South Korea has accused Chinese AI startup DeepSeek of sharing user data with the owner of TikTok in China.
“We confirmed DeepSeek communicating with ByteDance,” the South Korean data protection regulator told Yonhap News Agency.
The country had already removed DeepSeek from app stores over the weekend over data protection concerns.
The Chinese app caused shockwaves in the AI world in January, wiping billions off global stock markets over claims its new model was trained at a much lower cost than US rivals such as ChatGPT.
Since then, multiple countries have warned that user data may not be properly protected, and in February a US cybersecurity company alleged potential data sharing between DeepSeek and ByteDance.
DeepSeek’s apparent overnight impact saw it shoot to the top of App Store charts in the UK, US and many other countries around the world – although it now sits far below ChatGPT in UK rankings.
In South Korea, it had been downloaded over a million times before being pulled from Apple and Google’s App Stores on Saturday evening.
Existing users can still access the app and use it on a web browser.
The data regulator, the Personal Information Protection Commission (PIPC), told South Korea’s Yonhap News Agency that despite finding a link between DeepSeek and ByteDance, it was “yet to confirm what data was transferred and to what extent”.
Critics of the Chinese state have long argued its National Intelligence Law allows the government to access any data it wants from Chinese companies.
However, ByteDance, headquartered in Beijing, is owned by a number of global investors – and others say the same law allows for the protection of private companies and personal data.
Fears over user data being sent to China was one of the reasons the US Supreme Court upheld a ban on TikTok, which is owned by ByteDance.
The US ban is on hold until 5 April as President Donald Trump attempts to broker a resolution.
Cybersecurity company Security Scorecard published a blog on DeepSeek on 10 February which suggested “multiple direct references to ByteDance-owned” services.
“These references suggest deep integration with ByteDance’s analytics and performance monitoring infrastructure,” it said in its review of DeepSeek’s Android app.
Security Scorecard expressed concern that along with privacy risks, DeepSeek “user behaviour and device metadata [are] likely sent to ByteDance servers”.
It also found data “being transmitted to domains linked to Chinese state-owned entities”.
On Monday, South Korea’s PIPC said it “found out traffic generated by third-party data transfers and insufficient transparency in DeepSeek’s privacy policy”.
It said DeepSeek was cooperating with the regulator, and acknowledged it had failed to to take into account South Korean privacy laws.
But the regulator advised users “exercise caution and avoid entering personal information into the chatbot”.
South Korea has already followed a number of countries such as Australia and Taiwan in banning DeepSeek from government devices.
The BBC has contacted the PIPC, ByteDance and DeepSeek’s parent company, High Flyer, for a response.