Privacy violations: South Korean users’ data sent to China and the US
The case highlights growing international scrutiny over cross-border data transfers by AI companies, especially those based in China.
South Korea’s Personal Information Protection Commission (PIPC) has found that DeepSeek, a Chinese AI startup, transferred South Korean user data to companies in China and the United States without obtaining user consent or properly disclosing these actions in its privacy policy.
DeepSeek transmitted a range of user information, including AI prompts and technical data related to devices, networks, and applications. The data was sent to at least three companies in China and one in the United States. Among the recipients was Beijing Volcano Engine Technology, a cloud service platform linked to ByteDance, the parent company of TikTok.
These transfers occurred without clear user consent and were not mentioned in DeepSeek’s privacy policy when it launched its service in South Korea. The PIPC launched an investigation after the app gained popularity and suspended downloads in February 2025 due to privacy concerns.
DeepSeek admitted it had not fully considered South Korean data protection laws and expressed its willingness to cooperate with authorities. The company voluntarily halted new downloads and, as of 10 April, stopped transferring AI prompt data to the Chinese cloud service.
The PIPC issued a corrective recommendation requiring DeepSeek to destroy any AI prompt data previously sent to Beijing Volcano Engine Technology. It also ordered the company to establish legal procedures and consent mechanisms for future data transfers and update its Korean privacy policy.
Following partial compliance, DeepSeek’s app returned to South Korean app stores after a two-month suspension. Meanwhile, DeepSeek has faced similar restrictions in the United States, Taiwan, and Australia over data security issues.
China’s Ministry of Foreign Affairs responded to the allegations by emphasising the country’s commitment to data privacy and denying any requirements for illegal data collection.
