This week’s feeds and headlines were filled with the surprise release of a Chinese rival to ChatGPT called DeepSeek. Euroconsumers and its members were first out of the blocks to protect consumers from potentially harmful data security and privacy issues: 

Monday 20 January 2025: DeepSeek GenAI Chatbot released 

Monday 27 January 2025: DeepSeek app is downloaded an estimated 2.6 million times and hits the top of the Apple and Google appstore charts.

Tuesday 28 January 2025:  Euroconsumers and Altroconsumo publish an analysis of DeepSeek’s data policies which identifies breaches of GDPR and serious concerns about consumers’ data security and protection.

Tuesday 28 January 2025:  Euroconsumers and Altroconsumo submit the report to Garante – the Italian data protection authority and request a temporary restriction on the service.

Tuesday 28 January 2025:  Garante sends a formal request to DeepSeek for more information on their data practices and potential infringements of EU data law

Wednesday 29 January 2025:  Euroconsumers member Testachats/Testaankoop issues complaint on DeepSeek’s data usage policies to the Belgian Data Protection Authority (ADP)

Thursday 30 January 2025: Belgium’s Data Protection Authority launches an investigation into DeepSeek

Thursday 30 January 2025: Italy’s Data Protection Authority blocks DeepSeek 

Thursday 30 January 2025: Euroconsumers member Deco Proteste files complaint on the same basis to its National Data Protection Commission, the CNDP 

Friday 31 January 2025: Euroconsumers Spanish member OCU files a complaint to AEPD – Spain’s data protection agency

Friday 31 January 2025: Euroconsumers’ members in Spain, Belgium and Portugal will point to the decision of the Italian DPA and ask for similar action in their countries.

The full story of DeepSeek and Euroconsumers action

The DeepSeek app has quickly hit the top of appstore download charts.  What seems to have blindsided commentators and developers outside of China is that the trade restrictions on advanced chip technology that powers Generative AI have not deterred Chinese efforts to create a homegrown ChatGPT type service.

In fact, fewer chips and lower computing power means DeepSeek is more affordable, and could potentially open up a much more competitive market for GenAI.  

US companies and investors were left to absorb the shock of billions wiped from their share price, and a realization that their country’s lead position on AI was not as solid as they thought. 

Standing up for consumers in GenAI

However, while the markets reacted, people downloaded and governments strategised, Euroconsumers and its members were standing up for consumers’ interests by scrutinising DeepSeek’s handling of people’s personal data.

Non-EU companies like DeepSeek AI must comply with the EU’s General Data Protection Regulation (GDPR) if they are offering of goods or services to European data subjects.

The analysis has found that DeepSeek’s data processing is contrary to the GDPR. Our Italian member, Altroconsumo filed a report with the Italian Data Protection Authority requesting a temporary restriction on DeepSeek’s processing of Italian users personal data due to several concerns including: 

1. Personal data of European users is transferred to China without proper safeguards (e.g. standard contractual clauses (SCCs) or binding corporate rules (BCRs). Chinese law allows state access to data without guarantees of transparency or proportionality, but under the GDPR, personal data can only be transferred to a third country if that country is deemed to provide adequate levels of protection or if special agreements are in place
2. The privacy policy published on the official website reveals multiple violations of European and national data protection regulations
3. Incomplete Information: there is insufficient details on data retention, user rights, and data categories
4. Profiling: it is unclear if data is used for profiling or automated decisions
5. Rights of Data Subjects: there are ambiguous procedures for exercising rights
6. Children: there are no details on age verification or handling data of minors.

Working across borders to protect consumers’ data

The very next day, the agency known as Garante sent a request for information to the Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, the companies that provide the DeepSeek chatbot service to ascertain the level of risk for consumers. 

Garante have given the two companies until February 17th provide details on how the product complies with the GDPR in particular: what data is collected, for what purpose, where it is being stored and if it has been used to train the AI model.  

Very soon after the request for information, the DeepSeek app was blocked on both the iOS appstore and Google Play Store in Italy.

In Belgium, our member Testachats/Testaankoop was hot on the heels of Italy, filing a complaint with the Belgian Data Protection Authority. They were also quickly informed that the complaint was admissible and that an investigation would be opened.

Euroconsumers Portuguese organisation Deco Proteste has also filed a complaint on the same basis with its Data Protection Authority and Spanish member OCU will follow soon.

Euroconsumers want AI that innovates, empowers and protects consumers

Euroconsumers wants responsible AI that can build prosperity, inclusion, research breakthroughs and respond to the tangible needs of people. 

This will go hand in hand with a people-centered data economy where consumers can easily get value from their data and have control over how it is used. For this to happen, companies need to be transparent about their data practices and consumers be confident that they will be held to account for any misuse of customer data.

In the case of DeepSeek Euroconsumers and its membership have shown they are ready and waiting to take swift action on any AI operator who is not putting consumers first. 

Watch this space.