Android’s “Private DNS” Made Me Feel Safe, Until I Saw What My Internet Provider Could Still Track

4.9/5 - (15 votes)

I thought I’d locked my Pixel 8 down tight. Android 15, Private DNS set to strict mode, Google’s Private Compute Core turned on, MAC address randomization enabled, the whole privacy checklist.

Then I installed a traffic analyzer (PCAPdroid) to see what was actually leaving my phone. Within 30 seconds, the illusion cracked: even with Android’s best built-in protections switched on, my internet provider could still learn a lot about where I was going online.

Why Android’s Private DNS doesn’t really hide your browsing

Sommaire

1 Why Android’s Private DNS doesn’t really hide your browsing
2 What Google actually protects, and what it doesn’t
3 The ugly reality of “free VPN” apps
4 The real privacy leak: your IP address
5 My two-week test ended the same way most people end up: I got a VPN

Android’s Private DNS does one job well: it encrypts DNS lookups, the “phone book” requests your device makes to translate a website name into an IP address. In my case, those requests were encrypted using DNS-over-TLS and sent to Cloudflare, just as Android has supported since Android 9.

But here’s the catch: Private DNS only protects the lookup. Once your phone gets the destination IP address, the rest of the connection still reveals key metadata to your internet service provider. Your ISP may not see you ask for “nytimes.com” via DNS anymore, but it can still see the IP address you connect to.

And in many cases, it gets worse. A lot of websites still expose the Server Name Indication (SNI) during the TLS handshake, the early part of setting up an encrypted connection. That means the domain name can remain readable to the network even though the page content is encrypted.

What Google actually protects, and what it doesn’t

I spent a weekend digging through Android 15’s security and privacy settings, and the pattern is consistent: the features are real, but they’re narrower than most people assume.

Take Private Compute Core, which Google has promoted heavily since Android 12. It’s designed to keep certain on-device AI features, like Smart Reply, Now Playing, and Live Caption, isolated from the network. The concept is legitimate, and parts of it are open-source. But it doesn’t shield your web traffic, and it doesn’t stop your ISP (or a sketchy public Wi‑Fi network) from observing where your device is connecting.

There are other blind spots, too. Even with GPS “off,” Android can still scan nearby Wi‑Fi networks. Those networks’ identifiers (BSSIDs) can be used to pinpoint your location within a few yards through massive location databases maintained by companies like Google and Apple. Turning off location services doesn’t necessarily stop the scanning, you often have to dig into a deeper “Wi‑Fi scanning” submenu most people never find.

MAC address randomization, enabled by default since Android 10, helps prevent tracking across different Wi‑Fi networks. But once you’re connected, your traffic can still be linked to you in plenty of other ways.

And Android’s “Always-on VPN” setting? It doesn’t give you a VPN. It just forces your phone to use a third-party VPN app, meaning you still have to pick one and trust it.

The ugly reality of “free VPN” apps

That’s where a lot of users get burned. Search the Google Play Store for a free VPN and you’ll find hundreds of options, many with slick branding and millions of downloads.

But testing has repeatedly found that “free” often means “you’re the product.” In 2024, Top10VPN researcher Simon Migliano tested 100 of the most-downloaded free Android VPNs and reported that nearly 90% showed at least one type of data leak, while 46% asked for permission to scan the apps installed on the phone.

And the risks aren’t theoretical. In 2022, SuperVPN, an app with more than 100 million downloads, was linked to an exposure involving hundreds of millions of records, including IP addresses, emails, and device identifiers. Using the wrong VPN to protect your privacy can backfire spectacularly.

The real privacy leak: your IP address

The most sobering part of my test wasn’t DNS at all, it was how much my IP address gave away. Your IP can be tied to your identity through your ISP’s account records, and it can often be geolocated to a city or metro area with surprising accuracy.

In France, the ISP in this experiment (Free) retains connection logs for a year under national rules. The U.S. doesn’t have a single, uniform federal data-retention mandate for ISPs in the same way, but American providers can still keep extensive logs under their own policies, and those records can be obtained through legal demands. The practical takeaway is the same: if your ISP can see your outbound connections, it can build a detailed picture of your online life.

