Android 17 and a New Level of Network Privacy: ECH, Local Network Protection and Blocking 2G Fraud

Android 17, released on 16 June 2026 and initially made available to most supported Pixel devices, brings several network-security changes that affect much more than the appearance or everyday operation of a smartphone. Google has focused on information that can be exposed while a phone connects to websites, apps, home Wi-Fi equipment and mobile networks. Three changes are particularly important: Encrypted Client Hello, or ECH, which can conceal the domain requested during an encrypted connection; stricter control over apps accessing devices on a local network; and stronger protection against attacks that deliberately force phones onto vulnerable 2G connections. None of these measures makes an Android phone immune to tracking or fraud, but together they close several long-standing gaps that previously allowed network observers, intrusive apps and criminals using fake cellular equipment to learn more about a user’s activity than was necessary.

Encrypted Client Hello Makes Web Connections Less Revealing

HTTPS already encrypts the information exchanged between a smartphone and a secure website, including passwords, messages and most page content. Until recently, however, part of the initial connection could still reveal which internet domain the phone was trying to reach. The issue concerns the Server Name Indication, commonly shortened to SNI. A browser or app uses this information so that a server hosting several websites knows which one it needs to serve. Traditional TLS connections could expose that name before the fully encrypted session was established, meaning a Wi-Fi operator, internet provider or someone observing network traffic could potentially see the domain even though they could not read the contents of the connection.

Android 17 introduces built-in support for Encrypted Client Hello to address that gap. ECH encrypts sensitive information in the opening stage of a TLS connection, including the server name. As a result, an observer positioned between the phone and the destination has less useful information for determining exactly which supported website or service the user is contacting. This is particularly relevant on networks that users do not control, such as hotel, airport, café or public Wi-Fi, where traffic passes through equipment operated by another organisation. It can also reduce the amount of browsing information visible to an internet provider.

There is an important limitation. Android 17 does not automatically hide every domain requested by every app. For apps targeting Android 17, which corresponds to API level 37, ECH can be used when the networking software inside the app supports it and the destination server is also configured for ECH. Google identifies components such as WebView, HttpEngine and compatible versions of OkHttp as examples of software that can provide the necessary support. If the other end of the connection does not support ECH, Android cannot simply encrypt information that the server is unable to process. This makes ECH a meaningful privacy improvement, but one whose coverage will increase as developers and website operators adopt it.

What ECH Changes for Everyday Android Use

For an ordinary Android owner, the main benefit is that ECH works largely in the background. There is no need to activate a separate privacy mode each time a supported app connects to a website. When the required parts of the connection support ECH, the information is protected as part of the normal encrypted session. That matters because privacy features are most effective when they do not depend on users repeatedly changing settings or understanding the details of TLS connections before they can benefit from them.

ECH should not be confused with complete anonymity. A network can still see that the phone is exchanging data and can normally see the IP address it connects to. In some cases an IP address is shared by many domains, which makes it less useful for identifying the exact destination, while in other cases it may still reveal useful clues. DNS requests also need suitable protection because an unencrypted DNS lookup can expose a domain before ECH has any opportunity to conceal it. Android’s Private DNS feature and other encrypted DNS methods therefore remain relevant alongside ECH rather than being replaced by it.

The practical change is a reduction in unnecessary exposure rather than the disappearance of every network identifier. This distinction is important when assessing Android 17’s privacy claims. A person connected to a public Wi-Fi network may previously have protected the content of a HTTPS session while still revealing the requested domain during connection setup. ECH can close that particular opening where support is available. Users still need sensible security habits, including installing updates, avoiding untrusted certificates and keeping browsers and apps current, because ECH protects one part of network communication rather than every possible route through which information can be collected.

Local Network Protection Puts Home Wi-Fi Access Behind Permission

A home Wi-Fi network may contain far more information than users realise. Phones frequently share the same local network with televisions, printers, speakers, streaming boxes, computers, security cameras and smart-home equipment. An app able to search that network can potentially learn which devices are present and use their combination as another clue for identifying a household. Before the newer Android restrictions, local-network communication was treated differently from access to obviously sensitive information such as a camera or precise location, even though a detailed picture of connected equipment could itself reveal information about the user.

Android 17 changes this for apps targeting API level 37 by enforcing local-network protection. Such an app cannot simply obtain unrestricted access to devices on the local area network when it wants to search for or communicate with them. Android introduces the ACCESS_LOCAL_NETWORK runtime permission for apps that genuinely need broad LAN access. The permission belongs to the existing Nearby Devices permission group. This detail affects how the request appears to users: someone who has already granted an applicable Nearby Devices permission may not necessarily receive an additional prompt purely because the app begins using the new local-network permission.

