South Korea Finds DeepSeek Transferred User Data Abroad Without Proper Consent

South Korea’s Personal Information Protection Commission (PIPC) has found that Chinese AI startup DeepSeek transferred user data from South Korean users to entities in China and the U.S. without obtaining the required user consent. The investigation revealed that DeepSeek shared sensitive information—including AI prompt content, device, network, and app data—with Beijing Volcano Engine Technology Co., a Chinese cloud service provider affiliated with ByteDance. Despite this affiliation, PIPC clarified that the cloud service is a legally separate entity. DeepSeek claimed the data was used to improve user experience and app security but ceased the transfer of AI prompt data as of April 10. The data watchdog has issued corrective measures, requiring DeepSeek to delete previously shared data and implement legal frameworks for overseas data transfers. The chatbot app was removed from local app stores in February and may only return once these compliance updates are made. The case has stirred international concerns due to China’s strict data-sharing regulations for domestic companies, with other countries like the U.S., Taiwan, and Australia having also reportedly banned the app on government devices due to cybersecurity and privacy concerns.