Android 17 privacy toggle doesn’t block in-app browsing leaks

Google released Android 17 with a new privacy toggle intended to limit cross-app tracking and access to device identifiers. Independent tests of the feature found that users’ web browsing activity can still be exposed when web content loads inside apps, and through network-level signals and analytics integrations.

The toggle appears in Android 17 settings and is presented as a way to restrict which system identifiers apps can read and to reduce targeted advertising. Testers focused on whether flipping the control would prevent apps from learning which websites a user visits when pages open inside an app.

Tests covered common scenarios: following links from social apps, opening pages in in-app browser views and using apps that embed third-party web content. When pages loaded in an app’s WebView or custom in-app browser, referrer headers, cookies and session tokens continued to pass between the app and the web content. Those headers and tokens can allow site owners and analytics services to correlate visits across sessions.

Separately, network-level traces such as DNS queries, cached site resources and other metadata remained visible to apps that handle network traffic or act as browsers. Flipping the Android 17 toggle did not modify those HTTP-level data flows or clear cached artifacts left on the device by browsing sessions.

The tests also found that first-party integrations and embedded analytics SDKs were unaffected. Apps that load tracking scripts or send browsing events to their own servers continued those actions unless developers remove or change the code. The toggle restricts access to some device identifiers but does not intercept or block web requests between a client and a server.

Stopping the kinds of leaks documented in the tests would require changes beyond a single client setting. Possible technical steps include altering how in-app browsers handle referrer information, tighter sandboxing of WebView instances, and greater protection or obfuscation of network metadata. App developers can also remove third-party trackers, limit server-side logging of browsing events, or route content through privacy-preserving proxies, but those options require work by developers and service operators.

Privacy advocates recommend that users who want stronger protection avoid opening links inside apps and use dedicated browsers with privacy modes or extensions that block trackers. They also call for clearer documentation from platform makers and tools that address web-level signals specifically.

Android 17’s toggle joins previous platform changes such as a privacy dashboard, tighter sensor permissions and adjustments to advertising identifiers. Current tests indicate the setting narrows access to some identifiers but does not prevent apps from observing browsing-related data emitted during ordinary web interactions.