Android 17 users just gained a new layer of browsing privacy, though the protection stops short of fully hiding their activity.

Google's mobile operating system Android 17 now enables Encrypted Client Hello (ECH), a privacy standard that conceals a web request's destination from the network carrying it. Google detailed the rollout in a security post published Wednesday, describing it as the first broad Encrypted Client Hello rollout on a major mobile OS, built with its Jigsaw team and outside developers.

The feature addresses a long-standing gap in web encryption. A page loads over HTTPS, so its contents are scrambled—but the handshake that opens the connection still names the site in cleartext through a field called Server Name Indication (SNI). Every node between a phone and a server can read that field and log where a device goes, including carriers, Wi-Fi operators, and network snoops. Desktop browsers including Firefox and Chrome have shipped ECH support in recent years; Android's move extends the protection to the platform where most of the world's browsing now happens.

ECH seals that field. The client encrypts the site name to a key the destination publishes, and only that server can unwrap it. The rest of the path sees a meaningless label rather than the domain. The mechanism runs on top of private DNS, which already hides the separate step that turns a name into an IP address—and because ECH depends on encrypted DNS to deliver those public keys, the two features work as a pair.

The protection applies only to sites and apps that have switched ECH on. Google's post limits its claim to "supported websites and apps," and the company is pushing developers to upgrade to OkHttp 5.5.0 and enable the feature. Until adoption spreads, a request to a site without ECH still exposes its domain to the network. Deployments also rely on sites publishing ECH configurations through their DNS records, so hosting providers and CDNs must support the feature for it to reach their customers.

Even where ECH is active, limits remain. The network can still see the destination server's IP address and the volume of data moving. An observer can infer activity at a coarse level even when the name is hidden—the encryption is a lock on the label, not on the fact that a connection happened. ECH has also drawn pushback from network operators who rely on visible domain names for filtering and monitoring, a tension that will shape how widely the standard is adopted across carriers and enterprise networks.

Google's network-level move arrives as Android's device-level privacy faces its own test in court. Samuel Tunick, an Atlanta activist, became the first known American charged under federal law for allegedly using a duress password built into GrapheneOS, a hardened Android build that wipes the device when the code is entered. GrapheneOS has said its software is "completely legal" and constitutionally protected as the case proceeds, and a related prosecution has framed the dispute as a question of who controls the data on a phone.

"I just hope to send the message that the government doesn't own our data," Tunick told the New York Times in an interview published Friday.

Beyond ECH, Android 17 also turns on Certificate Transparency by default—making it harder for a rogue certificate authority to issue fraudulent credentials for a site unnoticed—and requires apps to ask permission before scanning a local network.