Google published a detailed breakdown on August 27, 2026 of four network-level privacy and security upgrades shipped in Android 17, headlined by platform-wide support for Encrypted Client Hello (ECH) — a move that makes Android the first major mobile operating system to build the standard directly into the OS rather than leaving it to individual browsers or apps. The announcement confirmed what the update’s technical specifications had indicated since the June 16 stable release: Android 17 is the first major mobile OS to close the gap between what HTTPS promises and what it actually delivers.

HTTPS Never Hid Where You Were Going — Only What You Said

For years, the padlock icon in a browser address bar carried a specific promise: the content of your browsing is encrypted, and no one in the middle can read it. That promise has always had a significant gap that neither Google nor the security community has hidden, but that most ordinary users have never been told about clearly.

When a device initiates a secure connection, it performs a TLS handshake — a brief protocol negotiation before any encrypted data flows. During that handshake, a field called Server Name Indication (SNI) announces the destination hostname in plaintext, before any encryption takes hold. Every node between the device and the server — the mobile carrier, the home ISP, a public Wi-Fi operator, or anyone running packet-capture software on that network path — can read that field. SNI was specified in 2003 as RFC 3546 specifically to enable shared hosting (one IP address, many HTTPS domains), and its plaintext nature was a deliberate design trade at the time. What was not anticipated was two decades of ISPs building advertising businesses on that metadata.

A 2021 Federal Trade Commission report examining six major ISPs — covering approximately 98% of the US mobile internet market — found that those providers were continuously monitoring domain and browsing metadata, combining it with location data, app usage, and cross-device signals, and monetizing it through targeted advertising platforms. The report identified specific cases where ISPs combined browsing history with television-viewing records across product lines for ad targeting, and documented real-time location data sharing with third-party customers including car salesmen and bail bondsmen. Even users connecting to fully encrypted HTTPS sites, or using VPNs, were not protected from this particular form of surveillance — because the SNI field sits outside the encrypted payload.

That is the gap ECH was designed to close, and that Android 17 has now closed at the operating-system level.

What Encrypted Client Hello Actually Does

ECH is an extension to TLS 1.3, published as IETF RFC 9849 in March 2026, developed over several years through collaboration between Cloudflare, Fastly, Mozilla, academic researchers, and standards bodies. It works by splitting the TLS ClientHello message into two parts:

The outer ClientHello contains non-sensitive parameters — cipher suite preferences, TLS version — and a generic, shared outer SNI pointing to the content delivery network handling the connection. No specific destination is named. The outer SNI tells the network only which infrastructure cluster is handling the traffic.

The inner ClientHello contains the actual destination hostname, encrypted using a public key the destination server publishes in its DNS records. Only the destination server holds the corresponding private key and can decrypt the real SNI. Every node between the device and the server sees only the outer label.

With ECH active and private DNS also enabled, a mobile carrier or Wi-Fi operator monitoring traffic sees only the CDN handling the connection and how much data is moving — not the specific website or app being accessed.

In Android 17, this protection is built into the platform. Any app targeting API level 37 (Android 17) that uses a compatible networking library — specifically OkHttp 5.5.0 or Google’s HttpEngine — gets ECH automatically, enabled by default. Developers who have not yet upgraded their networking library will not pass ECH protection to their users; Google is actively working with partners to accelerate that transition.

ECH GREASE: Making Every Connection Look the Same

ECH alone has a structural vulnerability: if only some connections use it, an observer can trivially identify ECH-protected traffic by its shape and block it selectively. This is exactly the strategy that censors and network middleboxes would use to suppress adoption.

The solution is ECH GREASE (Generate Random Extensions And Sustain Extensibility) — a companion mechanism that sends fake, randomized ECH-like extensions on every connection, including connections to servers that do not support ECH. From outside, every connection looks identical. A network observer cannot distinguish real ECH from GREASE ECH, which means it cannot selectively block one without blocking both — defeating the selective-suppression strategy.

Jigsaw, the Alphabet technology incubator that partnered with Android on this feature, validated ECH GREASE against the top 10,000 global web domains across 202 countries and 740 ISPs, including networks in Russia and China. Their testing found zero connection failures globally compared to standard TLS, and a “virtually 0% network interference rate globally.” ECH GREASE is enabled by default in Android 17.

Nick Sullivan, co-author of the ECH standard and founder of Cryptography Consulting LLC (formerly head of research at Cloudflare), called the move significant: “ECH support for Android is a huge step towards closing one of the largest remaining structural privacy holes left on the Internet.”

