Google says 80% of Android apps now encrypt network traffic by default, due to a policy introduced in Android 9, up from less than 20% a year ago
Google has announced that 80% of Android apps now encrypt all traffic by default, thanks to the increased uptake of transport layer security (TLS).
Context & Ripple Effects
This closes a loop Google has been opening for years on its own surfaces: encrypted web requests to its non-YouTube sites hit 75% back in 2016 per Google's own tally, and Chrome-on-Android traffic reached 64% HTTPS in 2017 as measured by Google. What changed with Android 9 is that Google stopped relying on developer goodwill and made cleartext traffic opt-in — and the app ecosystem followed, jumping from under 20% to 80% in roughly a year.
The gap this policy attacks was stark: as recently as 2016, fewer than 10% of Android phones had storage encryption at all against about 95% of iPhones, and Nougat's file-based encryption was framed as years behind Apple on lock-screen security. Transport-layer defaults are the network-side half of that same catch-up project.
First-order effects
- The remaining ~20% of Android apps still sending cleartext traffic now stand out to users, reviewers, and Google's Play tooling as laggards rather than the norm, since the platform default flipped against them.
- Developers who built against plaintext endpoints or self-signed certificates face immediate breakage pressure: the OS-level default means their apps fail unless they explicitly re-enable cleartext or fix their backends.
Second-order effects
- Backend operators serving Android clients get a forced upgrade path — TLS termination becomes table stakes for any API with Android reach, pushing certificate management and renewal into standard mobile-devops practice.
- Network middleboxes and analytics vendors that depended on inspecting plaintext mobile traffic lose that vantage point at scale, shifting their pitch toward endpoint SDKs and metadata.
Third-order effects
- If the pattern from Chrome's HTTPS rollout holds — measurement, then defaults, then deprecation warnings — the next structural step is Google treating cleartext as a policy violation rather than an opt-in, making encrypted transport a distribution requirement on Android.
- Platform-set security defaults are becoming the primary lever for mobile privacy, more effective per unit of effort than either user settings or exhortation, which is exactly the mechanism Google's earlier ad-encryption push across its platforms pioneered on the web side.
The trend: Google is converting encryption from an optional best practice into a platform-enforced default across every surface it controls — browser, ads, and now third-party apps.