Chinese artificial intelligence app DeepSeek transferred users’ personal data to a cloud platform without proper consent while still available for download, South Korea’s Personal Information Protection Commission (PIPC) revealed on Thursday.
The South Korean watchdog found that the app had shared sensitive information—including device data, network details, and user inputs during AI interactions—with servers operated by Volcano Engine, a Beijing-based cloud service.
DeepSeek’s R1 chatbot made waves among investors and tech experts in January for delivering performance on par with Western competitors, but at a significantly lower cost. However, its rapid rise soon drew scrutiny in countries like South Korea, Italy, Australia, and several U.S. states, which imposed restrictions or outright bans over data privacy concerns.
The PIPC launched a formal investigation in February and ordered the suspension of new downloads of DeepSeek in South Korea pending a full review of its data handling practices.
“From the outset, DeepSeek transferred personal data to companies located in China and the U.S. without obtaining user consent or disclosing it in the privacy policy active at the time,” said Nam Seok, a commission official. “It was confirmed that the data sent to Volcano Engine included not only device and network information, but also the textual inputs users entered during AI interactions,” he added.
Following the probe, DeepSeek acknowledged it had not adequately considered South Korea’s data protection laws. The company expressed willingness to cooperate with authorities and voluntarily halted new app downloads in the domestic market.
Asked about South Korea’s findings, China’s Foreign Ministry said it was unaware of the specific situation. However, ministry spokesperson Guo Jiakun stressed that “the Chinese government places great importance on data privacy and security and has never required, nor will it require, companies or individuals to collect or store data illegally.”
DeepSeek did not immediately respond to requests for comment, but had previously stated that the data was stored on “secure servers located in the People’s Republic of China.”
The company has also said its AI tool was developed using less advanced chips than those used by competitors, drastically reducing costs. Within just a few weeks of launch, the app was downloaded tens of millions of times.
Volcano Engine, the platform receiving the data, is a Beijing-based cloud service owned by ByteDance, the parent company of TikTok. According to statements gathered by the PIPC, DeepSeek claimed the data transfer aimed to “address security vulnerabilities and improve user experience and interface.”
