South Korea's Personal Information Protection Commission (PIPC) has revealed that the Chinese artificial intelligence (AI) application DeepSeek was transferring users' personal data to a cloud services platform in China without obtaining the necessary consent. This unauthorized data transfer occurred while the app was still available for download in South Korea.
According to the PIPC, the transferred information included sensitive details such as device information, network data, and even the user inputs entered as prompts for the AI. The destination of this data was identified as servers belonging to Volcano Engine, a cloud services platform based in Beijing.
DeepSeek's R1 chatbot had garnered significant attention in January, surprising investors and industry experts with its ability to rival the functionalities of Western competitors at a considerably lower operational cost.
However, the app's data handling practices have come under increasing scrutiny in several countries. South Korea joins a growing list that includes Italy, Australia, and certain US states, all of which have raised concerns regarding DeepSeek's storage of user data, leading to bans or restrictions on its use.
The PIPC initiated a formal investigation into DeepSeek's data practices in February. Subsequently, the commission announced that the app would be removed from download availability in South Korea pending a thorough review of its personal data collection methods.
“Initially, DeepSeek transferred personal data to companies located in China and the United States without obtaining users’ consent or disclosing this crucial information in its privacy policy at the time the service was launched,” PIPC official Nam Seok informed reporters during a press briefing.
He further elaborated on the specifics of the unauthorized data transfer, stating, “In particular, it was confirmed that DeepSeek transferred not only device, network, and app information, but also the very user inputs provided as prompts to the AI, directly to Volcano Engine.”
Following the findings of the PIPC's investigation, DeepSeek reportedly "acknowledged that it had insufficiently considered Korea’s data protection laws, expressed its willingness to cooperate fully with the commission's inquiries, and voluntarily suspended new downloads of the application from domestic app marketplaces," according to Nam Seok.
DeepSeek did not immediately respond to a request for comment regarding the PIPC's findings. The company had previously stated that user data was collected and stored on "secure servers located in the People’s Republic of China."
The company has touted its AI tool's ability to achieve comparable performance to competitors while utilizing less sophisticated and therefore less expensive chips, contributing to its lower operational costs. The DeepSeek app reportedly achieved tens of millions of downloads within just a few weeks following its initial launch.
Volcano Engine, the recipient of the transferred user data, is a Beijing-based cloud service platform owned by ByteDance, the parent company of the widely popular social media platform TikTok.
When questioned about the data transfer to Volcano Engine, DeepSeek reportedly stated that the transfer was conducted "for the purpose of addressing security vulnerabilities and improving user interface and experience," according to official Nam Seok of the PIPC.