In January 2025, Chinese AI company DeepSeek (full name: Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.) caused a furor in tech circles and beyond when it released its R1 model. The news even affected the stock price of tech company Nvidia, which is a major US-based supplier of AI hardware and software. <\/p>\n\n\n\n
R1 purportedly performs comparably \u2014 particularly in speed and efficiency \u2014 to other large language models. The most well-known of these come from American tech companies like OpenAI (ChatGPT) in which Microsoft has a significant investment, Meta (LLaMa), and Google (Gemini). <\/p>\n\n\n\n
What garnered a lot of attention was DeepSeek\u2019s claims that developing and training R1 was significantly cheaper and required a lot less computing power than the other companies\u2019 models: USD 6 million compared to USD 100 million for OpenAI\u2019s GPT-4, and about one-tenth the computing power required by Meta\u2019s LLaMa.<\/p>\n\n\n\n
However, DeepSeek has also caught the attention of EU regulators, with scrutiny, complaints, and a ban of R1 already being put in place. We look at EU data protection authorities\u2019 privacy concerns over R1, specific alleged violations and actions being taken, and what the future may hold for AI companies and their products, especially in the EU.<\/p>\n\n\n\n
According to a press release from Garante<\/a>, DeepSeek has claimed that EU data privacy laws like the GDPR<\/a> do not apply to the company, which is based in China. Regulators like Italy\u2019s Garante have questioned this, claiming that DeepSeek\u2019s operations clearly involve the processing of personal data of EU residents, thus making the GDPR and its extraterritorial scope applicable. Other laws like the AI Act<\/a> are also relevant.<\/p>\n\n\n\n If DeepSeek ignores EU regulatory requirements, EU residents\u2019 personal data may be collected and processed without individuals\u2019 knowledge or consent. The purposes for the processing, sharing with third parties, and international transfers of that data would also be performed without a valid legal basis under EU law. <\/p>\n\n\n\n EU residents\u2019 rights would additionally be violated in that they would have no ability to decline access to their personal data, to have processing stopped, or have their data deleted.<\/p>\n\n\n\n Let\u2019s look at how EU regulators have responded.<\/p>\n\n\n\n Several data protection authorities (DPA) in EU member states have weighed in over the last several weeks, and more may take action in the future \u2014 potentially as a bloc \u2014 as more information comes to light.<\/p>\n\n\n\n Italian DPA Garante ordered DeepSeek to block Italian access to R1<\/a>, so the app will not be available in Italian app stores. Users employing VPNs can still access it, however. This order came after DeepSeek failed to address Garante\u2019s concerns over its privacy policy, which makes no mention of the GDPR. Garante also received consumer complaints regarding DeekSeek.<\/p>\n\n\n\n Garante sought information from DeepSeek about what personal data R1 collects, from which sources, for what purposes, under what legal basis, and if the data is stored in China. The information DeepSeek provided was \u201cconsidered totally insufficient\u201d, leading to the order to block the app.<\/p>\n\n\n\n After levying the ban, Garante gave DeepSeek 20 days to provide details on how they process and store European users\u2019 data.<\/p>\n\n\n\n Several days after Garante ordered R1 blocked at the end of January, the Belgian data protection authority (DPA) confirmed that it had received a complaint about DeepSeek, though it declined to provide any additional details at that time.<\/p>\n\n\n\n The complaint was registered by consumer organization Testaankoop. Their sister organization in Portugal, Deco Proteste, also filed a complaint about DeepSeek with the Comiss\u00e3o Nacional de Protec\u00e7\u00e3o de Dados (CNPD), the Portuguese data protection authority.<\/p>\n\n\n\n Around the same time that complaint to the Belgian DPA was confirmed, Luxembourg\u2019s National Data Protection Commission (CNPD) commented that it had not yet received any complaints, but that they were aware of risks and may further examine DeepSeek\u2019s access to and processing of EU residents\u2019 personal data in conjunction with other DPAs across Europe.<\/p>\n\n\n\n Germany\u2019s regional DPAs have already begun discussing next steps regarding DeepSeek as well.<\/p>\n\n\n\n France\u2019s Commission nationale de l’informatique et des libert\u00e9s (CNIL) has confirmed that it\u2019s requesting additional information from DeepSeek, and that it is analyzing R1\u2019s functionality.