South Korea's privacy watchdog has accused Chinese artificial intelligence startup DeepSeek of illegally transferring user data overseas without consent, escalating international concerns over data security tied to Chinese tech firms. The Personal Information Protection Commission (PIPC) said Thursday that DeepSeek sent South Korean user information to entities in China and the United States before its app was pulled from local platforms in February.
The PIPC's findings followed a comprehensive security review of the company's chatbot service, which had surged in popularity after its January release of the R1 reasoning model. The Hangzhou-based firm attracted global attention for claiming to have trained its AI using relatively modest computing resources, positioning it as a potential rival to Western developers such as OpenAI and Google.
DeepSeek “acknowledged it had insufficiently considered Korea's data protection laws," Nam Seok, director of the PIPC's investigation bureau, said during a news briefing. It "expressed its willingness to cooperate with the commission, and voluntarily suspended new downloads."
Among the data transferred were AI prompt inputs, along with device, network, and app information. One of the main recipients, according to the PIPC, was Beijing Volcano Engine Technology Co., a cloud service firm linked to ByteDance, the parent company of TikTok. Although the PIPC described Volcano Engine as "an affiliate" of ByteDance, it noted the company is legally separate.
The commission issued a corrective recommendation requiring DeepSeek to destroy the prompt data it sent to Volcano Engine and to establish clear legal protocols for future cross-border transfers of user information. It also emphasized that the app could return to South Korean app stores only after compliance is verified.
DeepSeek and ByteDance did not respond to requests for comment.
China's Ministry of Foreign Affairs defended its regulatory stance, with spokesperson Guo Jiakun stating: "We have never - and will never - require companies or individuals to collect or store data through illegal means."
The backlash reflects broader geopolitical unease over China's expanding tech influence and its data-sharing obligations under national law. Concerns over DeepSeek's operations have already led to bans on its use by South Korean government employees, with similar restrictions reportedly implemented in Taiwan, Australia, and the United States.
Marc Andreessen, a prominent U.S. venture capitalist, previously hailed DeepSeek's emergence as "AI's Sputnik moment," underscoring how the startup's disruptive ascent challenged assumptions about American dominance in artificial intelligence.
