Are DeepSeek’s privacy policies cause for concern? Absolutely. DeepSeek, a Chinese AI chatbot akin to OpenAI’s ChatGPT, has rapidly become the most downloaded free app in the U.S. But as the U.S. moves to ban TikTok over its ties to China, DeepSeek’s meteoric rise has sparked major privacy fears.
Like many apps, DeepSeek requires users to accept its privacy policy before accessing its services. But few actually read it. Cybersecurity expert Adrianus Warmenhoven from NordVPN explains that DeepSeek’s English-language privacy policy clearly states that user data, including chats and responses, is stored on servers in China. This raises serious concerns due to China’s differing privacy and security standards, as well as its stringent data collection laws.
What Data Does DeepSeek Collect?
DeepSeek gathers a vast amount of user information under three categories:
1. Information You Provide
- Profile details (name, date of birth, email, phone number, password)
- Conversations, audio inputs, chat history, and uploaded files
- Verification details, such as proof of identity or age
2. Automatically Collected Information
- IP address, device ID, cookies, operating system, and usage data
- Keystroke patterns, system language, and performance diagnostics
- Payment details
3. Information from Other Sources
- Data from linked accounts (Google, Apple, etc.)
- Information from advertising and retail partners
What Does “Keystroke Patterns or Rhythms” Mean?
One particularly concerning data point is DeepSeek’s collection of “keystroke patterns or rhythms.” While this is not entirely uncommon—TikTok collects similar data—Instagram does not. Keystroke tracking can create a unique biometric identifier, distinguishing one user from another.
TikTok has clarified that this does not involve recording actual key presses but rather the timing between them. However, DeepSeek has not responded to inquiries for clarification. Given that its servers are in China, concerns over potential biometric surveillance and government data access are valid.
How Does DeepSeek Use Your Data?
DeepSeek utilizes collected data to:
- Deliver personalized ads and user notifications
- Improve AI models based on user inputs
- Comply with legal obligations and public interest tasks
- Share data within its corporate group and with law enforcement when required
WIRED’s analysis found that DeepSeek transmits data to Chinese tech giants like Baidu and Volces, further fueling concerns about data privacy and potential government surveillance.
Why Should You Be Concerned?
Many users underestimate the risks of data exposure. DeepSeek operates under China’s cybersecurity laws, which mandate compliance with government data requests. This means that:
- Your private conversations may be accessible to authorities
- Sensitive data could be misused or exploited
- AI models may be trained on your personal inputs without transparency
Moreover, DeepSeek has already faced cyberattacks. A recent large-scale attack forced the company to temporarily limit new registrations, highlighting the vulnerability of stored data.
How Can Users Protect Themselves?
Experts advise users to take proactive cybersecurity measures, including:
- Reviewing app privacy policies before granting access
- Limiting personal information shared with AI chatbots
- Using VPNs and encrypted platforms for sensitive queries
However, true data protection should not fall solely on individuals. Stronger data privacy laws are needed to hold companies accountable—whether they operate in China, the U.S., or elsewhere.
Final Thoughts
DeepSeek’s rapid success is undeniable, but so are the privacy risks it poses. Users must be aware of how their data is collected, stored, and potentially accessed. While AI-powered tools continue to evolve, the need for stronger global data protection policies has never been more urgent.