<\/p>\n\n\n\n Ireland’s Data Protection Commission also requested information from DeepSeek about collection and processing of Irish residents\u2019 personal data. <\/p>\n\n\n\n Of note is that Ireland\u2019s Data Protection Commission is often the lead EU regulator for many large US tech companies due to the location of their EU operations in Ireland. However, none of DeepSeek\u2019s parent companies has set up EU headquarters or other legal presence \u2014 in Ireland or elsewhere in the EU.<\/p>\n\n\n\n The European Commission\u2019s deputy director-general of the justice directorate, Irena Moozov\u00e1, has stated that the Commission is examining whether DeepSeek has violated any EU laws. Additionally, digital affairs spokesperson Thomas Regnier has noted that, \u201cthe AI Act ensures services operating in the EU must comply with European regulations.\u201d<\/p>\n\n\n\n Brando Benifei, a Member of European Parliament and a key figure behind the AI Act, has also stressed the importance of transparency in developing AI, noting \u201cEurope must remain competitive while enforcing its human-centric, rights-based approach to AI, setting a global standard for ethical and transparent innovation\u201d.<\/p>\n\n\n\n How DeepSeek and its parent companies respond remains to be seen.<\/p>\n\n\n\n Investigations by EU DPAs will continue, and involvement by additional EU data protection authorities is likely, up to and including further bans. <\/p>\n\n\n\n Outside of Europe, DeepSeek has already been banned on some Canadian government mobile devices<\/a>, echoing a prior ruling against another Chinese app, ByteDance\u2019s popular TikTok.<\/p>\n\n\n\n DeepSeek\u2019s failure to address regulators\u2019 questions and concerns, along with the company\u2019s lack of EU operations or legal presence, also creates further questions and complexities. It remains to be seen if the company will comply with demands to block the app from EU user access, or comply with future rulings against it and pay any fines that might be levied.<\/p>\n\n\n\n In 2023 OpenAI\u2019s ChatGPT was temporarily banned in Italy and later fined EUR 15 million for privacy violations. That company is based in the US and does have an EU presence headquartered in Dublin.<\/p>\n\n\n\n DeepSeek was also a popular topic of conversation at the Artificial Intelligence Action Summit in Paris<\/a> the week of February 10, 2025. The topic of AI more broadly has already proven to be contentious at the event, with the UK and US refusing to sign an international agreement on AI<\/a> that pledges an open, inclusive, and ethical approach to developing the technology.\u00a0<\/p>\n\n\n\n This comes just days after Google ended a company ban<\/a> on using AI to develop weapons and surveillance tools.<\/p>\n\n\n\n EU regulators have stressed the importance of transparency where processing of individuals\u2019 personal data is concerned. Complaints and actions to date have also centered around violations of data subjects\u2019 rights under EU law.<\/p>\n\n\n\n Usercentrics believes that privacy is a human right, and our products, like Usercentrics CMP<\/a>, enable organizations to be transparent with their audiences about the data they collect and how they use it. The CMP also enables users to exercise their rights around consent and data use.<\/p>\n\n\n\n Increasingly, individuals are able to vote with their wallets \u2014 and their data \u2014 which is backed by more and more regulations codifying the right to data portability. Companies that embrace Privacy-Led Marketing<\/a> can focus on building trust and long-term relationships, rather than pursuing what they can get away with regarding collection and processing of personal data.<\/p>\n\n\n\n Usercentrics\u2019s products enable privacy compliance and transparency, and help deliver great user experience to help you build that trust and sustainably grow your business.<\/p>\n\n\n Smart businesses build sustainability with great customer experience. Provide your users with transparency and real choice. Try Usercentrics for free.<\/p>\n <\/div>\n <\/div>\n EU data protection authorities react to DeepSeek<\/h3>\n\n\n\n
Italy\u2019s Garante orders DeepSeek-R1 blocked<\/h3>\n\n\n\n
Belgium and Portugal\u2019s data protection authorities receive complaints about DeepSeek<\/h3>\n\n\n\n
Other EU privacy regulators seek answers from DeepSeek<\/h3>\n\n\n\n
The European Commission\u2019s reaction to DeepSeek<\/h3>\n\n\n\n
What\u2019s next for EU data privacy regulators and DeepSeek?<\/h2>\n\n\n\n
How Usercentrics helps<\/h2>\n\n\n\n