German regulators to investigate Chinese AI app DeepSeek
German data protection authorities announced plans to investigate the Chinese AI chatbot DeepSeek following concerns about extensive user data collection and lack of compliance with European privacy regulations. Security researchers also discovered an unsecured database connected to DeepSeek containing sensitive user information.
What happened
German data protection authorities announced in late January 2025 that they plan to investigate the Chinese AI application DeepSeek. According to the Rhineland-Palatinate Data Protection Commissioner Dieter Kugelmann, the app's privacy policies permit extensive collection of user information including IP addresses, chat histories, uploaded files, and keyboard typing patterns and rhythm.
German regulators noted that DeepSeek appears to lack a European headquarters and a designated legal representative, which would constitute a violation of GDPR. There is no data protection agreement between the EU and China that would establish a legal basis for data transfers between the regions.
Reported impact
The Italian data protection authority has already contacted DeepSeek with questions about its use of user data, expressing concern about the high risk posed to the data of millions of people.
Security researchers at Wiz discovered an unsecured ClickHouse database connected to DeepSeek that was publicly accessible without authentication, containing a significant volume of chat histories, backend data, and sensitive information including log streams and API secrets.
Index analysis
German data protection authorities including Rhineland-Palatinate and several others plan to jointly consult on what further steps to take. A questionnaire on data processing practices will likely be sent to the company as a first step.
The investigation was discussed at a mid-conference meeting of data protection authorities in Berlin in late January 2025.
Governance controls
GDPR requires that data transfers with non-EU countries occur only with nations whose data protection level is comparable to that of the European Union, and requires companies operating in the EU to have a legal representative and registered location.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.