The Berlin Commissioner for Data Protection has formally requested Google and Apple to remove the DeepSeek AI application from the application stores due to GDPR violations.
The commissioner, Meike Kamp, alleges that DeepSeek’s owner, Hangzhou DeepSeek Artificial Intelligence, based in Beijing, unlawfully collects data from German users and transfers them for processing in servers in China.
As per the GDPR and Article 46 (1) specifically, any personal data collected from individuals in the European Union must be protected according to the standards upheld by the regulatory act.
However, China has very lax data protection regulations and a history of excessive data access requests to private entities. Because of this, it is unlikely that DeepSeek has implemented sufficient legal safeguards to guarantee its security to EU standards.
“The company has no branch within the European Union (EU),” explains the commissioner.
“The service is made available to users in Germany, among other places, through apps in the Google Play Store and Apple App Store with German-language descriptions and can be used in the German language.”
“This makes the service subject to the provisions of the European General Data Protection Regulation (GDPR).”
DeepSeek is a Chinese AI platform that rose to prominence in January 2025 after the release of the third generation of its chatbot, which came with extensive capabilities.
Although this sudden popularity was quickly tarnished by serious cybersecurity problems that exposed insecure practices, the platform continued to enjoy popularity in the global AI community.
The DeepSeek AI app has 50 million downloads on Google Play, Android’s official app store, and thousands of ratings on Apple’s App Store.
Kamp had requested DeepSeek to voluntarily remove its apps from app stores in Germany this year on May 6 but the company refused to comply.
Hence, the Berlin authorities now made use of Article 16 of the Digital Services Act (DSA), which allows them to report illegal content on platforms to the respective operators, in this case, Apple and Google.
The two tech giants will now have to review the commissioner’s report and decide whether DeepSeek AI will be removed from their stores or not.
Although the request was submitted by a state-level regulator and not the German government, there is coordinationwith other regulators from Baden-Württemberg, Rhineland-Palatinate, and Bremen, as well as the Federal Network Agency (Bundesnetzagentur).
BleepingComputer has contacted Google, Apple, and DeepSeek to comment on the situation, and we will update this post when we hear back from them.
While cloud attacks may be growing more sophisticated, attackers still succeed with surprisingly simple techniques.
Drawing from Wiz’s detections across thousands of organizations, this report reveals 8 key techniques used by cloud-fluent threat actors.
Get the Report