Italy’s Data Protection Authority has officially requested information from DeepSeek, a Chinese AI firm, following a complaint filed by Euroconsumers. Concerns have arisen over how DeepSeek collects and processes personal data, particularly in relation to the GDPR.
The watchdog warns that the data of millions of Italians could be at risk and has given DeepSeek 20 days to respond. DeepSeek’s privacy policy states that data collected in various countries is stored in China, and while the company claims compliance with relevant laws, European regulators are demanding more transparency.
Euroconsumers, which previously challenged Grok over AI training data, is asking DeepSeek to clarify what personal information it gathers, from which sources, and how it is used.
The Italian authority specifically wants to know what legal basis DeepSeek has for processing this data and how its servers in China operate. Additional concerns have been raised over web scraping and whether users, both registered and unregistered, are informed about how their data is processed.
The investigation has also highlighted potential risks for minors. DeepSeek states that its services are not meant for users under 18, but critics argue that there are no clear measures in place to verify age or restrict minors’ access. This lack of enforcement raises concerns about whether the company adequately protects young users’ privacy.
While Italy is the first to take action against DeepSeek, it is unlikely to be the last. European officials are beginning to discuss the implications of DeepSeek’s operations, though the European Commission has yet to announce any formal investigation.
Commission spokesperson Thomas Regnier stated that all AI services in Europe must comply with the AI Act but refrained from commenting on whether DeepSeek currently meets those regulations.
