Google brings stronger anti-tracking protections to Android 17

Google has detailed new privacy protections coming to Android 17, including technology that hides the websites users visit from internet providers and new safeguards against rogue cell towers.

The biggest addition is native support for Encrypted Client Hello (ECH), a standard designed to prevent internet providers from seeing which domains users are visiting. Historically, even with an encrypted HTTPS connection, a server’s domain name could still be exposed during the TLS handshake.

ECH encrypts that information before the connection is established. If a website does not yet support the standard, Android can send randomized cover data to make it harder for third parties to build a profile of a user’s browsing activity. Google says Android 17 will be the first mobile operating system to deploy the technology broadly at the system level.

Android 17 will also add automatic protection against rogue cell towers and SMS Blasters, which can be used to track devices and distribute phishing messages. Mobile carriers will be able to block suspicious 2G connections without requiring users to take action.

Google is also enabling Certificate Transparency by default to help verify SSL certificates. Apps will face tighter restrictions on scanning for devices on a user’s local home network while running in the background unless they have permission.