Android 17 Adds ECH and Other Network Privacy Protections
Summary
Google says Android 17 will enable ECH for compatible apps, require permission for local-network access, enable Certificate Transparency by default, and let participating operators disable 2G.
Key points
- Android 17 adds platform-level Encrypted Client Hello (ECH), which encrypts the hostname in the TLS handshake on supported servers.
- ECH is enabled by default for apps targeting Android 17 when they use a compatible networking library; private DNS can further reduce network profiling.
- For servers without ECH support, Android sends an ECH GREASE field, but the hostname remains visible.
- Google says its ECH GREASE tests across 10,000 domains and 740 providers in 202 countries found no site-loading issues or unexpected network blocks.
- Local Network Protection will require apps to obtain permission before scanning for or connecting to devices on a user's local network.
- Certificate Transparency will be enabled by default, making forged certificates more evident by requiring website certificates to appear in public logs.
- Participating mobile operators will be able to automatically turn off 2G for subscribers, reducing exposure to SMS blasters and rogue base stations.
Article Details
- Event Type
- Announcement of network security and privacy protections in Android 17
- Impact
- Adds platform-level Encrypted Client Hello support to obscure visited domain names from network providers when supported, permission controls for local-network scanning and connections, and default Certificate Transparency. Participating mobile operators can also disable 2G to reduce exposure to SMS blasters and rogue base stations. Hostnames remain visible when servers do not support ECH.