TAIPEI, Taiwan – Chinese generative AI service DeepSeek transferred Korean users’ personal information to companies in China and the United States without proper consent during its brief operation in the country, South Korea’s data protection watchdog said on Thursday.
DeepSeek’s chatbot app once became the most downloaded on Apple’s iPhone, surpassing U.S. company OpenAI’s ChatGPT. While praised for efficiency, it raised concerns over censorship of sensitive topics, data privacy and ties to the Chinese government, with some governments, including South Korea, banning the app.
DeepSeek transferred user data to three companies in China and one in the U.S. between Jan. 15 and Feb. 15, 2025, when the service was temporarily suspended following privacy controversies, the Personal Information Protection Commission, or PIPC, announced.
The Chinese service neither obtained user consent for these international transfers nor disclosed this practice in its privacy policy. With approximately 50,000 daily users during its one-month service period, the PIPC estimated that information from around 1.5 million users may have been improperly transferred overseas.
The commission also found that DeepSeek sent not only device, network, and app information but also the content that users entered into AI prompts to Volcano, one of the three Chinese companies and an affiliate of ByteDance, TikTok’s parent company.
DeepSeek acknowledged the transfers to Volcano but said it used the company’s cloud services to improve security vulnerabilities and the user experience. The PIPC told DeepSeek that transferring prompt inputs was unnecessary and confirmed that the company has blocked transfers since April 10.
“DeepSeek explained that although Volcano is affiliated with ByteDance, it operates as a separate legal entity unrelated to ByteDance operations,” said the PIPC in a statement.
“They assured that the processed information would only be used for service operation and improvement, not for marketing purposes, and promised to strictly protect personal information in compliance with legal requirements.”
The investigation also found DeepSeek lacked an “opt-out” function that would allow users to prevent their prompt inputs from being used for AI training and development. This feature was only implemented after the PIPC pointed out the deficiency.
Although DeepSeek claimed not to collect personal information from children under 14, it had no age verification process during registration.
The company has since established age verification procedures during the inspection process.
The privacy policy, available only in Chinese and English, also omitted required information about data deletion procedures, methods, and security measures mandated by South Korean privacy law.
The PIPC recommended that DeepSeek immediately delete user prompt content transferred to Volcano and implement several improvements, including appointing a domestic representative in South Korea and enhancing overall security measures for its personal information processing systems.
If DeepSeek accepts these recommendations within 10 days, it will be considered equivalent to receiving an official correction order under relevant laws, requiring the company to report implementation results to the PIPC within 60 days.
DeepSeek had previously acknowledged its insufficient consideration of South Korean privacy laws when it temporarily suspended new downloads in domestic app markets following the start of the PIPC investigation.
While the commission did not specify when DeepSeek might resume services in South Korea, the company is expected to restart operations soon, as it claims to have addressed most of the identified issues.
DeepSeek has not commented on South Korea’s findings.
Communist Party ‘enforcer’
The South Korean investigation came a week after the U.S. House Select Committee on the Chinese Communist Party, or CCP, said up to 85% of responses on DeepSeek were altered or suppressed to cater to the CCP’s narrative.
The chatbot uses automated filtering of responses and built-in biases to serve as a “digital enforcer of the CCP,” manipulating information pertinent to democracy, Taiwan, Hong Kong and Chinese human rights abuses, the committee said in a report released on April 16.
The investigation found that DeepSeek channels information from U.S. users directly to the CCP via backend infrastructure connected to China Mobile, listed as a Chinese military company by the U.S. government.
Millions of U.S. users’ data therefore serves as a “high-value open-source intelligence asset for the CCP,” it said.
Edited by Mike Firn and Stephen Wright.