The jury is still out on whether the Chinese AI upstart DeepSeek is a game changer or possibly part of an elaborate plan by its hedge fund parent company to short Nvidia and other tech stocks. Whichever it might be (maybe both?), DeepSeek and its large language model has made some major waves. Now, it’s catching the eye of data protection watchdogs. 

In what appears to be the first major move from one such watchdog since DeepSeek went positively viral in recent days, Euroconsumers, a coalition of consumer groups in Europe, has with the Italian Data Protection Authority filed a complaint related to how DeepSeek handles personal data in relation to GDPR, the data protection regulatory framework in Europe. 

The Italian DPA confirmed today that it subsequently wrote to DeepSeek with a request for information. “A rischio i dati di milioni di persone in Italia,” it notes. (“The data of millions of Italians is at risk.”) DeepSeek has 20 days to respond.

One key detail about DeepSeek that many noticed is the service is made and operates out of China. Per its privacy policy, this includes the information and data that DeepSeek collects and stores, which is also housed in its home country.

DeepSeek also briefly notes in its policy that when it transfers data to China from the country where DeepSeek is being used, it does so “in accordance with the requirements of applicable data protection laws.”  

But Euroconsumers — the organization that brought a successful case against Grok last year over how it used data to train its AI — and the Italian DPA want more detail. 

Addressing Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, the Italian DPA said it wants to know what personal data is collected, from which sources, and for which purposes – including what information is used to train its AI system – along with what the legal basis is for processing. It also wants more details on those servers in China. 

Further, it writes in its information request, it wants to know “in the event that personal data is collected through web scraping activities,” how users who are “registered and those not registered to the service have been or are informed about the processing of their data.”

The news outlet MLex notes that Euroconsumers also highlighted that there are no details regarding how DeepSeek protects or restricts minors on its services, from age verification to how it handles minors’ data.

(DeepSeek’s age policy notes that it is not intended for users under the age of 18, although it does not provide a way to enforce that. For those between the ages of 14 and 18, DeepSeek suggests these younger users read through the privacy policy with an adult.)

The consumer groups and the Italian watchdog are the first to make a move against DeepSeek. They might not be the last, although follow-ups may not be as swift. 

Earlier today, DeepSeek was a prime topic at a press conference at the European Commission. Thomas Regnier, Commission Spokesperson for Tech Sovereignty, was asked whether there are concerns at the European level over DeepSeek related to security, privacy, and censorship. Yet the main message was: it’s too soon to say anything about any investigations.

“The services offered in Europe will respect our rules,” Regnier noted, adding that the AI Act applies to all AI services offered in the region. 

He declined to say whether DeepSeek, in the EU’s estimation, respected those rules or not. He was then asked whether the app’s censorship on topics that are politically sensitive in China fell afoul of free speech rules in Europe and if that merited an investigation. “These are very early stages, I’m not talking about an investigation yet,” Regnier said quickly in response. “Our framework is solid enough to tackle potential issues if they are here.”

We have contacted DeepSeek regarding the Italian DPA complaint and will update this post as more information becomes available.