As Fondrie-Teitler noted, Kohler’s privacy policy says Kohler can use customer data to “create aggregated, de-identified and/or anonymized data, which we may use and share with third parties for our lawful business purposes, including to analyze and improve the Kohler Health Platform and our other products and services, to promote our business, and to train our AI and machine learning models.”
In its statement, Kohler said:
If a user consents (which is optional), Kohler Health may de-identify the data and use the de-identified data to train the AI that drives our product. This consent check-box is displayed in the Kohler Health app, is optional, and is not pre-checked.
Words matter
Kohler isn’t the first tech company to confuse people with its use of the term E2EE. In April, there was debate over whether Google was truly giving Gmail for business users E2EE, since, in addition to the sender and recipient having access to decrypted messages, people inside the users’ organization who deploy and manage the KACL (Key Access Control List) server can access the key necessary for decryption.
In general, what matters most is whether the product provides the security users demand. As Ars Technica Senior Security Editor Dan Goodin wrote about Gmail’s E2EE debate:
“The new feature is of potential value to organizations that must comply with onerous regulations mandating end-to-end encryption. It most definitely isn’t suitable for consumers or anyone who wants sole control over the messages they send. Privacy advocates, take note.”
When the product in question is an Internet-connected camera that lives inside your toilet bowl, it’s important to ask whether any technology could ever make it private enough. For many, no proper terminology could rationalize such a device.
Still, if a company is going to push “health” products to people who may have health concerns and, perhaps, limited cybersecurity and tech privacy knowledge, there’s an onus on that company for clear and straightforward communication.
“Throwing security terms around that the public doesn’t understand to try and create an illusion of data privacy and security being a high priority for your company is misleading to the people who have bought your product,” Cross said.
