Google is preparing to enable a new privacy standard by default in Android 17 that closes one of the last remaining gaps in encrypted web browsing—but security experts caution that the upgrade stops well short of making your online activity invisible.
What Encrypted Client Hello Does
The feature at the center of the change is called Encrypted Client Hello, or ECH. When a browser or app connects to a website, most of that exchange is already protected by encryption. Yet one crucial detail has historically slipped through unprotected: the name of the site being visited, which is transmitted in plain text during the initial handshake.
ECH scrambles that final exposed field, meaning network operators, internet service providers, and anyone snooping on the connection can no longer easily read which specific domains a user is loading. By turning the standard on by default, Android 17 extends this protection to a much wider base of users without requiring them to dig through settings.
The one piece of a web request that still traveled in the open is finally being locked down.
The Limits of the Upgrade
Despite the improvement, ECH is not a cloak of invisibility. Observers watching a connection can still see the IP addresses being contacted, and in many cases those addresses can be traced back to particular services or providers. That means a determined party may still infer a great deal about where a user is going online.
The feature also depends on both the website and the network supporting the standard. Where support is absent, the older, less private behavior can persist, leaving gaps in coverage that vary from site to site.
For users seeking stronger anonymity, ECH is best understood as one layer among several rather than a complete solution. Tools such as VPNs and privacy-focused browsers still play a role in masking broader patterns of activity.
- ECH hides the domain name during the connection handshake
- IP addresses and traffic patterns remain visible
- Protection requires support from both websites and networks
Why It Matters
Rolling the standard out by default across Android represents a meaningful step for mainstream privacy, given the platform's enormous global footprint. Features that are switched on automatically tend to reach far more people than those left as optional toggles.
Still, the move underscores a recurring theme in digital privacy: incremental gains rarely amount to total protection. Android 17 narrows the window of exposure, but users who assume their browsing is now fully hidden may be drawing the wrong conclusion.