Korean PIPC’s corrective recommendations to DeepSeek: no separate consent for transfers, user input sent to Volcano, no domestic agent
Subject: Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
What happened
DeepSeek launched its R1 LLM chatbot in Korea on 15 January 2025 with a privacy policy available only in Chinese and English. The PIPC sent an inquiry on 31 January 2025 and ran a technical analysis with the Korea Internet & Security Agency (KISA), which found third-party data transfer traffic and insufficient transparency in the privacy policy.
How it was handled
The PIPC ran its status examination and identified: a privacy policy lacking destruction procedures and methods, details of safeguards in place and the chief privacy officer’s name and contact details, while referencing collection of keystroke patterns and rhythms; transfers of users’ personal data to servers in China and the US without separate consent and without disclosure in the privacy policy; transfers of device information, user networks, applications and user input to Beijing Volcano Engine Technology Co., Ltd.; no opt-out from having user input used for AI development and training; and no age-verification procedure despite claiming not to collect data on children under 14. During the examination DeepSeek suspended new downloads on the App Store and Google Play.
Outcome
The PIPC concluded its deliberation on 23 April 2025. The recommendations for correction were: establish robust legal bases for cross-border transfer, destroy the user-entered data transferred to Volcano, and increase transparency in service provision. The recommendations for improvement were: implement the stronger safeguards recommended by the PIPC, check whether children’s personal data was collected and destroy it, overhaul the overall personal data processing system and upgrade safety measures, and designate a domestic agent. During remediation DeepSeek added opt-out for training on user input on 17 March 2025, submitted a Korean-language privacy policy on 28 March 2025, and blocked the transfer of user input from 10 April 2025.
What it means for Chinese exporters
- · Do three things before launch: a privacy policy in the local language, a domestic agent, and separate consent for cross-border transfer. Korea’s PIPA requires transfers to rest on one of the routes in Art. 28-8, and the consent route must be separate consent, not a tick buried in general terms of service.
- · Chinese cloud services inside your own stack are a hidden transfer channel. Put every third-party component — CDN, logging, APM, A/B testing, risk control, support ticketing, inference acceleration — into the data-flow map and confirm the destination country and recipient entity for each; what was named here was a cloud service used for security and experience optimisation.
- · "Does the user input need to leave the country at all?" is a question regulators ask directly. The PIPC found the transfer of user input unnecessary and the company blocked it. Design for minimisation by default: prompts stay in-region unless necessity can be argued item by item.
- · An opt-out from model training is now a de facto threshold in Korea and the EU. Build it as a product capability — a training-purpose switch, a record of when it took effect, and retroactive deletion of historical data — not a sentence in the privacy policy.
- · The regulator worked with the national cyber agency on traffic-level technical analysis. Whatever the privacy policy claims can be verified on the wire — do not list collection items that do not match the implementation (here "keystroke patterns" were listed but the company said they were not actually collected, and it still counted as a transparency problem).
Related regulations
Sources (1)
- Korean PIPC announces the results of its status examination of the DeepSeek servicePersonal Information Protection Commission, Republic of Korea (PIPC) · published 2025-04-30 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.