Google is building a meaningful privacy upgrade into Android 17: platform-level support for Encrypted Client Hello (ECH), a standard that hides which websites and apps you visit from your internet provider or the Wi-Fi operator at a coffee shop or airport. Right now, even when a connection is fully encrypted with HTTPS, the website’s domain name is still visible in the TLS handshake — a field called Server Name Indication (SNI) — which ISPs can and do collect for commercial profiling. ECH encrypts that field from the very start of the connection.
Android users on Chrome 117+ or Firefox 119+ already get ECH in those browsers, but Android 17 makes it a system-level default for all apps that use compatible networking libraries (OkHttp, WebView, or HttpEngine). For servers that don’t yet support ECH, Android will send a decoy ECH field so real ECH connections don’t stand out as a fingerprint. Google’s Jigsaw team tested this approach across the top 10,000 domains and 740 providers in 202 countries without finding blocking issues. Android 17 also adds Certificate Transparency by default (requiring website certificates to appear in public logs, making forged certificates visible), tightens Local Network Protection (apps must now ask permission before scanning your home network), and allows mobile carriers to disable 2G for subscribers — reducing exposure to SMS blasters and rogue base stations that capture nearby traffic.