Germany’s Deepseek Demand: A Closer Look at Data Transfer Concerns

Introduction

On June 27, 2025, Germany’s data protection commissioner, Meike Kamp, took a significant step by requesting that Apple and Google remove the Chinese AI app DeepSeek from their app stores in Germany.

This action stems from concerns that DeepSeek is unlawfully transferring user data to China, violating the European Union’s stringent data protection regulations.

Ronin Legal examines this latest development in the ongoing scrutiny of data privacy practices by international tech companies.

Background on Deepseek’s Data Practices

DeepSeek, a Chinese artificial intelligence startup, has gained attention for its cost-effective AI model and popular chatbot app, downloaded millions of times globally. It also attracted worldwide interest for having developed a fast and competitive model, despite its reliance on less advanced Nvidia chips. However, its data handling practices have raised certain red flags.

According to Meike Kamp, Berlin’s commissioner for data protection and freedom of information, DeepSeek transfers German users’ data to servers in China without ensuring protection equivalent to EU standards. This practice violates the EU’s General Data Protection Regulation (GDPR), which governs how personal data must be handled.

In May 2025, Kamp’s office had asked DeepSeek to comply with EU data transfer requirements or voluntarily withdraw its app from the German market. The company did not meet these demands, prompting the formal request to Apple and Google.

Further, she also expressed concern over the fact that Chinese authorities possess broad access privileges to personal data, that is within the operational reach or control of Chinese companies.

The core issue is that Chinese authorities have extensive access to personal data held by Chinese companies, creating a conflict with EU privacy laws.

Legal Framework: The GDPR and Data Transfers

The General Data Protection Regulation (GDPR), enacted in 2018, is one of the world’s most robust data protection frameworks. It restricts the transfer of personal data outside the EU, unless the destination country ensures that an adequate level of protection or appropriate safeguards are in place.

China lacks an EU adequacy decision, meaning companies like DeepSeek must implement measures like Standard Contractual Clauses (SCCs), requiring parties to ensure similar standards of privacy and data protection as the EU’s GDPR, through evaluations such as the Transfer Impact Assessment (TIA) during data transfers.

However, DeepSeek has not provided convincing evidence that it meets these standards. For example, the company’s privacy policy indicates that user data, including personal files and conversations, is stored on Chinese servers, where local laws allow government access for national security purposes. This lack of transparency and compliance has fuelled Germany’s concerns.

Responses From Key Stakeholders

As of July 1, 2025, DeepSeek has not issued a public statement addressing Germany’s allegations.

Google has confirmed that it has received the notice and is reviewing it, while Apple has not yet commented.

This is not DeepSeek’s first encounter with European regulators. In February 2025, Italy’s data protection authority, Garante, raised concerns about the app’s data handling practices.

In response, DeepSeek claimed it did not operate in Italy and therefore considered EU legislation inapplicable. However, Garante found the response unsatisfactory and proceeded to block the application.

Ireland also initiated an inquiry into DeepSeek’s data processing in January 2025. These actions suggest a growing European consensus on the risks posed by the app’s data practices.

Broader Implications

Germany’s request could have significant consequences. If Apple and Google comply, DeepSeek would lose access to the German market, a key part of the EU’s digital economy.

Furthermore, a ban in Germany could lead to similar actions across the EU, as GDPR applies uniformly across member states.

This case also underscores broader tensions between Chinese tech firms and Western regulators. Chinese companies often face challenges balancing local laws, which may require data sharing with the government, with international privacy standards.

For instance, a Reuters report alleged that DeepSeek supports China’s military and intelligence operations, adding to concerns about its data practices.

Global Context and Related Developments

The scrutiny of DeepSeek is part of a global trend. In the United States, lawmakers are considering a bill to ban Chinese-developed AI models in government agencies, citing national security risks.

In April 2025, South Korea’s Personal Information Protection Commission (PIPC) completed a status examination of DeepSeek following concerns about the app’s handling of personal data.

The investigation revealed significant issues including inadequate transparency in the privacy policy, unlawful cross-border data transfers to China and the U.S., and a lack of user consent mechanisms for data used in AI training.

The company was also found to have transferred user input to a third party, Beijing Volcano Engine Technology, without sufficient justification. DeepSeek has since made changes, including suspending downloads in Korea, updating its privacy policy, introducing opt-out features, and implementing age verification procedures.

The PIPC issued formal recommendations for correction and improvement, and will monitor DeepSeek’s compliance moving forward.

The Netherlands has banned DeepSeek on government devices, and Belgium has received complaints regarding the data privacy risks posed by it, potentially setting the stage for yet another investigation into the company’s practices. Spain’s consumer rights group requested an investigation in February 2025, though no ban is currently in place.

These actions reflect growing apprehension about the privacy and security implications of AI apps developed by companies under different data governance frameworks.

What Happens Next?

Apple and Google now face a critical decision. Complying with Germany’s request could set a precedent for how tech giants enforce GDPR compliance. If they remove DeepSeek, it may prompt other EU countries to follow suit, potentially leading to a broader ban. Conversely, non-compliance could lead to further regulatory action against the tech giants themselves.

For DeepSeek, the path forward involves addressing these concerns, possibly by restructuring its data handling practices to align with GDPR requirements. Failure to do so could limit its global expansion, particularly in privacy-conscious markets like the EU.

In the tech industry, this incident may prompt companies to reassess their data transfer practices, especially for countries without EU adequacy decisions. It could lead to increased use of data localization or enhanced security measures to ensure compliance.