There’s a newer fix on the horizon, Encrypted Client Hello (ECH), a technology meant to hide SNI during the TLS handshake. Cloudflare supports it, and some major sites do too. But adoption across the web is still uneven, and for now it’s a “check site by site” reality, not a blanket solution Android can magically enforce.

My two-week test ended the same way most people end up: I got a VPN

I tried living with Android 15’s native protections only, Private DNS, reasonable browsing habits, no VPN. After about 10 days, I ran tests on BrowserLeaks and saw the same thing: my public IP was exposed, my location was easy to infer, and SNI could still reveal domains.

I repeated the test on mobile data, expecting a different outcome. It wasn’t. The network still exposed an IP that mapped me to my area, and the handshake metadata still gave away more than most users realize.

That’s the uncomfortable truth behind a lot of mobile privacy marketing: Android’s protections do what they claim to do. The problem is what people assume they do.

Right now, if you want to reliably keep your ISP from seeing where you’re connecting, there’s no Android toggle that replaces a properly implemented VPN tunnel. You either trust your provider with that metadata, or you route your traffic through a VPN you trust not to monetize you instead.

PGRpdiBjbGFzcz0ibHdkLWNvbnRhaW5lciIgaWQ9Imx3ZF9ib3R0b21fc2VjdGlvbiI+DQ0KICAgIDxkaXYgaWQ9Imx3ZF9jb250YWluZXJfbG9nbyI+DQ0KICAgICAgICA8c3ZnIHdpZHRoPSIzNCIgaGVpZ2h0PSI0NSIgdmlld0JveD0iMCAwIDM0IDQ1IiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPg0NCiAgICAgICAgICAgIDxwYXRoIGQ9Ik0xOS4wMzEyIDE4SDIyLjY3OTVIMjYuMjgxMkMyNi41MjE2IDE4IDI2Ljc1MjEgMTcuODk0NiAyNi45MjIxIDE3LjcwNzFDMjcuMDkyIDE3LjUxOTYgMjcuMTg3NSAxNy4yNjUyIDI3LjE4NzUgMTdDMjcuMTg3NSAxNi43MzQ4IDI3LjA5MiAxNi40ODA0IDI2LjkyMjEgMTYuMjkyOUMyNi43NTIxIDE2LjEwNTQgMjYuNTIxNiAxNiAyNi4yODEyIDE2SDE5LjAzMTJDMTguNzkwOSAxNiAxOC41NjA0IDE2LjEwNTQgMTguMzkwNCAxNi4yOTI5QzE4LjIyMDUgMTYuNDgwNCAxOC4xMjUgMTYuNzM0OCAxOC4xMjUgMTdDMTguMTI1IDE3LjI2NTIgMTguMjIwNSAxNy41MTk2IDE4LjM5MDQgMTcuNzA3MUMxOC41NjA0IDE3Ljg5NDYgMTguNzkwOSAxOCAxOS4wMzEyIDE4Wk0yNi4yODEyIDI0SDkuMDYyNUM4LjgyMjE1IDI0IDguNTkxNjQgMjQuMTA1NCA4LjQyMTY4IDI0LjI5MjlDOC4yNTE3MyAyNC40ODA0IDguMTU2MjUgMjQuNzM0OCA4LjE1NjI1IDI1QzguMTU2MjUgMjUuMjY1MiA4LjI1MTczIDI1LjUxOTYgOC40MjE2OCAyNS43MDcxQzguNTkxNjQgMjUuODk0NiA4LjgyMjE1IDI2IDkuMDYyNSAyNkgxNy42NzE5SDI2LjI4MTJDMjYuNTIxNiAyNiAyNi43NTIxIDI1Ljg5NDYgMjYuOTIyMSAyNS43MDcxQzI3LjA5MiAyNS41MTk2IDI3LjE4NzUgMjUuMjY1MiAyNy4xODc1IDI1QzI3LjE4NzUgMjQuNzM0OCAyNy4wOTIgMjQuNDgwNCAyNi45MjIxIDI0LjI5MjlDMjYuNzUyMSAyNC4xMDU0IDI2LjUyMTYgMjQgMjYuMjgxMiAyNFoiIGZpbGw9ImJsYWNrIiAvPg0NCiAgICAgICAgICAgIDxwYXRoIGQ9Ik0xOS4wMzEyIDE4SDIyLjY3OTVIMjYuMjgxMkMyNi41MjE2IDE4IDI2Ljc1MjEgMTcuODk0NiAyNi45MjIxIDE3LjcwNzFDMjcuMDkyIDE3LjUxOTYgMjcuMTg3NSAxNy4yNjUyIDI3LjE4NzUgMTdDMjcuMTg3NSAxNi43MzQ4IDI3LjA5MiAxNi40ODA0IDI2LjkyMjEgMTYuMjkyOUMyNi43NTIxIDE2LjEwNTQgMjYuNTIxNiAxNiAyNi4yODEyIDE2SDE5LjAzMTJDMTguNzkwOSAxNiAxOC41NjA0IDE2LjEwNTQgMTguMzkwNCAxNi4yOTI5QzE4LjIyMDUgMTYuNDgwNCAxOC4xMjUgMTYuNzM0OCAxOC4xMjUgMTdDMTguMTI1IDE3LjI2NTIgMTguMjIwNSAxNy41MTk2IDE4LjM5MDQgMTcuNzA3MUMxOC41NjA0IDE3Ljg5NDYgMTguNzkwOSAxOCAxOS4wMzEyIDE4Wk0yNi4yODEyIDI0SDkuMDYyNUM4LjgyMjE1IDI0IDguNTkxNjQgMjQuMTA1NCA4LjQyMTY4IDI0LjI5MjlDOC4yNTE3MyAyNC40ODA0IDguMTU2MjUgMjQuNzM0OCA4LjE1NjI1IDI1QzguMTU2MjUgMjUuMjY1MiA4LjI1MTczIDI1LjUxOTYgOC40MjE2OCAyNS43MDcxQzguNTkxNjQgMjUuODk0NiA4LjgyMjE1IDI2IDkuMDYyNSAyNkgxNy42NzE5SDI2LjI4MTJDMjYuNTIxNiAyNiAyNi43NTIxIDI1Ljg5NDYgMjYuOTIyMSAyNS43MDcxQzI3LjA5MiAyNS41MTk2IDI3LjE4NzUgMjUuMjY1MiAyNy4xODc1IDI1QzI3LjE4NzUgMjQuNzM0OCAyNy4wOTIgMjQuNDgwNCAyNi45MjIxIDI0LjI5MjlDMjYuNzUyMSAyNC4