The rule builds on work introduced in Android 16, where developers could test and opt into local-network restrictions before they became compulsory for apps targeting Android 17. The purpose is not to prevent legitimate communication between phones and equipment around the home. Instead, Android separates applications that have a genuine reason to see the local network from applications whose main task can be completed without broad access. That distinction makes silent network scanning more difficult and gives Android a clearer basis for restricting apps that have no convincing reason to inspect nearby devices.

Casting and Smart Devices Without Unnecessary Network Visibility

Many legitimate Android functions rely on nearby equipment. A video app may need to send content to a television, a smart-home app may control a light or thermostat, and a utility may communicate with a printer or network storage device. Requiring unrestricted network access for every one of these actions would create its own privacy problem. Android 17 therefore supports system-mediated device selection methods that allow an app to work with a device selected by the user without first receiving permission to inspect everything else connected to the same network.

Casting provides an easy example. If a user wants to send a video to a television, the important decision is which television should receive it. The video app does not necessarily need a permanent list of every computer, camera, speaker and other reachable device in the home. A privacy-preserving system picker can handle the selection and give the app access to the chosen device. Apps that genuinely require wider and continuing communication with local equipment can instead request ACCESS_LOCAL_NETWORK and explain why that access is necessary.

For users, the change makes local-network access something worth considering rather than an invisible consequence of installing an app. A request can be reasonable for smart-home management, network diagnostics or certain device-control software, while the same request may be harder to justify in an app whose functions have nothing to do with nearby hardware. Android 17 cannot decide the legitimacy of every individual request on the user’s behalf, but enforcing a permission boundary reduces automatic access and gives developers an incentive to request only the network capabilities their software actually needs.

Android 17 Strengthens Defences Against 2G-Based SMS Fraud

Despite the widespread use of 4G and 5G, support for 2G remains a security concern because a phone capable of connecting to the older technology can sometimes be forced away from a more secure network. Criminals can use false base stations, sometimes described as cell-site simulators or SMS blasters, to broadcast a strong cellular signal near potential victims. A vulnerable phone may be pushed from LTE or 5G towards 2G, where older security protections are weaker. Attackers can then exploit the connection to inject fraudulent text messages or carry out other forms of interception that would be substantially harder on modern mobile networks.

SMS blasters are especially troublesome because fraudulent messages delivered through fake cellular equipment can bypass some of the protections normally applied by legitimate mobile networks. A message can be made to resemble communication from a bank, delivery company, government service or another familiar organisation and direct the recipient towards a phishing page. The attack is local: criminals need suitable radio equipment within range of the targeted phones. Google has highlighted examples of portable and vehicle-mounted equipment being used in busy urban areas, illustrating why the continued ability of modern smartphones to fall back to 2G can remain useful to attackers even where carriers themselves are reducing ordinary 2G service.

Android has allowed compatible devices to disable 2G at the cellular-radio level since Android 12, preventing normal scanning for and connection to 2G networks. Android 17 advances the idea by allowing mobile carriers to configure 2G protection so that 2G is disabled by default for their subscribers. This is not a universal switch that Google activates on every Android 17 phone. The stronger default depends on carrier participation and device support. Where it is used, however, the security benefit is significant because the phone avoids the vulnerable connection before an SMS blaster has an opportunity to exploit a forced downgrade.

What Users Should Know About 2G Network Protection

Users should first understand that disabling 2G is different from blocking ordinary spam messages. It removes a route that can be exploited by a specific class of cellular attacks. If a phone refuses normal 2G connections, a fake base station cannot simply rely on downgrading that device to 2G and then using the weaknesses of the older technology in the usual way. This is particularly useful in countries where legitimate 2G service has already been retired or is close to retirement, because there may be little practical reason for a modern handset to retain everyday 2G connectivity.

There are circumstances in which 2G can still be useful. Some regions continue to depend on older cellular coverage, and travellers may encounter roaming networks where 4G or 5G service is unavailable. Android’s documentation warns that a device with 2G disabled can lose ordinary cellular connectivity in such situations until the user enables it again. Emergency calls are treated differently: Android states that disabling 2G for security does not prevent emergency calling, as the device can still scan and use 2G where necessary for emergency services. This distinction allows stronger routine protection without intentionally removing a critical fallback for emergency communication.

Taken together, Android 17’s ECH support, mandatory local-network controls for newly targeted apps and improved carrier options for disabling 2G address three different forms of information exposure. ECH reduces the amount of destination information visible during supported encrypted connections; local-network permissions restrict silent inspection of equipment sharing a Wi-Fi network; and stronger 2G controls make downgrade-based SMS attacks harder where carriers and devices support the feature. None should be treated as a substitute for software updates, careful permission choices or scepticism towards unexpected messages. Their importance lies in reducing risks before the user has to react to them, making several previously permissive parts of Android networking more private by default.