With Android 17 officially rolling out, Google is introducing major upgrades to network privacy and security aimed at keeping users’ online habits more confidential. The new features are designed to block previously leaked data about which sites or apps are being accessed, tighten local network controls, and phase out outdated mobile technologies.
Encrypted Client Hello hides domain names
Even when connections use HTTPS, the name of the domain you visit is still visible because of unencrypted parts of the connection process—specifically the initial DNS lookup and the ClientHello message in the Transport Layer Security (TLS) handshake. These exposed domain names may be harvested by carriers or malicious actors to build profiles, or used in phishing and scam attacks. Android 17 now supports the Encrypted ClientHello (ECH) standard, working with private DNS, to shield the domain name by encrypting it with a key only the destination server can decode.
To take advantage of ECH, app developers must update to OkHttp version 5.5.0 and enable the feature in their client code. For sites and apps that support ECH, this change stops network providers and snoopers from seeing what domains you’re connecting to—even if HTTPS is already in use.
Blocking 2G, restricting local scans, requiring certificate integrity
Android 17 steps up other security measures too. Mobile carriers are now allowed to disable 2G by default. Earlier versions of Android introduced this as a user option—in 17 it becomes carrier-managed. This move is meant to stop attacks—often via SMS—that force phones to downgrade from LTE or 5G to weak, legacy 2G networks, where interception is far easier.
Apps will also now need explicit user permission before they can scan or connect to other devices on your local network. This adds a layer of control over local network interactions; everyday actions like casting to a TV are intended to be handled via secure system tools that avoid needing broad permissions.
Another improvement: Android 17 requires Certificate Transparency, ensuring all TLS certificates are logged publicly. That safeguards against the risk of fake or malicious certificates being used to impersonate legitimate websites or intercept secure traffic.
These additions signal a meaningful shift in Android’s approach to preserving user privacy and data safety over networks. From hiding domain names via ECH to enforcing certificate logging, Android 17 is locking down key vectors that have long been exposed. Watch for how quickly popular apps adopt OkHttp 5.5.0 and enable these protections—and for carriers to follow through on disabling 2G support truly by default. These changes raise the baseline for privacy across the Android ecosystem, challenging developers and network operators to catch up.
