DeepSeek Meteoric Rise and Growing Scrutiny Over Data Practices

The Chinese artificial intelligence company DeepSeek has rapidly emerged as a disruptive force in the AI industry. However, its sudden rise has led to increasing concerns regarding its data privacy practices and compliance with regulatory frameworks. While some view Deep Seek as a revolutionary player in the AI landscape, others suspect it may be part of a larger financial strategy orchestrated by its hedge fund parent company, possibly to influence the stock market. Regardless of speculation, Deep Seek has undeniably gained significant traction and, in doing so, has attracted the attention of European data protection authorities.

Italian Data Investigation into DeepSeek Compliance with GDPR

In what is considered one of the first major regulatory actions against Deep-Seek, Euro consumers—a coalition of European consumer advocacy groups—has collaborated with the Italian Data Protection Authority (DPA) to formally challenge the company’s data handling practices. The complaint raises concerns about Deep-Seek adherence to the General Data Protection Regulation (GDPR), a legal framework governing data privacy and security across the European Union.

The Italian DPA confirmed today that it has officially contacted DeepSeek with a request for detailed information regarding its data collection and processing methods. The watchdog issued a public warning, stating: “A rischio i dati di milioni di persone in Italia” (“The data of millions of Italians is at risk”). DeepSeek has been given 20 days to respond to this request.

Data Storage and Processing The China Factor

A key issue that has drawn attention is DeepSeek’s operational base in China. According to its privacy policy, DeepSeek collects, processes, and stores user data within China, raising concerns about cross-border data transfers. While the company asserts that these transfers comply with applicable data protection laws, regulators are demanding greater transparency regarding how user information is handled, stored, and safeguarded.

Euro consumers Concerns Lack of Clarity on Data Collection and AI Training

Euroconsumers, which previously led a successful case against AI chatbot Grok for improper data usage, is seeking answers regarding:

• The specific types of personal data DeepSeek collects
• The sources of this data
• The purposes for which it is used, particularly in AI model training
• The location and security measures of Deep-Seek data servers in China

Additionally, the Italian DPA has requested clarity on whether DeepSeek engages in web scraping activities to collect information from users who are not explicitly registered on the platform. If such practices are confirmed, regulators will assess whether affected individuals were properly informed of how their data is being used.

Concerns Over Minors Data Protection and Age Restrictions

Another significant concern raised in the complaint is the protection of minors using Deep-Seek services. The watchdog pointed out that DeepSeek has not provided sufficient details regarding its approach to age verification and restrictions on minors’ access to AI-powered tools.

While DeepSeek’s privacy policy states that its platform is not intended for users under 18, it lacks enforcement mechanisms to verify users’ ages effectively. Furthermore, it suggests that individuals between 14 and 18 should review the privacy policy with parental guidance, raising questions about whether minors’ data is adequately protected.

European Commission Position on DeepSeek Compliance with AI Regulations

DeepSeek’s rapid expansion into European markets has prompted broader discussions at the European Commission. During a recent press conference, Thomas Regnier, Commission Spokesperson for Tech Sovereignty, addressed concerns related to security, privacy, and censorship linked to DeepSeek’s services.

While the European Commission has yet to launch a formal investigation, Regnier emphasized that all AI services operating within Europe must adhere to the AI Act and GDPR. However, when asked whether DeepSeek currently complies with EU data regulations, he declined to provide a definitive answer. Questions regarding content censorship—particularly on politically sensitive topics in China—also remain unresolved, with EU officials indicating that it is too early to determine if the app’s policies violate free speech protections in Europe.

Potential Consequences for DeepSeek and the Future of AI Regulation

DeepSeek ongoing legal scrutiny could set a precedent for how AI companies operate within Europe. If the Italian DPA determines that DeepSeek’s practices violate GDPR, the company could face substantial penalties, including fines and potential restrictions on its operations within the European Union. Additionally, this case may prompt further investigations by other EU member states, increasing regulatory pressure on AI developers worldwide.

Conclusion

As artificial intelligence continues to evolve, regulatory bodies face the challenge of balancing technological advancements with stringent data protection laws. The investigation into DeepSeek underscores the growing concerns surrounding AI’s impact on user privacy, cross-border data transfers, and the ethical use of personal information. While DeepSeek has positioned itself as a leader in AI-driven solutions, its ability to maintain trust and compliance with global regulations will play a crucial role in shaping its future.

The coming weeks will be pivotal in determining whether DeepSeek can provide satisfactory answers to regulators or if it will face more extensive legal battles. As the AI industry moves forward, companies must prioritize transparency, ethical AI practices, and compliance with international privacy standards to ensure sustainable growth in an increasingly regulated digital landscape.