DeepSeek, a Chinese artificial intelligence startup, experienced a rapid rise in popularity soon after launching in January, quickly climbing the mobile app store charts. However, this emergence coincided with a significant drop in the stock values of major technology firms, including NVIDIA.

Since its inception, DeepSeek has faced numerous controversies regarding its data handling practices. In light of these concerns, the Trump administration is contemplating a ban on DeepSeek’s operations in the United States.

In February, South Korea accused DeepSeek of sharing user data without consent with ByteDance, the parent company of TikTok. The South Korean regulatory authority did not initially disclose which specific data was shared or the extent of this transfer.

However, the Personal Information Protection Commission (PIPC) now asserts that DeepSeek illegally transmitted user data to multiple companies in China. The PIPC’s findings stem from a comprehensive privacy and security review of DeepSeek.

It revealed that during the app’s operation in South Korea until February, the company shared user data with firms in the US and China without obtaining the required user consent or properly informing consumers of its practices. One significant case highlighted by the regulator involved DeepSeek sending user AI prompt information to Beijing Volcano Engine Technology Co., a Chinese cloud service platform.

In addition to prompt data, this platform also received details about users’ devices, networks, and app usage. PIPC identified Volcano Engine as an affiliate of ByteDance, though it noted that the cloud service is a separate legal entity.

DeepSeek responded by stating that it initially transferred user data to the cloud platform to enhance user experience. However, they ceased the transfer of AI prompt content beginning April 10.

In response to the situation, the Chinese Foreign Ministry expressed unawareness of the specific claims from South Korea, emphasizing that they do not condone the collection of data through illegal means. Following its investigation, the PIPC recommended that DeepSeek destroy the transferred user data and establish a legal foundation for any future transfers of personal information outside South Korea.