‘End-to-end encrypted’ smart toilet camera is not actually end-to-end encrypted

Earlier this year, Kohler introduced an innovative product known as the Dekoda, a smart camera designed to be mounted on toilet bowls. This device captures images of the toilet's interior and provides insights aimed at improving gut health. To address potential privacy concerns, Kohler asserted on its website that the Dekoda’s sensors exclusively focus on the toilet bowl and claimed that all data is protected by "end-to-end encryption." However, security researcher Simon Fondrie-Teitler highlighted significant inaccuracies in Kohler's assertions in a recent blog post. A closer examination of Kohler's privacy policy reveals that the company is actually referencing TLS encryption, which secures data as it transmits over the internet, similar to what powers HTTPS websites. This distinction is crucial, especially when addressing user privacy. The term "end-to-end encryption" is commonly associated with secure messaging services like iMessage, Signal, and WhatsApp. Misusing this terminology could mislead users into believing that Kohler lacks access to the images taken by the Dekoda, raising serious privacy implications. While a Kohler spokesperson did not provide comments to TechCrunch, a representative mentioned to Fondrie-Teitler that user data is encrypted when stored on devices and within their systems. Furthermore, the company indicated that data in transit is also encrypted, allowing it to be safely transmitted between the user's devices and Kohler's servers, where it is decrypted for processing. However, Fondrie-Teitler cautioned that since Kohler has access to the data on its servers, there is a possibility that images could be used to enhance AI algorithms. The company has stated that their algorithms are trained only on de-identified data. The Dekoda is priced at $599 and requires a subscription fee starting at $6.99 per month, making its privacy claims even more critical for potential buyers to consider.