Android 17 will finally stop ISPs from seeing which websites and apps you visit

Even with HTTPS keeping your actual activity on a website private, your network provider and anyone snooping on the connection can still see exactly which sites and apps you’re visiting. This privacy gap has quietly existed for years, and Google is now closing it with four major network security upgrades built into Android 17.

How Android 17’s Encrypted Client Hello (ECH) blocks ISP tracking

Your phone has been announcing its destination out loud this whole time. Every time you connect to a site, there’s a moment in the handshake called TLS ClientHello, where your device essentially broadcasts which domain it’s about to visit, in plain, readable text. Anyone watching the network, your ISP included, can read that.

Encrypted Client Hello scrambles that data so it’s unreadable to anyone but the site you’re actually visiting. Pair that with Private DNS, and your ISP loses the ability to track where you go or stitch your browsing into a profile. Android is the first major mobile OS to roll this out broadly, built alongside Jigsaw, with developer support landing through OkHttp 5.5.0.

Three other Android 17 security features rolling out

Beyond ECH, Android 17 packs in three more upgrades that close smaller but still crucial privacy gaps:

• Local Network Protection stops apps from silently scanning your home Wi-Fi to see what devices you own, whether that’s a smart TV, a security camera, or other connected gadgets, without asking your permission first.
• Certificate Transparency, now enforced by default, requires every website certificate to be logged publicly, making it harder for a compromised or rogue certificate authority to issue a fake certificate and intercept your traffic without getting caught.

• Zero-click 2G protection fights back against scams. Criminals use devices called SMS blasters to force nearby phones onto outdated, insecure 2G networks, then blast out phishing texts that slip past modern spam filters. Android 17 lets participating carriers disable 2G by default, shutting down that entire attack path automatically, with zero action required from you.

Together, these four changes will close some of the biggest privacy gaps still baked into how your phone connects to the world.