South Korea’s Personal Information Protection Commission (PIPC) has confirmed to Yonhap News Agency that Chinese AI startup DeepSeek has been transmitting user data to ByteDance, TikTok’s parent company. The discovery follows the removal of DeepSeek from South Korean app stores over data protection concerns.

The PIPC reports detecting third-party data transfers and a lack of transparency in DeepSeek’s privacy policy, though the regulator has not yet determined the scope and nature of the transferred data. DeepSeek acknowledges failing to comply with South Korean privacy laws and is currently cooperating with regulators.

Privacy and Security Concerns Mount

In a recent report, cybersecurity company Security Scorecard identified multiple direct references to ByteDance-owned services in DeepSeek’s Android app in February. 

Their analysis suggests integration with ByteDance’s analytics infrastructure and potential transmission of user behavior and device metadata to ByteDance servers. The company also detected data transfers to domains connected to Chinese state-owned entities.

Prior to its removal, DeepSeek had achieved over one million downloads in South Korea. While existing users retain access to the app and web platform, the PIPC advises against entering personal information into the chatbot. Several countries, including Australia and Taiwan, have already banned DeepSeek on government devices.

The investigation comes amid broader concerns about data protection and international data transfer practices. DeepSeek gained prominence in January when claims about its cost-effective training model compared to U.S. competitors temporarily impacted AI industry stock valuations. 

Beijing-based ByteDance maintains diverse global investor ownership, though debates continue about data access implications under Chinese law.