Earlier this year, the home‑goods maker Kohler launched a smart camera device called Dekoda — a toilet‑bowl attachment that photographs the contents of the bowl and analyzes the images to offer users insights into gut health.

Kohler’s marketing claimed that Dekoda data is protected with “end‑to‑end encryption,” presumably to allay privacy concerns by implying that only the user can view the images.

However, as security researcher Simon Fondrie‑Teitler pointed out, Kohler appears to have misused the term: what the company actually provides is standard transport‑layer encryption (TLS), not true end‑to‑end encryption in the sense used by secure messaging tools such as Signal or WhatsApp. In practice, that means data is encrypted while in transit (and at rest), but once it reaches Kohler’s servers it is decrypted and processed — so Kohler has access to the raw toilet images.

Kohler confirmed this interpretation: the company said that because the other “end” of the encrypted data stream is Kohler’s backend, it considered the phrasing legitimate. If users opted in (via a consent checkbox), Kohler may even use the de‑identified data to train AI models underpinning Dekoda’s analytics.

After being confronted, Kohler updated its website — removing references to “end‑to‑end encryption.” The new description says the product relies on “data encryption at rest and in transit.”

Dekoda retails for about US $599, and requires a subscription costing at least US $6.99 per month.