Android 17 adds Encrypted Client Hello to shield browsing data from ISPs

Google has rolled out platform-wide support for Encrypted Client Hello (ECH) in Android 17, making it the first major mobile operating system to adopt the standard. The announcement came from Jigsaw, a technology incubator operating under Alphabet.

The gap it closes

According to Jigsaw, even when a person visits a site over secure HTTPS, internet service providers can still see the domain names being accessed. That data can be used to build user profiles for targeted advertising, and it can also be exploited by malicious actors running phishing schemes.

ECH addresses this by encrypting the destination site information from the very start of a connection. Once active, ISPs will only be able to see which content delivery network, such as Cloudflare, is being used and the volume of data transferred — not the actual website or app a person is using.

The feature will be switched on by default on Android 17. Jigsaw describes closing this gap as a way to make the internet safer for all users.

What it doesn't cover

ECH alone isn't a complete privacy solution. It does not hide DNS lookups, the process that converts a web address into a numerical IP address computers can read; encrypted DNS needs to be enabled separately for that layer of protection. ECH also does not mask a device's IP address the way a VPN would.

Beyond ECH, Google has recently added other security measures to Android 17. Among them is a zero-click option that lets carriers disable 2G connectivity by default, aimed at blocking SMS blasters — devices that typically exploit the older cellular network to slip past modern spam filters.