'Deeply Seeking' your personal, Behavioral and Professional Information

by Vikram Venkatasubramanian

(5 min read)

DeepSeek stunned the world and rattled the financial markets with the release of their app a few weeks back. The app became the number one downloaded app overnight. Enough is being written and speculated about the value and implications of the various large language models as well as the hardware and software that will be needed for the various use cases. So, no I will not be addressing ANY of that here. Despite the initial rush to download and try the app, over the weeks that followed, security and privacy concerns around the app started to come to the fore. Since that time, here is what has happened:

Texas, New York, Virginia and Iowa banned the use of the app on all state owned devices
Oregon, Nevada and North Carolina enacted bans on a department policy basis
Kansas House Bill 2313 seeks to ban use of AI models from China, Cuba, North Korea, Russia, Venezuela and Iran from all state owned devices
South Korea, Italy, Taiwan and Australia issued bans across various governmental departments

Ok, so why these bans against the app? One advantage of the DeepSeek AI model is that you can download the model and run it on your own hardware in your own country. WONDERFUL!! But, that is NOT the case when you download and use the DeepSeek AI Assistant app! The app behaves differently from the open source model. A detailed read of their Privacy Policy yields a LOT of information that serve as legitimate basis for these actions by various state and national governments. So, let us go through the bread crumbs of evidence.

Snippet from DeepSeek AI Assistant App Privacy Policy

Can we do a sanity check?

So, where is the data stored?
- If you use the app, your data is sent to computer servers in China (see picture above). Credit where credit is due, they DO explicitly state this in their privacy policy. Caveat emptor!
So, who has access to this data?
- The 'Data Controller' is identified as two entities - Hangzhou DeepSeek Artificial Intelligence Co., Ltd., and Beijing DeepSeek Artificial Intelligence Co., Ltd. Given there is no detail provided on which entity has access to what and the extent of access, we must assume both entities have access to your data.
- Rather oddly, the privacy policy does not provide a link to the websites of either of these entities nor does an internet search of these entities reveal a website to either.
- The terms of service agreement notes an address of 5th Floor, North Building, Block C, Rongke Information Center, No.2 South Science Academy Road, Haidian District, Beijing, China which turns out to be a building on a university campus (thanks Google Maps!). There is no clear address readily available of the address for the Hangzhou entity. In other words, the Terms of Service and Privacy Policy agreements that you sign when using the app are essentially with two rather nebulous entities.
What do they collect?
- They are rather explicit and articulate about this topic in the Privacy Policy. There are three types of information collected:
  - Information you provide: This includes user id, email, profile information, etc i.e. information that is directly linked to you.
  - Automatically collected information: This includes your device identifiers but also very interestingly your keystrokes patterns and rhythms. This enables them to do cross mapping of device behavioral data with human behavioral data and uniquely identity both users and devices.
  - Information from other sources: This gets VERY INTERESTING! They access information about you from advertisers to learn about your behaviors across websites and apps outside of DeepSeek including your shopping patterns (online and in person!), your internet browsing habits and more!

The net effect of all of the data collection and correlation is that the app and the underlying service has a clear human digital fingerprint of the user irrespective of which device they use and a clear device fingerprint of all devices used to access the service. What is also interesting is that the disclosures in the Privacy Policy clearly indicate that they are indeed collecting and correlating information and linking it to the user identity. This is a HUGE privacy and security risk!

Now, let us keep in mind that most users who down the app from their favorite app store WILL NOT take the time to review the above mentioned Privacy Policy in detail. A small subset of users might review the 'App Privacy' section of the app store. Note that the App Privacy section in the app store is information that is self-reported by app makers to companies like Apple and Google as part of their app store listing. We reviewed this and found a serious discrepancy. As noted above, hidden in the language of the Privacy Policy is the disclosure that they do indeed link the information collected about you to your identity. However, take a look at the picture below of what they disclose they collect and specifically the context of collection. There is misrepresentation of what they collect as well as how it is connected to the user. All this being said, it is also only fair to point out that the Terms of Service document associated with the DeepSeek app explicitly states that all inputs to the app are the user's responsibility - which put simply means, 'we told you so and if you use the app, you understand the risks'.

There is a clear inconsistency between the Apple App Store self reported disclosure by DeepSeek and the full Privacy Policy!

They are not alone - why pick on them?

Don't American companies also indulge in similar privacy violating practices? How is this any different or more dangerous than what data brokers do? All good points and true indeed. My main concerns with this app hinge around two key points:

Downstream impact: DeepSeek is an advanced AI tool collecting everything it can about you from sources known and unknown. The data you provide explicitly and implicitly are both used to further train their models and improve the efficiency of their AI but can also be used to manipulate results or outputs in ways specific to you.
Enforceability: The Terms of Service(TOS) users agree to is under the governing law and jurisdiction of mainland China as noted in Section 9 of the TOS. Hard to believe that individual Americans (not corporations) will have much of success litigating in that jurisdiction.

When the app is free, you are the product. When the entities you are dealing with are nebulous and the laws covering the transaction are not well understood or have not been proven to protect American consumers, there is less scope for trust especially when it comes to our personal, behavioral or professional data. This is not to say there are no use cases for this app in the consumer context. I may, for example, use it to generate dad jokes. No harm there ... :-)