Android 17 adds domain encryption for privacy

Google has announced a suite of significant privacy and security enhancements for its upcoming Android 17 operating system, with a central focus on encrypting website domain names to shield user activity from network observers. The update introduces support for the Encrypted Client Hello standard, a major step in obscuring browsing metadata that has long remained visible even within secure HTTPS connections.

The core of the announcement, detailed in a blog post published on August 27, 2026, addresses a persistent gap in web privacy. While HTTPS encrypts the content of a web page, the initial handshake that establishes a connection still transmits the destination domain name in clear text. This allows internet service providers, WiFi operators, and other network intermediaries to see which websites a user visits. Android 17 implements Encrypted Client Hello to encrypt this domain name from the very start of the connection, using a secret key that only the destination server can decrypt.

"Even if the connection to a website or service is secure, internet service providers and WiFi operators can still see the destination, which can be collected for commercial profiling purposes,"...