Explained: Why the government is worried about DeepSeek

Governments across the world are concerned about how the Chinese AI company collects and uses the data of its users. India's cybersecurity agencies are investigating the potential risks associated with DeepSeek

By Fazal Rahim Forbes India Staff

Published: Feb 11, 2025 06:35:23 PM IST

Updated: Feb 12, 2025 11:36:03 AM IST

Full Bio

Many governments around the world, including the Indian government, are worried about how the Chinese AI company collects and uses the data of its users. Image: Joan Cros/NurPhoto via Getty Images

Chinese AI (artificial intelligence) model DeepSeek has taken the world by storm. While its release has wiped out billions of dollars from the world’s biggest stock markets, it is giving sleepless nights to governments across the globe due to security concerns related to it.

Many, including the Indian government, are worried about how the Chinese AI company collects and uses the data of its users. Further, concerns over misinformation and the lack of accountability to the governments are adding fuel to the fire.

What data does It collect?

According to DeepSeek’s privacy policy, the app collects information such as name, date of birth, email address, telephone number, uploaded prompts, files and chat history. It also collects information on device models, IP addresses, cookies, payment information and user keystroke patterns.

Additionally, when the user logs in with third-party accounts, such as ones with Google or Apple, DeepSeek gets information on the user’s activity on other websites or apps through its advertising partners.

The privacy policy states that DeepSeek can share this data with its service providers, advertising, analytical partners and law enforcement agencies.

Also read: DeepSeek: Chinese AI firm making waves in Silicon Valley

What are the concerns?

“We store the information we collect in secure servers located in the People’s Republic of China,” reads DeepSeek's privacy policy document. This has become the bone of contention for foreign governments.

Chinese tech companies have long been suspected of providing user data to the Chinese government. The 2017 Chinese National Intelligence Law requires all tech companies to cooperate with law enforcement agencies and provide data when requested. Due to suspicions of surveillance, many Chinese tech companies, such as Huawei and TikTok, have been banned in several countries.

According to research by Feerot Security, a Canadian cybersecurity company, DeepSeek has a code that could send user data to China Mobile, a Chinese state-owned telecom company that has been banned in the US due to security concerns.

The placement of the DeepSeek’s data centres gives limited jurisdiction to the user country. Accessing the data of their citizen for any investigation—in case of a criminal or cybersecurity threat, for example—becomes complex. Further, the user country has limited information and control over how much user data is collected and in what manner it is being used.

How are the countries responding?

The Finance Ministry of India had cautioned its staff on the use of AI tools such as DeepSeek and ChatGPT. India’s cybersecurity agencies are investigating the potential risks associated with DeepSeek. According to several media reports, the Indian government will soon release an advisory on potential risks related to DeepSeek.

Similarly, many other countries are taking cautionary measures against DeepSeek. In the US, the Congress introduced a bill to ban DeepSeek on government devices for espionage-associated risks. Further, New /York State has banned DeepSeek from being used on government devices.

In South Korea, the Ministry of Trade, Industry and Energy has banned DeepSeek for government employees. Similarly, the Australian and Taiwan governments have also banned DeepSeek from all government devices. The Italian government has issued an order that restricts DeepSeek from processing Italian users’ data. The move came after the country sought DeepSeek for additional details on how the company was storing and processing user data.