account and you created it more than 30 days ago without sending that email, you have already agreed to arbitration. If you are creating an account now, or if you are a parent setting one up for a teenager, send the opt-out email on day one. It costs nothing. It preserves your right to sue if something goes wrong.

What Happened to Under-18 Access?

This is the most visible change. Character.AI announced in October 2025 that it would remove the ability for users under 18 to engage in open-ended back-and-forth chats with AI characters, effective November 25, 2025.

This was not a subtle policy tweak. It eliminated the core product for minors. Open-ended chat is what Character.AI is. The company said it would build a replacement experience allowing teens to create videos, stories, and streams, but the conversational element, the thing that made users emotionally attached to the platform, was removed.

The context matters. This change followed wrongful-death lawsuits filed by families who alleged that the platform's AI characters contributed to the deaths of minors. Five of those lawsuits were settled in January 2026. California passed SB 243, effective January 1, 2026, requiring companion AI platforms to protect minors. New York introduced its own AI Companion Models Law around the same time.

The under-18 chat ban was not a proactive safety decision. It was a response to litigation and legislation. The terms of service formalized what regulators and courts were already forcing.

How Does Age Verification Work Now?

Character.AI rolled out mandatory face-based age verification in April 2026. All users are now required to scan their face to confirm they meet the minimum age threshold. Accounts flagged as possibly under 18 (based on behavioral signals, not just self-reported birthday) must either pass a face-estimation check or submit an ID, or lose access to open-ended chat.

The minimum age varies by region. In the U.S., the baseline is 13. In the European Economic Area and UK, it is 16. Under-16s in those regions are effectively barred entirely.

What Is the Privacy Cost of Face-Scan Verification?

This is the part that most coverage skips. Age verification that relies on face scans and ID checks creates a new biometric data collection surface. The platform now has your face geometry or a photo of your government ID, in addition to everything it already collects.

The FTC addressed this directly. In February 2026, the FTC issued a policy statement warning that operators must implement robust age verification without unlawfully hoarding biometric data. The regulator explicitly named the tension: you need to verify age, but you cannot build a biometric database as a side effect.

Character.AI's terms do not clearly explain how long face-scan data is retained, whether it is processed on-device or server-side, or what third parties (if any) handle the biometric analysis. This is a gap. If you are a parent consenting to your child's age verification, you are consenting to biometric data collection with limited visibility into what happens to that data afterward.

What Does "Behavioral Flagging" Mean in Practice?

Character.AI does not verify every user's age proactively. Instead, accounts are flagged based on behavioral signals that suggest the user might be under 18. If flagged, the user must verify. If they do not, or if verification fails, access to open-ended chat is restricted.

The company has not disclosed what behavioral signals trigger a flag. This is likely intentional (publishing the criteria would make them easy to game). But it means the system is profiling user behavior continuously to estimate age, which is itself a form of surveillance that the privacy policy does not isolate or explain.

There is a useful distinction here between two approaches to age verification. One is a gate: check once at signup, move on. The other is continuous behavioral fingerprinting, where the system watches how you use the product and makes ongoing inferences about who you are. Character.AI appears to be doing the second. The terms of service describe the first.

What Do the Updated Community Guidelines Say?

The community guidelines update accompanied the terms and privacy policy changes. The guidelines tightened rules around content that could be harmful to minors, expanded definitions of prohibited content, and reinforced the company's right to moderate and remove conversations.

One thing the guidelines do not address: emotional dependency. Multiple reviews, including a 2026 safety assessment, have noted that the platform's design encourages users to form emotional attachments to AI characters, and that this risk persists regardless of content moderation. The community guidelines govern what the AI says. They do not govern the relationship dynamics the product creates by design.

Is Character.AI Under Investigation?

Yes. The Texas Attorney General is actively investigating the company as of April 2026. This is in addition to the wrongful-death lawsuits, five of which settled in January 2026. Regulatory scrutiny is not a one-time event for this company. It is ongoing and intensifying.

The new terms of service should be read with this context. Several provisions (the arbitration clause, the expanded data-collection language, the biometric verification framework) look like legal infrastructure built to manage litigation risk. They protect the company. Whether they protect users is a different question.

What Should Parents Actually Do?

If your child uses Character.AI, here is what the updated terms mean for you in concrete steps:

1. Understand that open-ended chat is gone for under-18 accounts. Your child cannot have back-and-forth conversations with AI characters. What remains is a limited creative toolset. If your child is still having open-ended conversations, they are likely using an account that has not been flagged or verified, which means they may be misrepresenting their age.
2. Know that age verification involves biometric data. Your child's face scan or government ID is being processed. The terms do not clearly explain retention or third-party handling.
3. Send the arbitration opt-out email within 30 days of account creation. If the account is older than 30 days, you have already missed the window. For new accounts, do this immediately. The email address and instructions are in the terms of service.
4. Understand that the only full data opt-out is account deletion. You can limit targeted-ad sharing through the privacy choices page, but there is no way to use the product without the broader data collection.
5. Read the terms yourself. They are at characterai.cc/en/terms.html. This article is a summary, not a substitute.

Why Do These Terms Matter Beyond Character.AI?

Character.AI is not the only conversational AI product, and it will not be the last one to update its terms under legal pressure. The patterns in this update are going to become industry-standard within a year or two. Broad data collection with narrow opt-outs. Mandatory arbitration with buried escape hatches. Biometric age verification that creates new privacy surfaces while solving old safety problems. Advertising frameworks built for clickstream data applied to conversational data without modification.

If you care about privacy in AI products, these terms are worth reading not because Character.AI is uniquely bad, but because they show where the entire industry is heading. The question is whether "industry standard" is good enough for a product that knows what you think about when you are alone.

Conversational data is not browsing data. The privacy frameworks that work for social media do not transfer cleanly to AI companions. A platform that collects your conversation about a breakup, a panic attack, or a fantasy and then shares behavioral signals from that session with ad networks is doing something qualitatively different from a platform tracking which shoes you looked at. The legal language is the same. The stakes are not.

We built Selina around a different set of assumptions. Your conversations are encrypted at rest. Your files and transfers through SelinaSEND are end-to-end encrypted. We route through a stack of frontier models per task via API, and operational metadata is held for a short retention window, not indefinitely. Memory is adaptive, not a transcript, and it is not end-to-end encrypted, because a slice of each request reaches a provider at inference. We state that limit because it is real. But the design goal is straightforward: your AI assistant should remember you without selling what it remembers.

If that sounds like what you are looking for, start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io