Ehren Kret, CTO of Signal, described the rollout as “a crucial step forward for user protection” and called on developers to drive adoption across the ecosystem.

What ECH Does Not Do — and What Still Requires Action

ECH is specific in what it protects. It hides the SNI field in the TLS handshake. It does not:

• Hide IP addresses. The destination server’s IP address remains visible to the network. IP addresses can often be used to identify popular services, though shared IP addresses on major CDNs reduce this risk.
• Replace private DNS for the DNS lookup step. Domain name data leaks in two places: the initial DNS lookup and the TLS handshake. ECH closes the second leak; encrypted DNS (enabled separately via Android’s private DNS setting) is needed to close the first.
• Protect every connection immediately. ECH requires server-side adoption. Connections to sites that have not yet enabled ECH on their servers still expose the SNI field. Google is pushing developers and hosting providers to enable ECH, but the protection is partial until adoption spreads.

For enterprise environments, ECH introduces a deliberate tradeoff worth understanding. Many corporate networks use SNI-based traffic inspection — their firewalls read the plaintext SNI field to determine which connections to inspect, filter, or block, often for compliance or malware-prevention reasons. ECH makes the true SNI invisible to those firewalls, leaving them seeing only the CDN label. Google explicitly built administrative controls into Android 17 to address this: network administrators in managed environments can control ECH behavior via DNS settings, allowing corporate networks to maintain their inspection capabilities while preserving privacy on unmanaged consumer connections.

How Android Has Closed These Gaps Step by Step

The ECH announcement fits a multi-year architectural project. Android 9 (2018) introduced DNS-over-TLS, encrypting the DNS lookup step — the first of the two major domain-data leaks. Android 12 introduced a manual toggle allowing users to disable 2G hardware support, closing off one attack vector. Android 14 added protections against unencrypted network connections, and Android 15 added detection for cellular-network identifier requests. Android 16 consolidated these into a dedicated Mobile Network Security settings page.

Android 17 closes the second major TLS metadata leak — the SNI field — with ECH, and adds three additional network protections announced alongside it.

Carriers Can Now Disable 2G to Cut Off SMS Blasters

The second announced feature addresses a physical hardware attack that has escalated sharply in recent years: portable devices known as SMS blasters, or false cellular base stations.

These devices work by broadcasting high-power 2G signals that force nearby smartphones to drop their LTE or 5G connections and downgrade to legacy 2G networks. Once on 2G, those phones lose access to modern spam filtering and carrier-level scam detection; attackers can then push phishing texts directly to every device in range, bypassing all platform-level filters because the messages never travel through the legitimate carrier network.

Hardware costs have dropped to approximately $3,000, making these attacks accessible to organized criminal groups at scale. In Canada, police investigation Project Lighthouse — launched in November 2025 — documented three individuals operating an SMS blaster from a vehicle that moved around the Greater Toronto Area. Before they were arrested (two on March 31, 2026; a third turned himself in April 21, 2026), the device caused 13 million network disruptions — a figure that included temporary losses of 911 emergency service access for affected devices. In London, four defendants were sentenced in 2026 for carrying suitcase-style SMS blasters through Underground stations, targeting commuters with fake parcel-delivery phishing texts.

Android 12 gave users a manual toggle to disable 2G. Android 17 upgrades this to a zero-click carrier-side solution: participating mobile carriers can now disable 2G by default for their subscribers, proactively removing the attack surface before it can be exploited. Google has not yet specified which carriers are participating in the program, but the infrastructure is now in place for carriers to activate it.

Apps Can No Longer Silently Map Your Home Network

The third feature addresses a quieter surveillance vector: app-level local network reconnaissance.

Until Android 17, apps could silently probe a user’s home Wi-Fi network, discovering and mapping every connected device — smart TVs, security cameras, routers, printers, and other hardware — without disclosing this activity or requesting permission. This capability has been documented in use for device fingerprinting (building device-signature profiles useful for cross-device tracking) and for identifying potentially vulnerable hardware on a network that an app could later exploit or report.

Android 17 enforces Local Network Protection: apps must now explicitly request user permission before scanning or connecting to local network devices. For common use cases — casting video to a television, for example — Google has provided a secure system interface that allows users to select their target device without the app gaining visibility into the rest of the network.

Certificate Transparency Now Applies to Every Certificate by Default

The fourth feature is Certificate Transparency (CT) enforcement by default. CT requires every TLS certificate to be recorded in a publicly accessible, append-only log before a browser or app will trust it.

