DeepSeek under GDPR scrutiny: The EU on High Alert

Aurilex • 10 May 2025

DeepSeek: The New AI Sensation Faces Regulatory Heat Just Days After Record-Breaking Launch

Since its launch in January 2025, DeepSeek has revolutionized the world of artificial intelligence, overshadowing ChatGPT. In just seven days, this generative AI became the most downloaded application on European smartphones. However, only a few days after its release, the AI-based application came under scrutiny from EU institutions. It is now suspected of posing a risk to European users.


Data Storage in China


The main concern centers around the storage of user data and activity in China, without clear and appropriate safeguards, as stated in DeepSeek’s privacy policy. In the absence of an adequacy decision by the European Commission, the data controller is required to implement a protection mechanism  (such as standard contractual clauses or approved binding corporate rules). However, there is no indication that such measures have been implemented, making the data processing opaque. Moreover, DeepSeek has no establishment or representative in the EU. This detail is significant, as it effectively complicates the application of the GDPR, both in terms of users’ rights and potential sanctions imposed by European data protection authorities. This situation leaves European users in a vulnerable position.


This situation recalls the case of Clearview AI. This American company was fined 20 million euros by the CNIL in 2022 for non-compliant use of biometric data for facail recognition. This sanction was later increased in 2023 with a fine of 5.2 million euros, as the company had not paid the initial fine. The CEO had publicly stated that his company was not conducting any activities in Europe and believed it was not subject to the GDPR.


While the concerns regarding DeepSeek’s data storage practices are serious, they have not gone unnoticed by European regulators. As a result, several countries have begun to take action.


Deepseek in Europe’s Crosshairs


DeepSeek received its first ban in Italy a few days after its launch, following a statement by the Garante (Italian Data Protection Commission) dated January 30, 2025. DeepSeek is now no longer available on most Italian app stores, although it can still be accessed via a web browser. Beyond Italy, actions taken have been less severe. For example, the French CNIL and the Irish Data Protection Commission announced they would question DeepSeek to better understand how its system works and what risks it poses in terms of data protection. In Spain and Portugal, no official decisions have yet been made. Nonetheless, complaints have been filed by consumer associations. In Germany, several Länder data protection authorities have opened discussions in preparation for an investigation.


A Precedent: ChatGPT


This situation echoes that of ChatGPT. In 2023, the Italian authority imposed a temporary ban on the platform. An investigation revealed that OpenAI had used user data to train its system without a valid legal basis. Furthermore, it was also found that the system lacked any protective mechanisms for minors under the age of 13 against inappropriate content. ChatGPT was ultimately fined €15 million and required to conduct an information campaign for six months.


Prudent Recommendations


While awaiting the positions to be taken by the various EU Member States and the European Union itself, awareness campaigns have been conducted to reduce the risks associated with the use of DeepSeek. For instance, the Luxembourg data protection authority issued recommendations on this matter. It urges users to exercise caution by avoiding the disclosure of confidential data or refraining from installing DeepSeek on IT devices. It recommends favoring alternative solutions that comply with the GDPR and offer stronger guarantees in terms of security and respect for privacy.


Marco Mouchot, Trainee Lawyer

Christine Chai, Managing Partner, Attorney-at-Law


by Aurilex 16 April 2025
On April 16, 2025, Christine Chai, partner at Aurilex, was invited to speak at the seminar “ China–Europe Intellectual Property Protection in Practice: A Dual Perspective on Compliance and Risk Mitigation ,” jointly organized by Aurilex and Shanghai Sunhold Law Firm. The event brought together legal professionals from both Europe and China, offering in-depth analysis and practical guidance for companies navigating intellectual property (IP) protection across borders. As the representative speaker on European IP practice, Christine Chai delivered a detailed presentation covering the legal frameworks, registration strategies, and enforcement challenges businesses typically face when entering the European market. Navigating Dual Systems: EU-Wide vs. National IP Protections Christine highlighted the complexity of Europe’s IP system, which combines EU-wide mechanisms (such as EUTM and EPO filings) with country-specific rules. She emphasized the importance for businesses to align their IP strategies with this dual-layered structure. “For example,” she noted, “the actual use requirement under the EU Trademark Regulation means that companies must plan not only for registration but for active, timely use in the market.” Trade Fair Injunctions: A Real and Growing Risk Christine also warned Chinese companies about the increasing use of emergency injunctions during trade fairs in France and other EU countries. “There have been multiple cases where exhibitors faced injunctions on-site, resulting in booth closures and seizure of displayed goods. Without preemptive IP audits, companies expose themselves to serious operational disruptions,” she explained. The UPC: Centralization Comes with Strategy Shifts Addressing recent developments, Christine discussed the impact of the Unified Patent Court (UPC) on enforcement strategy in Europe. While the UPC offers streamlined litigation across multiple EU member states, it also requires companies to make deliberate choices between centralized and national enforcement routes. Joint Dialogue: Cross-Border Action Checklists During the joint dialogue session, Christine collaborated with the Chinese legal team to provide practical compliance checklists for cross-border business activities. She advised Chinese companies to: Conduct prior trademark and patent clearance in target EU countries; Evaluate whether to opt in or out of the UPC system; Prepare legal strategies in case of emergency injunctions or enforcement challenges. Likewise, she shared insights for European companies expanding into China, particularly on navigating local IP enforcement procedures and understanding the nuances of evidence collection in cases involving trade secrets. This seminar highlighted the increasing importance of IP compliance in cross-border business, especially as more Chinese companies “go global” and more European businesses expand into China. Aurilex remains committed to providing in-depth legal support tailored to the needs of international clients operating across jurisdictions.
by Aurilex 31 January 2025
Aurilex Recognized in WTR 1000: Leading Trademark Professional in 2025
by Aurilex 27 November 2024
EU design views must be consistent to be valid. A recent decision of the General Court of the EU confirms this requirement.
by Aurilex 11 November 2024
The General Court clarifies the evidence requirement for trademark use in the EU trademark law in a recent judgement.
by Aurilex 26 July 2024
One hundred years ago, from May 4 to July 27, 1924, the eighth Olympiad of the modern era was held in Paris. Already at that time, the International Olympic Committee paid attention to the protection of the Olympic intellectual properties. Below is the trademark filed in 1924 for the Olympic Games in Paris.
by Aurilex 8 July 2024
The departing question of this legal issue is as follows: does a distillery company, which only fills labeled bottles provides by a third party, infringe the trademark of others, if it turns out that the label provided by the third party is a trademark infringement?
by Aurilex 13 May 2024
Lesson from M&M's: Attention by changing the brand!
designer's right, trademark right, trademark protection, intellecutal property in France
by Aurilex 21 April 2024
After the end of collaboration, can the company still use a designer's name as a trademark ?
artificial intelligence, EU AI Act
by Aurilex 1 April 2024
The New EU AI Act will bring changes for artificial intelligence companies coming into the European Union.
More posts