When your device opens an encrypted connection, the very first message has historically been sent in the clear — and it contains the hostname you are connecting to.

That field is SNI, and it is why an ISP, a Wi-Fi operator or anyone else on the path can build a list of every site you visit without decrypting a single byte of the actual traffic.

Encrypted Client Hello encrypts it. Google's description of the benefit is that it obscures the domain names you visit, hiding metadata that can be used to profile you.

What Android 17 actually changes

ECH has existed in browsers for a while — Chrome from version 117, Firefox from 119. What is new is that Android 17 implements it at platform level rather than leaving it to whichever browser you happen to use.

It is on by default for apps targeting Android 17 that use OkHttp, WebView or HttpEngine — which is most apps that make HTTPS requests without writing their own networking stack.

That distinction matters because the tracking problem was never mainly about browsers. It was about the hundred other apps on the phone, each opening connections all day, none of which anybody audits.

The part that is genuinely smart

ECH needs the server to support it. Most do not yet.

So on connections to servers without ECH support, Android sends ECH GREASE — data that looks like ECH but is not. The hostname stays visible on those connections. Nothing is protected.

The point is what it does to everyone else's traffic.

If only ECH-capable connections carried ECH, then the presence of ECH would itself be a signal — a network observer could see exactly which users had privacy features enabled and treat them differently, or simply block the protocol. By making a large share of connections look identical whether or not they are protected, the protection becomes unremarkable.

This is the exact lesson from the browser fingerprinting tool whose author found that hardening your browser makes you easier to identify: privacy that makes you unusual is not privacy. The difference is that a platform can fix it and an individual cannot. One person cannot manufacture a crowd; an operating system can.

Google says it tested ECH GREASE against the top 10,000 domains across 740 internet providers in 202 countries and found no site-loading issues or unexpected network blocks.

What else ships

  • Local Network Protection — apps must ask permission before scanning or connecting to devices on your local network. That closes a long-standing gap where any app could quietly inventory your home.
  • Certificate Transparency on by default, requiring a site's certificate to appear in public logs.
  • 2G disabling — participating mobile operators can switch 2G off for subscribers, cutting exposure to SMS blasters and rogue base stations.

The 2G item is the sleeper. 2G has no mutual authentication, which is why fake base stations work at all, and turning it off is the only real fix.

What it does not do

Worth being clear, because "hides which sites you visit" gets over-read:

  • It does not hide the IP address you connect to. For a site on its own address, that is often enough to identify it.
  • It does not stop fingerprinting. Canvas, fonts, WebGL and the rest are untouched.
  • It does not work without server support. On a server without ECH, you get GREASE and no protection.
  • It needs private DNS. Otherwise your DNS queries leak the hostname you just went to the trouble of hiding.

What is not established

  • Rollout timing and which devices get it. Not specified.
  • How many servers support ECH today. No figure published.
  • Whether networks will start blocking ECH where they currently profile SNI. GREASE is designed to make that costly; whether it succeeds is an empirical question nobody can answer yet.
  • Which operators will use the 2G switch. Described as participating operators, none named.