The Italian Data Protection Authority (DPA) has launched an investigation into DeepSeek, the Chinese AI startup that has been making waves with its large language model, over concerns about its handling of personal data and compliance with the General Data Protection Regulation (GDPR). The move comes after Euroconsumers, a coalition of consumer groups in Europe, filed a complaint against DeepSeek, citing potential risks to the data of millions of Europeans.

The Italian DPA has written to DeepSeek, requesting information on how it collects, stores, and processes personal data, as well as its legal basis for doing so. The authority is also seeking details on the company's data transfer practices, particularly with regards to its servers in China. This marks the first major move by a data protection watchdog against DeepSeek since it gained popularity in recent days.

One key aspect of DeepSeek's practices that has raised eyebrows is its storage of user data in China, which has sparked concerns about the potential risks to European users. According to its privacy policy, DeepSeek collects and stores user information in its home country, but claims to do so in accordance with applicable data protection laws. However, Euroconsumers and the Italian DPA are seeking more clarity on these practices, particularly with regards to the company's use of web scraping activities to collect data.

The investigation is also scrutinizing DeepSeek's age policy, which notes that the service is not intended for users under 18, but does not provide a way to enforce this restriction. The company suggests that users between 14 and 18 read through its privacy policy with an adult, but Euroconsumers has highlighted the lack of details on how DeepSeek protects or restricts minors on its services.

The European Commission has also weighed in on the issue, with Commission Spokesperson for Tech Sovereignty Thomas Regnier stating that the services offered in Europe will respect EU rules. However, Regnier declined to say whether DeepSeek's practices comply with these rules, citing the need for further investigation. The AI Act, which applies to all AI services offered in the EU, will be used to assess DeepSeek's compliance.

The investigation into DeepSeek's data handling practices is likely to be closely watched, given the growing concerns about the potential risks of AI startups to user privacy and data security. As the first major move against DeepSeek, it sets a precedent for future scrutiny of the company's practices and may have implications for other AI startups operating in the EU.

This article will be updated as more information becomes available. DeepSeek has been contacted for comment on the Italian DPA complaint.