Restricting DeepSeek operations

In February 2025, regulators in Europe,¹ the US, and Australia imposed restrictions on the use of chatbot DeepSeek, as it is unclear how the company stores and processes user data. DeepSeek also transfers foreign user data to China, which raises questions about the legality of its transfer between jurisdictions.

The OECD, in its 2019 AI Recommendations, points to the need for transparency in the collection and processing of data by AI systems. China has not joined these Recommendations. The DeepSeek case demonstrates the trend toward stricter controls over foreign digital services that handle foreigners' personal data.

The US experience

In January-February 2025, a number of US states (New York, Texas, Virginia, Kansas, etc.) issued bans on DeepSeek for government employees' devices and networks, as the application can transmit user data to the Chinese government. Interestingly, in 2022- 2024, Texas and Virginia already imposed similar bans on TikTok, WeChat, Rednote, and² Lemon8.

A special bill has been proposed in Kansas to ban the use of “dangerous” AI platforms on state-issued devices and³ networks. State employees will not be able to install or access such platforms on their issued devices, and state networks must block their use. All state agencies are required to delete existing accounts and stop working with such AI. The only exception is for law enforcement and cybersecurity investigations. “Dangerous” AI is defined as DeepSeek and any models controlled by China, Russia, Iran, DPRK, Cuba, and Venezuela.

The experience of European

countries

In January-February 2025, a number of European countries banned the use of DeepSeek on government-owned devices⁴ (Italy ) or issued recommendations for citizens not to use DeepSeek (Poland, Netherlands, and Liechtenstein). Germany has launched an investigation into DeepSeek's violation of the EU General Data Protection Regulation (GDPR). The regulators have the following concerns about DeepSeek:

1. Lack of description of the purposes of user data collection, measures to ensure privacy and security of data storage (Art. 12 GDPR and Art. 50 of the EU AI Act).

2. Risk of illegal transfer of user data from the EU to China (violation of Articles 45 to 50⁵ GDPR). DeepSeek collects and stores data (IP addresses, chat history, files, keystroke patterns) on servers in China, which does not have a data protection agreement with the EU.

3. The absence of an official DeepSeek representative in the EU (Article 27 GDPR). This requirement applies to all companies collecting personal data in the EU and providing goods or services.

Russia’s experience

Russia has no special requirements for the storage of data processed by AI systems. On the one hand, China is on the list of states that provide adequate protection of the rights of⁶ personal data users. That is, personal data of users from Russia can be transferred to China, provided that Roskomnadzor is notified of this.

On the other hand, DeepSeek is still obligated to comply with data protection requirements, such as localization (storage) of Russian users' data on Russian servers.

From the monitoring issue No. 2 (14), February 2025. Download the full issue (PDF) · issue page at the Gaidar Institute