Android 17 Doesn’t Hide Every Website You Visit—Here’s What It Really Does

Introduction

Google is making one of Android’s biggest privacy upgrades in years, but the headlines oversold it.

Some reports made it sound like Android 17 now hides every website you visit from your carrier and Wi-Fi network. That’s not what happened.

The real change is Encrypted Client Hello (ECH), a new internet standard that closes one of HTTPS’s biggest remaining privacy gaps. It’s a genuine security upgrade—but it only works when your app, the website, and your network configuration all support it.

Here’s what actually changes.

The privacy leak HTTPS never fixed

HTTPS already encrypts almost everything you do on a website.

Your passwords, messages, searches, and page contents are protected.

But two important pieces of metadata have traditionally remained visible.

• DNS lookups, where your device asks which IP address belongs to a website.
• Server Name Indication (SNI), which tells the destination server which website you’re trying to reach during the TLS handshake.

That means your ISP, mobile carrier, hotel Wi-Fi, or anyone monitoring the connection can often still see that you visited example.com even though they can’t read the page itself.

Android has supported encrypted DNS through Private DNS since Android 9, which protects the first leak.

Android 17 is designed to reduce the second one.

What Encrypted Client Hello actually does

Instead of sending the real website name in the open, ECH encrypts it.

The process works like this:

• A website or CDN publishes an ECHConfig containing a public key.
• Your device creates an encrypted inner handshake containing the real hostname.
• A harmless-looking outer handshake is sent instead.
• Only the destination server can decrypt the real hostname.

To someone watching your traffic, the connection often appears to be going only to a shared provider like Cloudflare or Google rather than revealing the specific site.

That’s a major improvement—but only when the website supports ECH.

Why Android 17 isn’t universal protection

The biggest limitation is compatibility.

Android 17 enables the capability, but several conditions have to line up before your hostname is actually hidden. Requirement Needed? Android 17 Yes App targets API 37 Yes App uses an ECH-capable networking stack Yes Website supports ECH Yes Private DNS enabled Recommended to hide DNS too

If any of those pieces are missing, Android falls back to normal behavior.

What GREASE is—and why it matters

One clever addition is ECH GREASE.

Without it, encrypted connections would stand out.

Instead, Android intentionally sends fake ECH-looking handshakes even when a website doesn’t support ECH.

That doesn’t hide the hostname on unsupported sites.

It simply makes ECH-capable traffic harder to identify and block because encrypted and non-encrypted handshakes look much more similar.

Google says compatibility testing across thousands of websites and hundreds of ISPs found almost no measurable disruption from GREASE.

What Android 17 still cannot hide

Even with ECH enabled, several things remain visible.

Android 17 does not hide:

• Your destination IP address
• DNS lookups if Private DNS isn’t enabled
• Traffic size
• Connection timing
• Apps using older networking stacks
• Websites that haven’t deployed ECH

A website hosted alone on its own IP address can still be identifiable from the IP itself, even if SNI is encrypted.

How to get the most privacy

If you’re using Android 17, the best setup is surprisingly simple.

• Update to Android 17 when it’s available for your device.
• Turn on Private DNS in Settings → Network & Internet → Private DNS.
• Keep Chrome and other apps updated so they use modern networking libraries.

The biggest privacy gains happen when encrypted DNS and ECH work together.

Three other security upgrades in Android 17

Google’s announcement wasn’t just about ECH.

Android 17 includes three other notable network security improvements.

Local Network Protection

Apps targeting Android 17 now need a new runtime permission called ACCESS_LOCAL_NETWORK before scanning or connecting to devices on your home network.

That helps prevent apps from quietly fingerprinting every TV, printer, camera, and smart device in your house.

Certificate Transparency becomes the default

Android 17 now enables Certificate Transparency by default for apps targeting API 37.

Certificate Transparency requires publicly trusted certificates to appear in public audit logs, making secretly issued fake certificates much harder to hide.

Carriers can disable 2G automatically

Fake cell towers often exploit 2G networks to deliver phishing texts or intercept communications.

Android already let users disable 2G manually.

Now participating carriers can disable 2G by default for supported subscribers without requiring any action from the user.

The bottom line

Android 17 delivers a real privacy upgrade—but it’s more accurate to think of it as bringing browser-grade encrypted connections to more apps, not making your phone invisible online.

When everything lines up—Android 17, an updated app, Private DNS, and a website that supports ECH—your carrier often can’t see the specific website you’re visiting.

When those conditions aren’t met, much of the old metadata can still leak.

So the headline shouldn’t be “Android now hides every website you visit.”

It’s closer to this:

Android 17 closes one of the internet’s last major HTTPS privacy leaks—but only where the modern web is ready for it.

FAQ

Does Android 17 automatically enable ECH?

The platform supports ECH by default, but apps generally need to target Android 17 (API 37) and use an ECH-capable networking stack for real protection.

Do I still need Private DNS?

Yes. ECH protects the TLS handshake, while Private DNS protects DNS lookups. They work together to reduce metadata leaks.

Will every website benefit?

No. Websites or CDNs must publish ECH configuration for the feature to fully hide the hostname.

Can my ISP still see something?

Yes. Your ISP can still see the destination IP address, traffic volume, timing, and any connections that don’t negotiate ECH.