Android 17 Rolls Out OS-Wide ECH to Block ISP Website Snooping

Google has announced a suite of network security enhancements in Android 17, headlined by operating-system-wide support for Encrypted Client Hello (ECH), a privacy standard designed to prevent ISPs, cellular carriers, and on-path snoopers from observing which websites and apps a user visits. In a Thursday announcement, Google engineers Bram Bonné and Shuaibo Huang explained that ECH works alongside private DNS to obscure destination domain names from the very first packet of a connection, stripping out the metadata that carriers routinely harvest to build user profiles. For anyone wondering whether their current setup already leaks browsing data to their provider, running a DNS leak test is a quick way to audit one of the channels ECH is designed to complement.

The protection is not blanket, however. Google's Jigsaw division noted that ECH only works when destination servers advertise support, which could itself become a fingerprinting signal. To counter that, Android 17 ships with ECH GREASE enabled by default, a technique that injects fake, randomized ECH extensions into every connection request so that traffic to ECH-enabled and non-ECH sites is indistinguishable to observers. Jigsaw has also upstreamed ECH support into OkHttp, the open-source HTTP client widely used in Android apps, allowing third-party developers to inherit the protection without rewriting their networking code. ECH first landed in Google Chrome 117 and Mozilla Firefox 118, but extending it system-level closes a significant gap for browsers and apps that had not yet integrated the standard.

Beyond ECH, Android 17 enforces Local Network Protection, requiring apps to obtain explicit user permission before scanning or connecting to neighboring devices on the same Wi-Fi segment. Google is also enabling Certificate Transparency (CT) by default, ensuring every TLS certificate encountered is logged in a public, auditable registry that browsers and monitors can verify — a control worth cross-checking against any given site's configuration using an SSL/TLS checker. Finally, participating carriers can now disable 2G radio support at the network level, eliminating a long-standing downgrade attack vector exploited by rogue base stations and SMS blasters used to intercept traffic and push smishing payloads. Whereas Android 12 offered a manual user toggle and Android 14 added a managed-device policy for IT administrators, the new carrier-side control operates as a zero-click mitigation that protects subscribers before any attack can be staged.