Italy's Garante blocks DeepSeek: limitation on processing of Italian users' data (2025)

The problem

DeepSeek is a relational generative-AI chatbot offered in Italy, on the web and via app, by two Chinese companies: Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence (source). Italy’s data-protection regulator, the Garante per la protezione dei dati personali, sent the two companies an information request about their processing of Italian users’ personal data, and judged the reply inadequate: “The limitation order - imposed to protect Italian users’ data - follows the companies’ communication received today, whose content was deemed entirely unsatisfactory” (source). The Garante added that, “Contrary to what was found by the Authority, the companies declared that they do not operate in Italy and that European legislation does not apply to them” (source). This is a regulator-origin, adjudicated public record — a national data-protection authority ordering a live generative-AI operation halted — not a vendor case study.

What was built

The system under review was the DeepSeek generative-AI chatbot as provided to Italian users on the web and via app. The Garante acted against the two named companies that provide it — Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence (source).

The outcome

On 30 January 2025 the Garante ordered a halt. In its own words: “The Italian Data Protection Authority has ordered, as a matter of urgency and with immediate effect, the limitation on processing of Italian users’ data against Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, the Chinese companies that provide the DeepSeek chatbot service” (source). The same release states, “In addition to ordering the limitation on processing, the Authority also opened an investigation” (source).

Two independent newsrooms carried the order firsthand. The Reuters wire reported that “Italy’s data protection authority said on Thursday it had blocked Chinese artificial intelligence model DeepSeek over a lack of information on its use of personal data,” and that the information the companies had provided “was considered to totally insufficient” (source). SecurityAffairs reported that “The Italian Data Protection Authority has urgently and immediately ordered the restriction of data processing for Italian users by Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, the Chinese companies providing the DeepSeek chatbot service,” that the regulator acted “citing a lack of information on its use of users’ personal data,” and that “The Authority has also launched an investigation into the matter” (source).

As a practical effect around the time of the action, the assistant became unavailable to download in Italy: the Reuters wire reported that DeepSeek “could not be accessed on Wednesday in Apple or Google app stores in Italy” (source). This is a practical effect reported around the Garante’s action, not a direct Garante app-store takedown order.

(Scope note: this is a data-protection order by the Garante. It is distinct from Italy’s separate competition-authority (AGCM) consumer-protection case about DeepSeek’s hallucination-risk disclosures, and from the earlier Garante ChatGPT/OpenAI matter and the €15M OpenAI fine later annulled by the Court of Rome — none of those is relied on here. DeepSeek’s separate move to disable new registrations after a reported cyberattack is likewise not merged into this order.)

A note on the weakest link

The order itself rests on the strongest possible source — the Garante’s own adjudication (Tier 1, regulator-origin) — so the newsrooms corroborate rather than carry it. The weakest load-bearing source is the app-store detail: it is a single-wire, Reuters-only claim (a practical effect, not part of the Garante’s operative order), and even the Reuters text here is bound to a Yahoo News relay of the wire rather than a Reuters-hosted capture. It is carried as a non-critical supporting detail, not as part of what the regulator ordered.

How this was verified

• Method: Tier-1 regulator-origin adjudication — the Garante’s published release of 30 January 2025 (docweb 10097450, bilingual Italian/English on one page), the primary for the limitation order and the opened investigation. Every quoted line above was grep-matched this session against the local capture of that release and the two corroborating captures.
• Corroboration: both critical claims hold two independent newsrooms — the Reuters wire (relayed via Yahoo News) and SecurityAffairs — each reporting the restriction order and the opened investigation firsthand. The Garante is independent-origin and is not counted toward that corroboration.
• Date verified: checker round 1, 2026-08-10 (confidence 1.000; graduated to pending).
• What “verified” (green) would still require: a human confirming, on the Garante (or DeepSeek) record, the current status of the 30 January 2025 limitation order and the outcome of the investigation opened alongside it — whether it remains in force, was superseded, or led to a fine. Green never depends on the subject confirming its own numbers; it rests on the Garante’s order plus the independent public record. This page is pending (amber); no green badge is claimed.

Related case files

• Brazil’s ANPD halts Meta’s generative-AI training on Brazilians’ data — the closest sibling: another national data-protection authority ordering a live generative-AI data operation suspended by preventive measure, not a vendor claim.
• Spain’s AEPD orders Worldcoin to halt biometric iris-scanning — a regulator-origin enforcement in the same family, a European DPA using urgent measures to stop an automated system on GDPR grounds.
• Italy’s Garante fines Foodinho (Glovo) over its rider-management algorithm — the same authority, the Garante, ruling another automated system unlawful under the GDPR and ordering it changed.
• The ICO orders Serco Leisure to halt unlawful facial-recognition attendance monitoring — a UK data-protection authority striking down another automated system that processed personal data without a lawful basis.

Sources

1. Garante per la protezione dei dati personali · “Intelligenza artificiale: il Garante privacy blocca DeepSeek / Artificial intelligence: Italian SA blocks DeepSeek” (provvedimento docweb 10097450) · 2025-01-30 · https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10097450 — Tier 1 (regulator-origin primary; the adjudicating authority’s own bilingual release; independent-origin, not counted toward corroboration; local capture, Wayback 20250131152737).
2. Reuters (relayed via Yahoo News) · “Italy’s privacy watchdog blocks Chinese AI firm DeepSeek’s chatbot” · 2025-01-30 · https://www.yahoo.com/news/italys-privacy-watchdog-blocks-chinese-190225147.html — Tier 2 (Reuters wire carrying the block, the “totally insufficient” characterisation and the app-store unavailability firsthand; local capture, Wayback 20250130213821).
3. SecurityAffairs · “Italy’s Data Protection Authority Garante blocked the AI chatbot DeepSeek” · 2025-01-31 · https://securityaffairs.com/173680/security/italys-data-protection-authority-garante-blocked-deepseek.html — Tier 2 (independent security newsroom; states the restriction order and the opened investigation firsthand; local capture, Wayback 20250131174614).