Google is rolling OS-wide Encrypted Client Hello (ECH) support into Android 17, closing one of the largest remaining structural privacy holes on the internet: the domain names users visit remain visible to network operators even when the connection itself is HTTPS-encrypted.
ECH encrypts the destination domain with a key only the target server can unlock, so carriers, Wi-Fi operators and eavesdroppers can no longer build profiles from browsing metadata. Because many web servers do not yet support ECH, Android 17 enables ECH GREASE by default, sending randomized decoy extensions so protected and unprotected connections look identical. Google says this makes Android the first major mobile OS to roll out broad ECH support, and it is working with its Jigsaw unit and app developers to speed adoption. OkHttp, the open-source HTTP client, now supports ECH in its core library, letting third-party apps inherit the protection.
For apps targeting Android 17, ECH turns on by default when the app runs on a supported networking library such as newer OkHttp, WebView or HttpEngine versions. Jigsaw validated the rollout with two large-scale checks, including GREASE requests against the top 10,000 domains worldwide.
Android 17 also tightens local network behavior: apps must now ask permission before scanning or connecting to other devices on the home network, and additional protections target Wi-Fi-based tracking. For defenders, the change shrinks the metadata that network-level monitoring and targeted phishing operations rely on, though organizations should remember ECH does not hide traffic from the destination server itself.
