Android 17 hides which websites you visit from your Wi-Fi and mobile provider
Google's next Android release turns on Encrypted Client Hello by default, blocks silent local network scans, and lets carriers switch off the ageing 2G network that fraudsters abuse.
Key points
- Android 17 turns on Encrypted Client Hello (ECH) by default for apps using modern networking libraries, hiding the name of the website you visit from your internet provider.
- Chrome 117 and Firefox 119 already support ECH inside their browsers; Android 17 pushes the protection down to the whole phone.
- Apps must now ask permission before scanning devices on your home Wi-Fi, closing a long-standing privacy gap.
- Participating mobile carriers can automatically switch off 2G on subscribers' phones to block SMS blasters and fake cell towers.
- Google's Jigsaw team tested the new system against the top 10,000 domains across 740 providers in 202 countries and found no breakage.
Google is rolling out a batch of network privacy changes in Android 17 that together make it much harder for internet providers, café Wi-Fi operators and nearby criminals to see what you do on your phone.
The headline feature is called Encrypted Client Hello, or ECH. It plugs a leak in the TLS handshake that has been quietly exploitable for years.
What does Encrypted Client Hello actually do?
ECH hides the name of the website your phone is trying to reach. Even when you visit a site over HTTPS, the very first message your phone sends contains the site's name in plain text inside a field called the Server Name Indication. Your provider can log it, and build profiles from it.
ECH encrypts that opening message. To the network, every connection looks like generic traffic to a large hosting provider, not to a specific bank or dating site.
Android users who browse with Chrome 117 or Firefox 119 already get ECH inside those browsers. Android 17 moves it down to the operating system, so any app built on OkHttp, WebView or HttpEngine inherits the protection automatically. We covered Google's parallel push to harden its cloud-level cryptography on 14 August 2026; ECH is a different layer of the same long game.
What happens on sites that don't support it?
Android still pretends they do. The phone sends a decoy field called ECH GREASE that looks identical to a real encrypted hello. A snooping network can't single out ECH users as unusual.
Google's Jigsaw unit, which works on anti-censorship tools, ran that decoy traffic against the world's 10,000 busiest domains across 740 different internet providers in 202 countries. Nothing broke.
The other Android 17 network changes
Three more shifts land alongside ECH. Each is small on its own; together they close doors that have been quietly open for years.
| Change | What it does | Who it protects you from |
|---|---|---|
| Local Network Protection | Apps must ask permission before scanning your home Wi-Fi | Nosy apps mapping your printers, cameras and smart bulbs |
| Certificate Transparency on by default | Website certificates must appear in public logs | Attackers using forged certificates to impersonate real sites |
| Optional 2G shutdown | Carriers can switch off the old 2G network per subscriber | SMS blasters and fake base stations parked near you |
The 2G change matters more than it sounds. Criminals drive around with suitcase-sized devices called SMS blasters that impersonate a mobile tower, force nearby phones to drop to 2G, and then push fake bank or delivery texts straight to the handset. Turn 2G off and the attack fails at the first step.
Should you worry that ECH still won't cover everything?
Yes, a little. ECH hides metadata about where you go. It doesn't stop a phishing site from stealing your password if you type it in, and it doesn't stop session cookies being lifted from a compromised device. Multi-factor authentication, ideally a passkey, still stops the account takeover at the end of that chain.
What Android 17 does is strip away the easy commercial surveillance that has quietly funded the mobile ad economy, and remove a few of the cruder tools criminals use on public networks. The vendors won't oversell this one: it's infrastructure plumbing, unglamorous and genuinely useful.
