Table of Contents
South Korea’s data protection watchdog has taken action against Chinese artificial intelligence startup DeepSeek, accusing it of transferring personal data and user prompt content without consent during its launch phase in the country. The move underlines mounting global scrutiny of data handling practices by AI firms, particularly around international data transfers and user transparency.
DeepSeek Accused of Transferring Data Without Consent
In an official statement released on Thursday, South Korea’s Personal Information Protection Commission (PIPC) announced that Hangzhou DeepSeek Artificial Intelligence Co. Ltd had violated local data protection laws during the rollout of its app in South Korea earlier this year.
According to the PIPC, DeepSeek failed to obtain proper user consent before transferring personal data to several overseas entities in both China and the United States. This reportedly occurred during the app’s availability in local markets in January 2025.
The unauthorized data transfer included sensitive information such as user prompts submitted to the AI, device identifiers, network information, and app-related metadata.
Prompt Data Sent to Chinese Tech Firm Volcano Engine
In a particularly troubling revelation, the PIPC stated that DeepSeek transferred AI prompt content—essentially, the questions and inputs users entered into the AI system—to Beijing Volcano Engine Technology Co Ltd, a tech company affiliated with ByteDance, the parent company of TikTok.
OpenAI Open to Buying Chrome if Google Ordered to Divest
The PIPC emphasized that DeepSeek had sent this data without clearly informing users or acquiring lawful consent. When questioned by authorities, DeepSeek claimed that the information was transferred as part of efforts to “improve user experience”—a rationale the commission did not accept as sufficient justification under South Korea’s privacy regulations.
Regulatory Action: App Suspended and Corrections Demanded
In response to initial findings, South Korea’s data agency suspended new downloads of the DeepSeek app in February 2025, citing the company’s failure to comply with local privacy safeguards.
On April 10, DeepSeek informed the PIPC that it had blocked the further transfer of AI prompt data to Volcano Engine. However, the commission continued its probe and has now issued a corrective recommendation, directing the company to:
- Immediately delete all prompt content previously transferred to Volcano Engine.
- Establish a legally valid framework for transferring personal data outside of South Korea in the future.
Broader Implications for AI and Cross-Border Data Governance
This case underscores growing concerns among regulators worldwide about how AI platforms collect, process, and share user data—especially across borders. As AI services become more widespread, the risk of data misuse or unauthorized sharing also increases, making privacy and consent enforcement more urgent.
The DeepSeek incident is likely to set a precedent in South Korea and potentially influence broader policy trends in Asia and globally, especially when it comes to foreign AI companies operating in domestic digital ecosystems.
With tensions high over data sovereignty and digital ethics, more governments are expected to increase oversight and demand greater transparency and accountability from AI firms—whether homegrown or international.
