South Korea Accuses DeepSeek of Unauthorized User Data Transfer to China and US

South Korea says DeepSeek transferred user data to China and the U.S. without consent

The findings were released in relation to an ongoing investigation into DeepSeek, and the company has been sent corrective recommendations. South Korea's data protection authority has concluded that Chinese artificial intelligence startup DeepSeek collected personal information from local users and transferred it overseas without their permission. The authority, the Personal Information Protection Commission, released its written findings on Thursday in connection with a privacy and security review of DeepSeek. It follows DeepSeek's removal of its chatbot application from South Korean app stores in February at the recommendation of PICP. The agency said DeepSeek had committed to cooperate on its concerns. During DeepSeek's presence in South Korea, it transferred user data to several firms in China and the U.S. without obtaining the necessary consent from users or disclosing the practice, the PIPC said. The agency highlighted a particular case in which DeepSeek transferred information from user-written AI prompts, as well as device, network, and app information, to a Chinese cloud service platform named Beijing Volcano Engine Technology Co. While the PIPC identified Beijing Volcano Engine Technology Co. as "an affiliate" of TikTok-owner ByteDance, the information privacy watchdog noted in a statement that the cloud platform "is a separate legal entity and has no relation to ByteDance," according to a Google translation. According to PIPC, DeepSeek said it used Beijing Volcano Engine Technology's services to improve the security and user experience of its app, but later blocked the transfer of AI prompt information from April 10.

S. Korea says DeepSeek transferred data to Chinese company without consent

Chinese artificial intelligence app DeepSeek was transferring personal data to a cloud services platform without users' consent while it was still available for download, South Korea's data protection authority said on Thursday. The Personal Information Protection Commission (PIPC) said the information, which included device, network and user inputs in AI prompts, was transferred to servers at Beijing platform Volcano Engine. DeepSeek's R1 chatbot stunned investors and industry insiders in January with its ability to match the functions of its Western competitors at a fraction of the cost. However, countries including South Korea, Italy and Australia and some US states have questioned DeepSeek's storage of user data and have banned or restricted its use. The PIPC launched an investigation in February and said DeepSeek would no longer be available for download until a review of its personal data collection practices was completed. "Initially, DeepSeek transferred personal data to companies located in China and the United States without obtaining users' consent or disclosing this in the privacy policy at the time the service was launched," commission official Nam Seok told reporters. "In particular, it was confirmed that DeepSeek transferred not only device, network, and app information, but also user inputs in AI prompts to Volcano Engine," he said. Following the investigation, DeepSeek "acknowledged it had insufficiently considered Korea's data protection laws, expressed its willingness to cooperate with the commission, and voluntarily suspended new downloads from domestic app markets", Nam said. Asked about South Korea's findings about DeepSeek, Beijing said it was not familiar with the "specific situation". "But I can emphasize that the Chinese government attaches great importance to and protects data privacy and security," Foreign Ministry spokesman Guo Jiakun told a regular news conference. "It has never and will never require companies or individuals to collect or store data in a manner that violates the law," Guo said. DeepSeek did not immediately respond to a request for comment. It has said that data was collected in "secure servers located in the People's Republic of China". The company claims its AI tool was built using less sophisticated chips than its competitors, slashing the cost. The app was downloaded tens of millions of times in just a few weeks after its launch. Volcano Engine is a Beijing-based cloud service platform owned by ByteDance, which is also the parent company of the hugely popular platform TikTok.

DeepSeek Transferred User Data & Prompts Overseas Without Consent, Claims South Korea's Data Protection Authority; Activities Were Carried Out When Service Was Active In January

The rise of DeepSeek put multiple regions on high alert, and while the company's AI chatbot can effortlessly be used in several locations, countries like South Korea have outright banned the service due to security concerns. Now, according to the latest report, the authorities' reasoning for suspending it might have some weight as a data protection agency believes that DeepSeek was transmitting user data and prompts overseas without consent. The latest update regarding DeepSeek's alleged anti-privacy acts has been reported by Reuters, which mentions that South Korea's Personal Information Protection Commission said in a statement that users' personal information was being sent to a number of companies located in China and the United States without permission. The report mentions that DeepSeek did not have the authority to send user data, but it states that this happened while the service was launched in January. It did not take long for DeepSeek to be suspended entirely in the region in February 2025, with the data protection agency stating that the AI startup admitted it failed to take into account some of the watchdog's rules on privacy and personal data. In addition to user information, the Personal Information Protection Commission believes that DeepSeek sent AI prompts entered by South Korean users to a Chinese firm called Beijing Volcano Engine Technology, along with details related to the individual's networks, devices, and apps. DeepSeek clarified that it was transferring data to Beijing Volcano Engine Technology to improve the user experience, and to likely comply with the agency's privacy rules, blocked the transfer of AI prompts from April 10. China's foreign ministry has reassured that the government has not and will never ask AI companies to collect and store user information illegally, but it appears that the South Korean agency is not satisfied with the response, as the service remains inactive. Perhaps if DeepSeek can be a little transparent with what it does with the transferred data, the AI chatbot can once again be used in the country.

South Korea says DeepSeek transferred user data, prompts without consent

SEOUL (Reuters) -South Korea's data protection authority said on Thursday that Chinese artificial intelligence startup DeepSeek transferred user information and prompts without permission when the service was still available for download in the country's app market. DeepSeek did not immediately respond to a request for comment. The Personal Information Protection Commission said in a statement that Hangzhou DeepSeek Artificial Intelligence Co Ltd did not obtain user consent while transferring personal information to a number of companies in China and the United States at the time of its South Korean launch in January. In February, South Korea's data agency suspended new downloads of the DeepSeek app in the country after it said DeepSeek acknowledged failing to take into account some of the agency's rules on protecting personal data. The data protection agency said on Thursday that DeepSeek also sent content in AI prompts entered by users to Beijing Volcano Engine Technology Co. Ltd. along with device, network and app information. DeepSeek later told the agency that the decision to send information to Volcano Engine was to improve user experience and that it had blocked the transfer of AI prompt content from April 10, it said. The agency said it has decided to issue a corrective recommendation for DeepSeek to immediately remove AI prompt content transferred to Volcano Engine and establish a legal basis for transferring personal information abroad.