S. Korea says DeepSeek transferred data to Chinese company without consent

Chinese artificial intelligence app DeepSeek was transferring personal data to a cloud services platform without users’ consent while it was still available for download, South Korea’s data protection authority said on Thursday.

The Personal Information Protection Commission (PIPC) said the information, which included device, network and user inputs in AI prompts, was transferred to servers at Beijing platform Volcano Engine.

DeepSeek’s R1 chatbot stunned investors and industry insiders in January with its ability to match the functions of its Western competitors at a fraction of the cost.

However, countries including South Korea, Italy and Australia and some US states have questioned DeepSeek’s storage of user data and have banned or restricted its use.

The PIPC launched an investigation in February and said DeepSeek would no longer be available for download until a review of its personal data collection practices was completed.

“Initially, DeepSeek transferred personal data to companies located in China and the United States without obtaining users’ consent or disclosing this in the privacy policy at the time the service was launched,” commission official Nam Seok told reporters.

“In particular, it was confirmed that DeepSeek transferred not only device, network, and app information, but also user inputs in AI prompts to Volcano Engine,” he said.

Following the investigation, DeepSeek “acknowledged it had insufficiently considered Korea’s data protection laws, expressed its willingness to cooperate with the commission, and voluntarily suspended new downloads from domestic app markets”, Nam said.

Asked about South Korea’s findings about DeepSeek, Beijing said it was not familiar with the “specific situation”.

“But I can emphasize that the Chinese government attaches great importance to and protects data privacy and security,” Foreign Ministry spokesman Guo Jiakun told a regular news conference.

“It has never and will never require companies or individuals to collect or store data in a manner that violates the law,” Guo said.

DeepSeek did not immediately respond to a request for comment. It has said that data was collected in “secure servers located in the People’s Republic of China”.

The company claims its AI tool was built using less sophisticated chips than its competitors, slashing the cost. The app was downloaded tens of millions of times in just a few weeks after its launch.

Volcano Engine is a Beijing-based cloud service platform owned by ByteDance, which is also the parent company of the hugely popular platform TikTok.

Asked about the data transfer to Volcano Engine, DeepSeek said it was sent “for the purpose of addressing security vulnerabilities and improving user interface and experience”, Nam said.

© 2025 AFP