xMDU0IDI2LjUyMTYgMjQgMjYuMjgxMiAyNFoiIGZpbGw9ImJsYWNrIiAvPg0NCiAgICAgICAgICAgIDxwYXRoIGQ9Ik0xOC43NjU4IDIySDIyLjQxNDFIMjYuMDE1OEMyNi4yNTYyIDIyIDI2LjQ4NjcgMjEuODk0NiAyNi42NTY2IDIxLjcwNzFDMjYuODI2NiAyMS41MTk2IDI2LjkyMjEgMjEuMjY1MiAyNi45MjIxIDIxQzI2LjkyMjEgMjAuNzM0OCAyNi44MjY2IDIwLjQ4MDQgMjYuNjU2NiAyMC4yOTI5QzI2LjQ4NjcgMjAuMTA1NCAyNi4yNTYyIDIwIDI2LjAxNTggMjBIMTguNzY1OEMxOC41MjU1IDIwIDE4LjI5NSAyMC4xMDU0IDE4LjEyNSAyMC4yOTI5QzE3Ljk1NSAyMC40ODA0IDE3Ljg1OTYgMjAuNzM0OCAxNy44NTk2IDIxQzE3Ljg1OTYgMjEuMjY1MiAxNy45NTUgMjEuNTE5NiAxOC4xMjUgMjEuNzA3MUMxOC4yOTUgMjEuODk0NiAxOC41MjU1IDIyIDE4Ljc2NTggMjJaTTI2LjAxNTggMjhIOC43OTcwN0M4LjU1NjcxIDI4IDguMzI2MjEgMjguMTA1NCA4LjE1NjI1IDI4LjI5MjlDNy45ODYzIDI4LjQ4MDQgNy44OTA4MiAyOC43MzQ4IDcuODkwODIgMjlDNy44OTA4MiAyOS4yNjUyIDcuOTg2MyAyOS41MTk2IDguMTU2MjUgMjkuNzA3MUM4LjMyNjIxIDI5Ljg5NDYgOC41NTY3MSAzMCA4Ljc5NzA3IDMwSDI2LjAxNThDMjYuMjU2MiAzMCAyNi40ODY3IDI5Ljg5NDYgMjYuNjU2NiAyOS43MDcxQzI2LjgyNjYgMjkuNTE5NiAyNi45MjIxIDI5LjI2NTIgMjYuOTIyMSAyOUMyNi45MjIxIDI4LjczNDggMjYuODI2NiAyOC40ODA0IDI2LjY1NjYgMjguMjkyOUMyNi40ODY3IDI4LjEwNTQgMjYuMjU2MiAyOCAyNi4wMTU4IDI4Wk0yNi4wMTU4IDMySDguNzk3MDdDOC41NTY3MSAzMiA4LjMyNjIxIDMyLjEwNTQgOC4xNTYyNSAzMi4yOTI5QzcuOTg2MyAzMi40ODA0IDcuODkwODIgMzIuNzM0OCA3Ljg5MDgyIDMzQzcuODkwODIgMzMuMjY1MiA3Ljk4NjMgMzMuNTE5NiA4LjE1NjI1IDMzLjcwNzFDOC4zMjYyMSAzMy44OTQ2IDguNTU2NzEgMzQgOC43OTcwNyAzNEgyNi4wMTU4QzI2LjI1NjIgMzQgMjYuNDg2NyAzMy44OTQ2IDI2LjY1NjYgMzMuNzA3MUMyNi44MjY2IDMzLjUxOTYgMjYuOTIyMSAzMy4yNjUyIDI2LjkyMjEgMzNDMjYuOTIyMSAzMi43MzQ4IDI2LjgyNjYgMzIuNDgwNCAyNi42NTY2IDMyLjI5MjlDMjYuNDg2NyAzMi4xMDU0IDI2LjI1NjIgMzIgMjYuMDE1OCAzMloiIGZpbGw9ImJsYWNrIiAvPg0NCiAgICAgICAgICAgIDxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMF8yMTNfMjcpIj4NDQogICAgICAgICAgICAgICAgPHBhdGggZD0iTTYuMzAwNjEgMjAuNDQwMUM1LjkwMTg4IDE5LjkzNjkgNS43MTIyNiAxOS4yOTM5IDUuNzczMzYgMTguNjUyMUM1LjgzNDQ2IDE4LjAxMDMgNi4xNDEzIDE3LjQyMjEgNi42MjY1MyAxNy4wMTY3TDguMTQ1MzUgMTUuNzUwNkM4LjI1MTA3IDE1LjY1MTMgMTAuMDc0MiAxMy44OTcgMTAuNjQ2NSAxMC43NjA3QzEwLjY3NCAxMC42MDkxIDEwLjc0MzIgMTAuNDY5MiAxMC44NDU5IDEwLjM1NzRDMTAuOTQ4NiAxMC4yNDU2IDExLjA4MDUgMTAuMTY2NSAxMS4yMjYyIDEwLjEyOTRDMTEuMzcxOSAxMC4wOTI0IDExLjUyNTMgMTAuMDk4OSAxMS42NjgzIDEwLjE0ODJDMTEuODExMyAxMC4xOTc1IDExLjkzODEgMTAuMjg3NiAxMi4wMzM3IDEwLjQwNzlMMTcuMDUzMSAxNi43MjlDMTcuMTQ4NyAxNi44NDk0IDE3LjIwOTEgMTYuOTk0OSAxNy4yMjcyIDE3LjE0ODVDMTcuMjQ1MyAxNy4zMDIxIDE3LjIyMDQgMTcuNDU3MyAxNy4xNTU0IDE3LjU5NkMxNy4wOTAzIDE3LjczNDYgMTYuOTg4IDE3Ljg1MSAxNi44NjAyIDE3LjkzMTNDMTYuNzMyNCAxOC4wMTE2IDE2LjU4NDcgMTguMDUyNiAxNi40MzQyIDE4LjA0OTRDMTMuOTk5IDE3Ljk5OTQgMTIuMjE3MSAxOC44ODg3IDExLjQ5OTcgMTkuMzE5OUwxMi40OTQ4IDIwLjU3MzFDMTIuNTc3NyAyMC42NzcyIDEyLjYzNDQgMjAuODAwNCAxMi42NTk5IDIwLjkzMThDMTIuNjg1NSAyMS4wNjMyIDEyLjY3OTEgMjEuMTk4NyAxMi42NDEzIDIxLjMyNjNMMTIuNDUxNSAyMS45NjU4QzEyLjQxNDggMjIuMDg5NSAxMi4zNDk4IDIyLjIwMjEgMTIuMjYxOCAyMi4yOTQyQzEyLjE3MzggMjIuMzg2MiAxMi4wNjUzIDIyLjQ1NTEgMTEuOTQ1NiAyMi40OTQ5QzExLjgyNTggMjIuNTM0OCAxMS42OTgyIDIyLjU0NDUgMTEuNTczNCAyMi41MjMyQzExLjQ0ODYgMjIuNTAyIDExLjMzMDMgMjIuNDUwNCAxMS4yMjg0IDIyLjM3MjhMOS4zODc2MSAyMC45OTQ3QzguODk4NzUgMjEuMzAxNCA4LjMxNjI3IDIxLjQxNDIgNy43NDg0NiAyMS4zMTIyQzcuMTgwNjUgMjEuMjEwMiA2LjY2NjE1IDIwLjkwMDMgNi4zMDA2MSAyMC40NDAxWk0xNi40NDA0IDE3LjIzNTNMMTEuNDIzMiAxMC45MTY5QzEwLjkxNiAxMy42OTc1IDkuNTI4OTYgMTUuNDUwNyA4LjkzNjM3IDE2LjA5MThMMTAuOTkwNiAxOC42Nzg3QzExLjcyNDIgMTguMjE2OSAxMy42ODA2IDE3LjE4MTQgMTYuNDQwNCAxNy4yMzUzWk0xMS42OTIyIDIxLjcxODlMMTEuNjk1NyAyMS43MjMzTDExLjg4NTUgMjEuMDgzN0wxMC44NTkzIDE5Ljc5MTRMMTAuMDM1MSAyMC40Nzg2TDExLjY5MjIgMjEuNzE4OVpNOS4xMzYyMyAyMC4xNzczTDEwLjM1NzQgMTkuMTU5M0w4LjM0OTYzIDE2LjYzMDhMNy4xMjg0NyAxNy42NDg5QzYuODA0NiAxNy45MTg5IDYuNTk5NzYgMTguMzExIDYuNTU5MDEgMTguNzM5QzYuNTE4MjcgMTkuMTY3IDYuNjQ0OTUgMTkuNTk1OCA2LjkxMTE5IDE5LjkzMTFDNy4xNzc0NCAyMC4yNjY0IDcuNTYxNDQgMjAuNDgwNyA3Ljk3ODcxIDIwLjUyNjlDOC4zOTU5OSAyMC41NzMxIDguODEyMzYgMjAuNDQ3MyA5LjEzNjIzIDIwLjE3NzNaIiBmaWxsPSJibGFjayIgLz4NDQogICAgICAgICAgICA8L2c+DQ0KICAgICAgICAgICAgPHBhdGggZD0iTTMwLjE5MDEgMTAuMjAwNlYzNS41MTMxQzMwLjE5MDEgMzYuMjU5IDI5Ljk2NjIgMzYuOTc0NCAyOS41Njc3IDM3LjUwMThDMjkuMTY5MiAzOC4wMjkyIDI4LjYyODcgMzguMzI1NiAyOC4wNjUxIDM4LjMyNTZINC42OTAxQzQuMTI2NTIgMzguMzI1NiAzLjU4NjAxIDM4LjAyOTIgMy4xODc1IDM3LjUwMThDMi43ODg5OCAzNi45NzQ0IDIuNTY1MSAzNi4yNTkgMi41NjUxIDM1LjUxMzFWMTAuMjAwNkMyLjU2NTEgOS40NTQ2NCAyLjc4ODk4IDguNzM5MjcgMy4xODc1IDguMjExODJDMy41ODYwMSA3LjY4NDM4IDQuMTI2NTIgNy4zODgwNiA0LjY5MDEgNy4zODgwNkgyOC4wNjUxQzI4LjYyODcgNy4zODgwNiAyOS4xNjkyIDcuNjg0MzggMjkuNTY3NyA4LjIxMTgyQzI5Ljk2NjIgOC43MzkyNyAzMC4xOTAxIDkuNDU0NjQgMzAuMTkwMSAxMC4yMDA2Wk0yOSAzNi45NDAzVjguNzMxMzRIMy44Nzc2VjM2Ljk0MDNIMjlaIiBmaWxsPSJibGFjayIgLz4NDQogICAgICAgICAgICA8ZGVmcz4NDQogICAgICAgICAgICAgICAgPGNsaXBQYXRoIGlkPSJjbGlwMF8yMTNfMjciPg0NCiAgICAgICAgICAgICAgICAgICAgPHJlY3Qgd2lkdGg9IjEyLjcxODgiIGhlaWdodD0iMTIuOTE0NyIgZmlsbD0id2hpdGUiIHRyYW5zZm9ybT0ibWF0cml4KC0wLjc2ODA5OSAwLjY0MDMzMSAwLjYyMTg1NCAwLjc4MzEzMyAxMiA3LjgwOTUyKSIgLz4NDQogICAgICAgICAgICAgICAgPC9jbGlwUGF0aD4NDQogICAgICAgICAgICA8L2RlZnM+DQ0KICAgICAgICA8L3N2Zz4NDQogICAgPC9kaXY+DQ0KICAgIDxkaXYgaWQ9Imx3ZF9jb250YWluZXJfbGlzdCI+DQ0KICAgICAgICANCiAgICAgICAgICAgIDxwIHN0eWxlPSJmb250LXNpemU6IDExcHg7bWFyZ2luLWJvdHRvbTo1cHg7Ij48c3Bhbj5Db250ZW51IGNvbsOndSBldCBwcm9wb3PDqSBwYXIgI0VSRTI2MDMyMDI2LiBMYSByw6lkYWN0aW9uIGRlIExhIFJldnVlIFRlY2ggbidhIHBhcyBwYXJ0aWNpcMOpIMOgIGxhIHLDqWFsaXNhdGlvbiBkZSBjZXQgYXJ0aWNsZS48L3NwYW4+PC9wPg0NCiAgICAgICAgDQogICAgICAgIA0KICAgICAgICAgICAgPHAgc3R5bGU9ImZvbnQtc2l6ZTogMTFweDttYXJnaW4tYm90dG9tOjVweDsiPjxzcGFuPi0gQ3LDqWRpdHMgaW1hZ2VzIDogRnJlZXBpayA8L3NwYW4+PC9wPg0NCiAgICAgICAgDQogICAgICAgIA0KICAgIDwvZGl2Pg0NCjwvZGl2Pg==