China’s artificial intelligence (AI) model DeepSeek has come under regulatory scrutiny in South Korea after it was found to have transmitted user data to ByteDance, the parent company of TikTok. South Korea’s Personal Information Protection Commission (PIPC) confirmed on Feb. 17 that DeepSeek had been transferring user data to ByteDance without proper disclosure. Acknowledging gaps in its data protection measures, DeepSeek suspended new app downloads on Feb. 15. This marks the second nationwide ban on the app, following Italy’s decision to block downloads in late January.
In response to the suspension, Chinese Foreign Ministry Spokesperson Guo Jiakun addressed the issue during a regular briefing, stating, “The Chinese government has consistently required Chinese companies to strictly comply with local laws and regulations. We hope that the country in question [South Korea] will not turn economic, trade, scientific, and technological matters into security or political issues.”
DeepSeek has gained global attention for developing a high-performance AI model at a relatively low cost. However, its data collection practices, including tracking users’ keyboard habits, have sparked privacy concerns. As of late January, the app had 1.21 million weekly active users, second only to ChatGPT’s 4.93 million.
The PIPC uncovered the data transfer while reviewing DeepSeek’s internet access records but has yet to determine the specifics, including the volume and nature of the transmitted data and its intended use. South Korean law mandates that companies clearly disclose how user data is collected, processed, and shared with third parties, as well as obtain explicit user consent. DeepSeek failed to meet these requirements. “The law requires that any third-party data sharing be accompanied by user consent, with clear disclosure of what data is collected, why it is collected, and how long it will be retained,” the commission stated. “DeepSeek’s privacy policy and terms of service did not meet these standards.”
This is not the first time DeepSeek has faced scrutiny over security concerns. According to ABC News, North American cybersecurity firm Feroot Security previously decrypted DeepSeek’s code and discovered a concealed function that transmitted user data to China Mobile, a state-owned telecommunications company. Additionally, the app does not allow users to opt out of data collection.
Following the launch of DeepSeek’s latest AI model, R1, last month, the PIPC reviewed the app’s privacy policy, terms of service, and key security measures. A technical analysis of data transmissions and traffic during usage confirmed that user data was being sent not only to DeepSeek but also to ByteDance. Upon discovering this, the commission ordered DeepSeek to halt app downloads, a directive the company complied with on Feb. 15, resulting in an indefinite suspension of its availability in South Korea. PIPC Vice Chairman Choi Jang-hyuk stated, “Service will resume once DeepSeek implements the necessary improvements to comply with domestic data protection laws.”
The commission identified two major violations. South Korean law requires companies to obtain separate user consent before sharing personal data with third parties and to disclose what data will be stored and for how long. DeepSeek failed to meet these obligations.
The more pressing concern, however, is that user data is being transmitted to ByteDance, a major Chinese platform company. “Our analysis of proxy server communications revealed that when users access DeepSeek, their data is also being transmitted to ByteDance,” a commission official said. “Further investigations will determine the specifics of the data being shared and the reasons behind the connection with ByteDance.”
