Android 17’s ECH Privacy Upgrade: Encrypted Website Names, Visible Metadata, and Developer Requirements

Android 17’s most consequential network-privacy change is platform support for Encrypted Client Hello (ECH), a TLS 1.3 extension that encrypts the hostname normally exposed in the opening part of a secure connection. The result is less hostname leakage to Wi-Fi operators, internet providers, and other network observers—but not complete anonymity. 46

ECH is useful only when the full connection supports it: the device must run Android 17 or later, the app must use an ECH-capable networking library, and the destination service must deploy ECH. 25

What ECH encrypts

In a conventional TLS connection, the client sends a Server Name Indication (SNI) containing the hostname it wants to reach. ECH encrypts that sensitive part of the initial ClientHello using configuration and key material published by the destination service. The server can decrypt the protected information, while an observer on the network sees an outer handshake rather than the intended hostname. 416

That distinction matters because HTTPS already encrypts the content of a web session, but hostname exposure can still reveal which service an app is contacting. ECH is designed to reduce that particular form of metadata leakage for supported destinations. 56

What network observers can still see

ECH does not encrypt every part of a network connection. Depending on the connection and the observer’s position, the following information may remain available:

• The device’s source IP address.
• The destination IP address, which may identify a hosting provider, CDN, or sometimes a particular service.
• Connection timing, packet sizes, and traffic volume.
• DNS lookups if the DNS request is not protected separately.

This is why ECH should not be described as a VPN or an anonymity system. Google presents ECH and Private DNS as complementary protections: ECH hides the hostname in the TLS handshake, while encrypted DNS helps prevent the separate domain-lookup step from revealing it. Neither feature by itself hides the device’s IP address. 612

ECH requirements and Android 17 defaults

Android 17 provides the operating-system support and APIs needed for networking libraries to implement ECH, including the ability to query HTTPS DNS records containing ECH configurations. 4

Actual protection still depends on three conditions:

1. The device runs Android 17 or later.
2. The app’s networking stack supports ECH. Examples named in Android’s documentation include HttpEngine, WebView, and OkHttp, but platform support alone does not make every library ECH-capable. 23
3. The remote server has deployed ECH. Without server-side configuration, the client cannot encrypt the destination hostname for that service. 25

For apps targeting Android 17 or higher, ECH is used for TLS connections when the networking library and remote server both support the protocol. If ECH cannot be used, the app’s configured domain-encryption policy determines whether the connection can continue or must fail closed. 12

How ECH GREASE works

Android’s domain-encryption policy includes more than an on-or-off ECH switch. When domain encryption is enabled but a server does not support real ECH, Android can send ECH GREASE instead. The extension is deliberately nonfunctional, but it resembles ECH traffic.

The purpose is compatibility and resistance to simplistic traffic classification: systems should not be able to assume that the absence of a usable ECH connection means the client never attempts ECH. GREASE does not hide the hostname in the same way as successful ECH. It is a compatibility mechanism, not a substitute for server-side deployment. 1

If an app disables domain encryption, Android’s NetworkSecurityPolicy documentation says that neither ECH nor GREASE should be used. The same API also exposes domain-encryption modes, including enabled and required configurations. 1

What developers need to change

Android 17 support does not automatically protect traffic from every app. Developers should:

• Verify that the app’s networking library has integrated ECH support. 235
• Configure the app’s Network Security Config or equivalent domain-encryption policy. 15
• Ensure the library can retrieve and use the ECH configuration advertised by the destination service. Android provides platform APIs for retrieving HTTPS DNS records that contain ECH configuration data. 4
• Test behavior for both ECH-capable and ECH-incapable servers, including whether the app should permit fallback or require ECH and fail closed. 1

Server operators also have to deploy ECH and publish the configuration that clients need. This service-side dependency is the main reason Android’s platform support will not immediately hide every hostname visited by every app. 516

Google says it is working with Jigsaw, industry participants, service providers, and app developers to expand adoption. The broader objective is to make hostname protection available to apps through common networking infrastructure rather than limiting it to specially configured browsers. 46

Other Android 17 network protections

Local-network access requires a runtime permission

Apps targeting Android 17 or higher must request the ACCESS_LOCAL_NETWORK runtime permission before discovering or connecting to devices on the local network. The permission is part of the existing NEARBY_DEVICES group, so users who have already granted another permission in that group may not receive a second group-level prompt. 217

The change is intended to reduce silent local-network scanning that could support tracking, fingerprinting, or discovery of vulnerable devices. Apps that legitimately connect to smart-home hardware, casting receivers, or other LAN devices need to declare and request the permission. 1719

Certificate Transparency is enabled by default

Android 17 enables Certificate Transparency (CT) by default for TLS connections. CT helps expose improperly issued public certificates by requiring certificates to appear in public, auditable logs. Apps can opt out globally or for selected domains through network-security configuration. 3

Carriers can restrict insecure 2G connections

Android 17 also adds protection related to the weak security of 2G cellular networks. The feature allows carriers to restrict or disable 2G connectivity by default where supported, reducing exposure to rogue base stations and SMS-blaster attacks. The exact behavior depends on carrier and device support. 8

The practical privacy verdict

ECH is a meaningful improvement because it removes the hostname from a key part of the TLS handshake when the client and server support the standard. But it does not make browsing invisible. DNS configuration, destination IP addresses, timing, packet sizes, and traffic volume can still provide clues.

For stronger domain privacy, ECH should be combined with encrypted DNS. For protection against IP-address identification, users need a separate system such as a VPN, proxy, or Tor. The most accurate way to understand Android 17’s change is therefore: it makes website and service names harder for network observers to read, while leaving other layers of connection metadata outside ECH’s protection.