1 SEP 2026 — Android 17 turns on Encrypted Client Hello by default for apps that target it and use a compatible networking library. ECH hides the domain name from the TLS handshake. The destination IP address is still in plain sight, so the privacy gain depends entirely on how many other sites share that address.
What ships
ECH encrypts the opening portion of a TLS handshake, specifically the Server Name Indication field that names the site being requested. Without it, an observer reading an HTTPS connection cannot see the content but can read the domain in clear text.
On Android 17 the feature is on by default for apps targeting that version and using a compatible networking library, including recent versions of OkHttp, WebView and HttpEngine. Where a server does not support ECH, Android sends a decoy field called ECH GREASE so that connections using real ECH do not stand out, though in that case the hostname remains visible.
Google's Jigsaw unit tested GREASE against the top 10,000 domains across 740 internet providers in 202 countries and reports no site-loading failures or network blocks. Android 17 also adds enhanced local network protection requiring app permission, Certificate Transparency on by default, and optional 2G disabling where operators participate.
What an observer still sees
A destination on a network is identified by three things: the DNS lookup, the SNI field and the IP address the connection goes to. ECH addresses only one.
The DNS query goes first, and unless the device is using encrypted DNS the resolver sees the domain name in clear text before any TLS handshake begins. ECH and encrypted DNS have to be deployed together or the leak simply moves upstream by one step.
The IP address cannot be hidden by any of this, because packets have to be routed. If the address belongs to a large content delivery network fronting millions of sites, it reveals almost nothing. If a site runs on its own dedicated address, the IP is a dead giveaway, and ECH has protected a name that was already deducible.
The decoy is the clever part
GREASE solves a problem that defeats most privacy features in practice: small minorities are conspicuous. If only a few users hide their traffic, a network operator who cannot read it can still act on the fact that they are hiding it.
By having every Android 17 connection carry an ECH field, real or fake, the feature removes the signal that distinguishes users of it. An operator can no longer treat the presence of ECH as a category worth blocking without blocking the entire Android install base.
The Jigsaw testing figure is more important than it looks. Confirming that 740 providers in 202 countries do not break on the decoy shows that the anti-fingerprinting property will hold up where it is most needed.
Default-on is what makes it work
ECH has existed as a standard for years and has been available in desktop browsers behind a setting for most of that time, with negligible effect on what network operators can see.
A privacy feature that a user must find and enable protects the people who already knew to look, which is the population least in need of it. Turning it on for every app that targets a new Android version and uses a current HTTP library reaches everyone else, including people who will never know the feature exists.
The condition is real, though. An app targeting an older API level or pinning an old networking library gets nothing, and large applications often do both. Coverage will arrive over the two or three years it takes target levels to move, which is slow but is also the only mechanism that has ever produced platform-wide change on Android.
Why this lands differently in this region
Website filtering across much of Southeast Asia is implemented at the network layer, and the practical techniques are DNS blocking and inspection of the SNI field. Both are cheap, both operate per-domain, and both are exactly what ECH plus encrypted DNS removes.
A regulator that loses SNI-based filtering is left with two uncomfortable options. Blocking by IP address is blunt, because addresses behind a large CDN are shared with thousands of unrelated sites and one block takes them all down. Blocking connections that use ECH means blocking the default configuration of a mainstream mobile operating system.
The likely outcome is more pressure applied further up the stack, at platforms and app stores rather than at the network. We reported that Malaysia is implementing under-16 social media restrictions through identity verification rather than network controls, which is what regulation looks like once the network layer stops being a usable lever.
What to actually do
For users, the setting that matters alongside this is private DNS, which most Android builds expose directly and which nothing here enables automatically. ECH without encrypted DNS closes the second door while leaving the first open.
For developers, the requirement is targeting Android 17 and using a current networking library, which means an application on a pinned older HTTP client gets none of this. The dependency audit is the work.
For anyone assessing the privacy claim, ECH raises the cost of passive per-domain observation for sites on shared hosting and does very little for a service with its own address. Both statements are true simultaneously, and which one applies depends on the site rather than on the phone.
View author profile → · Editorial policy
