Google has added several network security features to Android 17 that give users more privacy when they use Wi-Fi, browse the web or connect to mobile networks.
The changes cover local network access, web traffic, digital certificates and older cellular networks. Together, they aim to limit what apps, network operators and attackers can learn about users.
Google announced the four protections on August 27 as part of its Android 17 security work. The new controls focus on four areas that can expose useful data about a user or device.
Android apps face tighter local network controls
One of the most important changes is about what data apps will have access to regarding a local network of a user.
For instance, a phone connected to home Wi-Fi may be able to share the connection with other devices like a smart TV, printer, speaker, security camera, and game console on that network. Up until Android 17, apps could just scan the local network and get information about other devices connected to it. That could create a privacy risk.
An app could use the devices it found to build a picture of a person’s home technology. Apps can also use those details for device fingerprinting or other types of tracking.
Starting with Android 17, apps targeting this version or newer need the ACCESS_LOCAL_NETWORK permission if they want to find or talk to devices on your local network—so Google’s really raising the bar for privacy here.
But this rule doesn’t block apps from connecting to your smart home devices. It just means you’ll have more control over which apps can access your network.
Google wants developers to use system tools for common tasks instead. A system device picker, for example, can let a user choose a TV for casting without giving the app access to every device on the home network. That gives users more control while keeping common features working.
Google says the new permission also helps stop malicious apps from using local network access for covert tracking and fingerprinting.
Android 17 hides more information about websites
Google is also closing a privacy gap in secure web connections. HTTPS protects the content of a user’s connection. However, the name of the website can still appear during the early part of the connection.
Network operators and other observers could use that information to see which domains a device was trying to reach. That data can be used to build profiles of users and their online activity.
Android 17 adds support for Encrypted Client Hello (ECH). This feature encrypts the Server Name Indication (SNI). Notably, SNI is sent during the first part of a secure connection. ECH ensures that network watchers can’t determine the exact domain that the app is trying to access.
Google says ECH works with Private DNS to provide stronger privacy for this data. The protection does not cover every site or app on its own. The app’s network library must support ECH, and the server must also support it. For apps that target Android 17, ECH is enabled by default when the needed support exists.
Google is asking developers to update their network libraries so more apps can use the feature.
Certificate checks get stronger
Android 17 also changes the default setting for Certificate Transparency. Digital certificates help a phone check that a website or service is genuine. If an attacker gets a fake certificate, that person could try to intercept an encrypted connection.
Certificate Transparency adds another layer of checks. It requires the certificates to be in publicly visible logs, making it easy to identify any abnormal or incorrectly issued certificate.
Certificate Transparency becomes enabled automatically starting from Android 17. This feature applies to applications that are targeting API level 37 and above. Developers may opt out of the feature under certain conditions in Android network security configuration.
Google says the change can make certificate-based attacks harder to hide. The feature is not completely new to Android. Android 16 added Certificate Transparency support, but apps had to opt in. Android 17 changes the default for apps that target the new API level.
Certificate Transparency proved critical after attackers compromised DigiCert in April 2026, stealing 27 code-signing certificates to sign Zhong Stealer malware and bypass Windows security checks. DigiCert revoked 60 certificates, highlighting the value of public certificate logging.
Carriers can turn off 2G by default
Android 17 also targets a different threat: SMS blaster attacks. Hackers may establish fake cell towers that will cause the phones in the area to switch off from the advanced network and go back to the old 2G networks. Once a phone connects to 2G networks, attackers can then send phishing texts to it.
Already, Android 12 allowed users to manually disable 2G. Android 17 adds a new option for mobile carriers to disable 2G by default for their subscribers. Google calls this a zero-click defense because users do not need to find and change the setting themselves.
The feature still depends on carrier support. Not every Android phone handles this the same way, so the level of protection people get isn’t always consistent.
Android 17 takes a broader approach to privacy
The four changes address different ways that phones can reveal useful information. Local Network Protection limits what apps can learn about devices around a user. ECH hides more information about online destinations. Certificate Transparency adds stronger checks for website certificates. The 2G change cuts off one path used by SMS blasters.
These controls also move more security work into the Android system. Users do not need to manage every protection by hand.
For developers, the changes bring new rules. Apps that need local network access must handle the new permission or use Google’s privacy-focused system tools. Apps that use ECH also need compatible network libraries.
For users, most of the changes should work in the background.
Android 17 does not stop all forms of Wi-Fi tracking. Instead, it makes it harder for apps to quietly scan a user’s local network and learn what devices are nearby.
That is an important distinction. The goal is not to make a phone invisible on every network. It is to give users more control over what apps can discover and to reduce the amount of network data that leaks without their knowledge.
Google’s latest changes show a clear push toward stronger privacy controls at the network level. With Android 17, the company is putting more limits on local device discovery, website data, certificate checks, and older cellular networks.
