Personal Information Protection Commission (PIPC) — Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
The PIPC announced preliminary results of its status examination into DeepSeek, issuing corrective recommendations for issues including privacy policies only in Chinese and English, unauthorized data transfers to China and the U.S. without user consent, and AI model training without user consent. Recommendations included creating a Korean privacy policy, ceasing unnecessary data transfers, introducing opt-out options for AI training data, implementing age verification, and destroying unlawfully transferred data.
Key takeaway — how to prevent this
Substantiate every AI marketing claim and don't sell AI built to deceive. Deceptive 'AI-powered' claims and AI tools designed for fraud are direct FTC targets.
Case brief
Read from the authority's press release on 2026-09-06. Every holding carries a short verbatim quote from that text.
- Decided by
- Personal Information Protection Commission
- Parties
- Personal Information Protection Commission v. Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
- Decision date
- April 23, 2025
- Remedy
- The PIPC issued recommendations for correction and improvement, requiring DeepSeek to establish legal bases for cross-border data transfers, immediately destroy user-entered data transferred to Volcano, disclose its privacy policy in Korean, upgrade safety measures, and designate a domestic agent.
- Appeal
- Appeal status not stated
Key holdings
The PIPC issued administrative recommendations for correction to DeepSeek to ensure legal compliance and transparency in service operations.
“The PIPC decided to issue recommendations for correction on DeepSeek to enhance transparency in providing services on an ongoing basis as follows:” — Administrative Disposition and Future Plans
DeepSeek transferred personal data to foreign servers without securing separate user consent or disclosing the transfers upon service launch in Korea.
“Still, it failed to obtain separate consent from users regarding cross-border data transfer and disclose the fact in its privacy policy with the launch of its services in Korea.” — 2. Cross-border Transfer of Personal Data
DeepSeek transferred user personal data to servers located in China and the United States to support service performance and functionality.
“DeepSeek transferred users’ personal data to servers located in China and the U.S. to improve service functionality, security, and customer support.” — 2. Cross-border Transfer of Personal Data
During the PIPC's examination, DeepSeek added features allowing users to opt-out of having their inputs used for AI model training.
“DeepSeek has added opt-out features associated with providing user-entered data for AI development and training since March 17, 2025, and notified the PIPC.” — 3. User Input for AI Model Development and Training
In plain English
The Personal Information Protection Commission of South Korea conducted a status examination of Hangzhou DeepSeek Artificial Intelligence Co., Ltd. regarding its artificial intelligence chatbot service. Following privacy concerns after the launch of its model on January 15, 2025, the authority sent an inquiry on January 31, 2025, and initiated a technical analysis with the Korea Internet & Security Agency. The examination revealed multiple compliance issues under South Korea's Personal Information Protection Act, including an initial lack of a Korean privacy policy, unconsented cross-border transfers of personal data to servers in China and the United States, third-party data transfers to Volcano, lack of opt-out options for model training on user input, and the absence of age verification for children under 14. During the examination, DeepSeek took voluntary corrective actions, such as releasing a Korean privacy policy on March 28, 2025, adding opt-out features for training data on March 17, 2025, blocking user input transfers to Volcano on April 10, 2025, and adding age verification measures. On April 23, 2025, the authority concluded deliberations and issued official recommendations for correction and improvement. DeepSeek must destroy user-entered data transferred to Volcano, establish robust legal bases for cross-border transfers, designate a domestic agent, and upgrade safety measures. DeepSeek must notify the commission of implementation results within 60 days.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.