South Korea’s data protection authority announced Thursday that Chinese artificial intelligence startup DeepSeek unlawfully transferred user data and AI prompts to entities in China and the United States without user consent, prompting regulatory action.

According to an official statement, DeepSeek’s app, which launched in South Korea in January, transmitted personal data and AI command inputs—commonly referred to as prompts—to several foreign companies, including Volcano Engine Technology, a Beijing-based firm. The app also collected device and network information from users.

The Personal Information Protection Commission (PIPC) stated that DeepSeek failed to secure proper user consent before transferring sensitive data, in violation of South Korea’s data protection regulations.

App Download Suspended, Directive Issued

In response, South Korean regulators suspended new downloads of the DeepSeek app in February and have now issued an amended directive. The company is required to immediately delete all AI prompt data sent to Volcano Engine and to establish a clear legal basis for future cross-border data transfers.

DeepSeek later claimed that the transmission of AI prompts and data was aimed at "improving user experience," but reported that such transfers were halted as of April 10.

International Response

The Chinese Ministry of Foreign Affairs denied allegations of state-ordered data collection, asserting that China does not compel private companies to violate data privacy laws abroad.

This incident adds to growing scrutiny of AI startups and digital platforms in South Korea, where regulators are tightening enforcement on the handling of personal data, especially when transmitted across borders.

As AI adoption surges globally, South Korean authorities have made it clear that any platform—foreign or domestic—must adhere to local privacy and security regulations.