The threat CT addresses is certificate misissuance: if a certificate authority is breached or coerced — by a state actor, for instance — into issuing a fraudulent certificate for a domain it does not control, that certificate could be used to intercept TLS traffic without the certificate appearing fraudulent to the connecting device. With CT, that fraudulent certificate would appear in the public log, where automated monitors can flag it and trigger revocation. Before Android 17 made it a default, CT required each developer to implement it individually; it now applies to all apps running on the platform.

How Significant Is the ECH Privacy Advance?

ECH represents a genuine privacy advance for mobile users, but its significance is proportional to what it replaced — which was nothing. For users who already run a VPN, ECH adds a layer of protection in the specific window where a VPN provider itself could see domain metadata (between the device and the VPN server). For users without a VPN, ECH moves ISP visibility from “every domain they visit” to “which CDN or server cluster they’re routing through.” That is a meaningful reduction in surveillance granularity.

What ECH does not do — and cannot do alone — is make mobile internet activity anonymous. IP addresses, connection volumes, timing patterns, and device fingerprints all remain available to networks with the capability and motivation to collect them. ECH is one layer in a stack that also requires encrypted DNS, private browsing modes, and potentially a VPN for users with specific threat models.

David Kleidermacher, VP of Engineering for Android Security and Privacy, framed the company’s position this way in the Jigsaw blog published August 27: “Internet security must evolve continuously to match modern threats. Jigsaw’s ECH measurements helped validate deployment in Android 17, addressing a long-standing vulnerability and advancing our shared goal of a more private web.”

Developer Actions Required for Full Protection

For end users running Android 17, ECH protection is automatic for apps that have been updated to target API level 37 and upgraded to OkHttp 5.5.0 or HttpEngine. For enterprise or IT administrators managing Android 17 fleets, ECH behavior can be configured via DNS administrative controls in managed environments.

For app developers, the required steps are: target API level 37, upgrade to OkHttp 5.5.0, and ensure server-side ECH configurations are published via HTTPS DNS records. Developers building or configuring their own network stacks can access Jigsaw’s open-source ECH measurement tools on GitHub for guidance on their specific configurations.

Frequently Asked Questions

Does Android 17 hide my browsing from my mobile carrier?

For apps and websites that have enabled ECH on their servers, and for apps that have been updated to target Android 17 using a compatible networking library, yes — your carrier can no longer see the specific domain names you visit. It will see only which content delivery network is handling your traffic. For sites that have not yet enabled ECH, the protection does not apply, and for apps that have not been updated, the protection will not take effect until developers upgrade. Enabling Android’s private DNS setting alongside ECH closes the second major metadata leak (the DNS lookup step), which ECH alone does not address.

Does ECH replace a VPN?

No — they protect different things. A VPN hides your IP address and encrypts all traffic between your device and the VPN server, but the VPN provider can still see which domains you visit. ECH hides domain names from ISPs and network observers but does not hide your IP address or encrypt traffic beyond the TLS handshake SNI field. For most users, ECH provides meaningful carrier-privacy protection without requiring any additional tool. For users with specific threat models requiring IP-address anonymization or defense against a VPN provider itself, ECH and a VPN are complementary rather than interchangeable.

Do I need to do anything to get ECH protection on my Android 17 device?

Not for the protection itself — ECH is enabled by default at the OS level. However, full protection depends on two things outside your direct control: whether the app you are using has been updated to target Android 17 with a compatible networking library (a developer action), and whether the website or service you are connecting to has enabled ECH on its servers. You can accelerate your own protection by enabling Android’s private DNS setting (which handles the DNS-lookup half of the domain-data leak) and by keeping apps updated so developers’ networking library upgrades reach you promptly.

What is an SMS blaster, and does Android 17 automatically protect against it?

An SMS blaster is a portable device — hardware now available for approximately $3,000 — that broadcasts high-power 2G signals to force nearby smartphones to drop their LTE or 5G connections. Once a device downgrades to 2G, criminals can send phishing texts that bypass modern spam filters, because the messages never travel through the legitimate carrier network. Toronto police documented 13 million cellular disruptions from a single vehicle-operated SMS blaster in Canada’s first known case of the attack. Android 17 enables mobile carriers to disable 2G by default for their subscribers — a zero-click protection that requires no action from users — but it depends on carriers opting into the program. Google has not yet specified which carriers are participating. If your carrier has not yet enrolled, you can manually disable 2G support in your Android network settings.