Every time your phone visits a website, even a secure one, it whispers the site’s name out loud before the encryption kicks in. Your ISP has been listening to that whisper for years. Android 17 is finally doing something about it.
Google announced that Android 17 will be the first major mobile operating system to ship with platform-wide support for Encrypted Client Hello, or ECH. Built with Alphabet’s Jigsaw unit, ECH encrypts the initial domain handshake that happens when your device connects to a website. That handshake, called the TLS ClientHello, has historically been sent in plain text. ISPs and network operators have used it for years to track which sites and apps people use, building behavioral profiles that feed targeted advertising systems.
So why does this matter now? Because HTTPS alone was never the full story. Millions of people assume that the padlock icon in their browser means no one can see where they are going. That assumption is wrong. HTTPS protects the content of your traffic, but the initial connection still exposes the domain name. ECH seals that gap. When combined with Private DNS, your ISP sees only the content delivery network handling the request, not the actual site you are visiting.
Google is also pushing app developers to adopt the OkHttp 5.5.0 networking library to bring ECH support into third-party apps, not just the browser. That’s the part worth watching. Browser-level privacy improvements are useful, but most people spend more time in apps than in browsers on mobile. If developers don’t update their networking code, ECH’s protections won’t reach the apps that arguably need it most.
Android 17 comes with several other network security changes worth knowing about:
- Protection against SMS blasters and fake cell towers that force phones onto insecure 2G networks, a cheap attack that costs criminals as little as $3,000 in hardware
- Local Network Protection, which requires apps to ask permission before scanning your home Wi-Fi for connected devices like smart TVs or cameras
- Certificate Transparency enforced by default, making it much harder for rogue certificate authorities to issue fake credentials that could enable silent interception of your web traffic
The broader picture here is that mobile networks have become a primary target for surveillance, both commercial and criminal. Carriers have financial incentives to track traffic. Bad actors exploit insecure protocols that the industry has been slow to retire. And users have had almost no visibility into any of it.
Google turning ECH on by default is a meaningful step because it removes the burden from users. Most people will never configure Private DNS or install a VPN. Building these protections into the platform, without requiring anyone to dig through settings, is how privacy improvements actually reach ordinary people. Still, the real test will be adoption among app developers and whether ISPs attempt to interfere with ECH traffic, something that has happened with other privacy standards before.
Android 17 does not solve every surveillance problem on mobile. But it does make passive ISP tracking significantly harder, and that’s not nothing.