DeepSeek illegally shares user data with China and the U.S

In South Korea, the Personal Information Protection Commission (PIPC) has accused the Chinese AI startup DeepSeek of illegally transferring personal user data to companies in China and the United States without obtaining proper consent. The findings were published on April 24, 2025, following an investigation that began after concerns were raised about the company’s data handling practices. DeepSeek’s chatbot application was removed from South Korean app stores in February 2025 under the recommendation of the PIPC, which highlighted violations of local data protection regulations. During its operation in South Korea, DeepSeek mishandled various types of personal information, including user-generated AI prompts and device data. The company allegedly shared this information with the Beijing Volcano Engine Technology Co., a cloud service that has ties to ByteDance, the parent company of TikTok, even though they are legally separate entities. Despite DeepSeek claiming that the data sharing was meant to enhance app security and user experience, the agency raised significant national security concerns, especially regarding the potential access that Chinese authorities could have to the information. The PIPC issued corrective recommendations to DeepSeek, mandating immediate destruction of any transferred AI prompt information and the establishment of legal protocols for data transfer. Failure to comply could prevent the app from returning to South Korean app stores. Concerns about the app’s data handling led to broader government restrictions, as several agencies in South Korea and other countries like the U.S., Australia, and Taiwan banned its use on government devices. Meanwhile, the U.S. House Energy and Commerce Committee has launched its own investigation into DeepSeek, probing whether the company shares data with the Chinese Communist Party and affects the output of its AI models to align with propaganda narratives. This investigation reflects rising tensions around data privacy and the growing scrutiny on foreign technology companies that operate in the U.S. and allied countries. Earlier investigations indicated that DeepSeek's AI model, known as R1, might have been trained on data drawn from U.S. competitors, raising further alarms about the security implications of the company’s operations.