DeepSeek under GDPR scrutiny: The EU on High Alert
DeepSeek: The New AI Sensation Faces Regulatory Heat Just Days After Record-Breaking Launch

Since its launch in January 2025, DeepSeek has revolutionized the world of artificial intelligence, overshadowing ChatGPT. In just seven days, this generative AI became the most downloaded application on European smartphones. However, only a few days after its release, the AI-based application came under scrutiny from EU institutions. It is now suspected of posing a risk to European users.
Data Storage in China
The main concern centers around the storage of user data and activity in China, without clear and appropriate safeguards, as stated in DeepSeek’s privacy policy. In the absence of an adequacy decision by the European Commission, the data controller is required to implement a protection mechanism (such as standard contractual clauses or approved binding corporate rules). However, there is no indication that such measures have been implemented, making the data processing opaque. Moreover, DeepSeek has no establishment or representative in the EU. This detail is significant, as it effectively complicates the application of the GDPR, both in terms of users’ rights and potential sanctions imposed by European data protection authorities. This situation leaves European users in a vulnerable position.
This situation recalls the case of Clearview AI. This American company was fined 20 million euros by the CNIL in 2022 for non-compliant use of biometric data for facail recognition. This sanction was later increased in 2023 with a fine of 5.2 million euros, as the company had not paid the initial fine. The CEO had publicly stated that his company was not conducting any activities in Europe and believed it was not subject to the GDPR.
While the concerns regarding DeepSeek’s data storage practices are serious, they have not gone unnoticed by European regulators. As a result, several countries have begun to take action.
Deepseek in Europe’s Crosshairs
DeepSeek received its first ban in Italy a few days after its launch, following a statement by the Garante (Italian Data Protection Commission) dated January 30, 2025. DeepSeek is now no longer available on most Italian app stores, although it can still be accessed via a web browser. Beyond Italy, actions taken have been less severe. For example, the French CNIL and the Irish Data Protection Commission announced they would question DeepSeek to better understand how its system works and what risks it poses in terms of data protection. In Spain and Portugal, no official decisions have yet been made. Nonetheless, complaints have been filed by consumer associations. In Germany, several Länder data protection authorities have opened discussions in preparation for an investigation.
A Precedent: ChatGPT
This situation echoes that of ChatGPT. In 2023, the Italian authority imposed a temporary ban on the platform. An investigation revealed that OpenAI had used user data to train its system without a valid legal basis. Furthermore, it was also found that the system lacked any protective mechanisms for minors under the age of 13 against inappropriate content. ChatGPT was ultimately fined €15 million and required to conduct an information campaign for six months.
Prudent Recommendations
While awaiting the positions to be taken by the various EU Member States and the European Union itself, awareness campaigns have been conducted to reduce the risks associated with the use of DeepSeek. For instance, the Luxembourg data protection authority issued recommendations on this matter. It urges users to exercise caution by avoiding the disclosure of confidential data or refraining from installing DeepSeek on IT devices. It recommends favoring alternative solutions that comply with the GDPR and offer stronger guarantees in terms of security and respect for privacy.
Marco Mouchot, Trainee Lawyer
Christine Chai, Managing Partner, Attorney-at-Law

