Google deploys support for Encrypted Client Hello on Android 17
Google has added system-wide support for Encrypted Client Hello (ECH) to Android 17, becoming the first major mobile operating system to do so. The feature encrypts the destination of an HTTPS connection from the outset, reducing the ability of internet service providers and others to identify which websites or services a user is accessing. This matters because visible domain data can be used for profiling, targeted advertising and phishing.
ECH will be enabled by default on Android 17, though it does not provide complete anonymity. Providers may still see the content delivery network being used and the amount of data transferred; ECH also does not hide DNS look-ups or a user’s IP address, for which encrypted DNS and a VPN would be needed respectively. Google has also introduced a carrier-controlled option to disable 2G by default, intended to reduce abuse by SMS blasters.
- Android 17 enables encrypted website destinations by default.
- ECH limits ISP visibility into sites and services used.
- It does not replace encrypted DNS or a VPN.
New here? Start with this
When a phone connects to a website using HTTPS, the connection is encrypted, but some information about where it is connecting can still be visible to internet providers and other network operators. That information can help show which services a person uses, even when the pages they view are protected.
Encrypted Client Hello (ECH) is designed to hide the website’s destination at the start of an HTTPS connection. It is part of wider efforts to limit what can be inferred from internet traffic, but it does not conceal every detail: for example, a user’s IP address and some information about the connection may remain visible.
Google develops Android, the software used by phones from many manufacturers, while mobile operators provide network access and can manage some phone settings. ECH’s privacy effect depends on the websites and services a phone connects to supporting it, and it does not replace other tools that protect different parts of a connection.