NordVPN, available at $3.49/month on its 2-year plan, is one of the most established options for filling in the gap Android leaves behind.
What Android 17’s ECH feature actually does
When you connect to a website, your device sends what’s called a “Client Hello” message, part of the TLS handshake that establishes an encrypted connection. That message contains a field called Server Name Indication (SNI), which tells the server which specific site you’re trying to reach. Until now, that SNI field was sent in the clear, meaning any observer on the network, including your ISP, your Wi-Fi hotspot operator, or anyone with access to the routing infrastructure between you and the website, could read the domain name of every site you visited.
Encrypted Client Hello, standardized this year as RFC 9849, wraps that SNI field in encryption. When both your browser and the website support ECH, the destination domain name becomes invisible to intermediaries. Google’s Jigsaw research team worked with Android on the implementation, and it will roll out with Android 17. The company also announced a feature called ECH GREASE, which sends randomized fake ECH values on every connection so observers cannot easily distinguish protected traffic from unprotected traffic. Google tested this on 10,000 domains and reported no measurable change in connection success rates.
Why this was a real privacy gap
The size of the gap ECH closes is worth understanding. Most privacy-conscious users had assumed that switching to encrypted DNS (DoH or DoT) hid their browsing history from their ISP. It did not, not completely. The DNS lookup was encrypted, but the subsequent TLS handshake still exposed the destination domain through the unencrypted SNI field. Cybersecurity researchers have publicly demonstrated this leak using standard network capture tools, showing that a full picture of which websites a user visits could be reconstructed even when the actual page content was encrypted.
That data has commercial value. ISPs in many jurisdictions have historically monetized browsing history data for advertising, and in some regions, they are required to log it and hand it over to law enforcement. Even where regulations restrict what ISPs can do with the data, the fact that it exists at all creates a target for breaches. The Android 17 update genuinely improves this situation, and Google deserves credit for pushing an internet standard into a mainstream operating system.
Add IP protection with NordVPN
What ECH does not fix
ECH is a real improvement, but it has two significant limits. First, ECH only works when the website itself supports it. Most web servers on the internet currently do not, which means the domain name of the sites you visit will remain visible to your ISP until adoption becomes widespread. That transition is expected to take years, not months, given how slowly server-side security features tend to roll out across the long tail of the web.
Second, and more fundamentally, ECH does not hide your IP address. Your ISP still sees which servers your device connects to, which reveals a significant amount of information about your activity even without the specific URLs. Network operators can still map IP addresses to services (this IP belongs to Netflix, that one to a banking site) and build usage patterns from that alone. On top of that, the IP address you present to every website you visit is still your real one, tied to your home or mobile connection, which sites use for tracking, geolocation, and profile building.
Where NordVPN fits in the picture
A VPN handles the piece Android 17 does not. When you connect through NordVPN, your device establishes an encrypted tunnel to a NordVPN server, and all your traffic exits from that server’s IP address rather than your own. Your ISP sees a single encrypted connection to the VPN server and nothing about which sites you actually visit, whether they support ECH or not. Websites see the VPN server’s IP address rather than yours, which prevents IP-based tracking, geolocation, and profile linkage across sessions.
NordVPN runs on the NordLynx protocol, built on WireGuard, and covers over 7,000 servers across 118 countries. The apps are available on Android, iOS, Windows, macOS, Linux, browser extensions, and router installations, with up to 10 simultaneous device connections per account. The company is based in Panama, outside the 5, 9, and 14 Eyes intelligence-sharing alliances, and its no-logs policy has been independently audited multiple times by PricewaterhouseCoopers and Deloitte.
The Basic plan at $3.49/month
NordVPN’s Basic plan is currently available at $3.49/month, which works out to $94.23 billed once for 27 months of service (24 + 3 free). That is a 69% discount off the standard rate. Annual renewal continues at $139.08/year, cancelable from the account dashboard at any time.
The plan includes the core VPN across up to 10 devices, applications for Windows, macOS, Linux, iOS, Android, browser extensions, and router installation for whole-household coverage. Combined with Android 17’s ECH support (once it rolls out to your device), the two together cover both the SNI leak and the IP address leak, which is what most people want privacy tools to do in the first place.
Get NordVPN Basic at $3.49/month
30 days to test everything, no strings attached
NordVPN backs every plan with a 30-day money-back guarantee. If the service does not fit the way you use your devices, you can request a full refund within the first month. Refunds are processed through 24/7 chat support, and funds typically return within 5 to 10 business days depending on the payment method used.
That gives you a full month to install the apps across your devices, test the speeds on your home connection, verify that the tunnel handles your usage, and see whether the service fits before the refund window closes. A note on the subscription: the $3.49/month rate applies to the first 27 months. Auto-renewal then kicks in at the standard annual rate. If you would rather renegotiate or cancel before renewal, set a reminder in your calendar 7 to 10 days before the renewal date.