Android 17's accessibility restriction works only when Advanced Protection is on

The switch matters more than the version number

Google's 1 October announcement says that Android 17 restricts access to the AccessibilityService API to verified applications categorised as accessibility tools when Advanced Protection is enabled. The control is aimed at malicious apps that use accessibility privileges to read screens, interact with other apps, install malware or resist removal. The Hacker News highlighted the change on 2 October.

The condition matters. An Android 17 device does not gain this restriction merely by receiving the operating-system update. A user needs Advanced Protection on. Google says existing Advanced Protection users will be notified when the new capabilities arrive on their devices. Its post does not provide a public list of every app that will qualify as a verified accessibility tool, so there is a legitimate compatibility question for people who depend on assistive software.

The six features in Google's announcement, separated by what requires another action or has device limits.

Feature	Published condition
Accessibility protection	Applies when Advanced Protection is enabled on Android 17
Intrusion Logging	Separate manual opt-in; encrypted cloud logs retained for a rolling 12 months
USB Protection	Pixel 6+ and select Android 17 devices
Disable WebGPU	Applied through Advanced Protection Mode
Failed Authentication Lock	Select Android 17 devices
View Supporting Apps	Shows which installed apps check Advanced Protection status

Three decisions behind the single switch

Google's settings path is Settings → Security and privacy → Advanced Protection → Device protection. A screen lock is required and a restart may be needed to apply changes. Account protection and device protection are related but separate choices. The accessibility restriction then applies on Android 17 under Device protection; Intrusion Logging still asks for its own consent. This is a layered setting, not a universal operating-system default.

The technical reason accessibility matters is that an AccessibilityService can observe screen content and perform actions on a user's behalf. Those capabilities are essential for assistive tools but also valuable to malicious software. Google's new rule narrows API access to verified applications categorised as accessibility tools when the high-risk protection is active. Google has not published enough detail to declare that every legitimate third-party assistive app will pass the check. An accessibility-dependent user should test their own tools after enabling it.

An Android 17 update alone does not activate every control.

Decision	Effect	Caveat
Install Android 17	Makes new capabilities available	Rollout and device support vary
Enable Device protection	Activates the accessibility rule and other supported controls	User opt-in; screen lock required
Opt into Intrusion Logging	Stores encrypted security events for later review	Separate consent and 12-month rolling retention

What the log records, and what it does not promise

Google says Intrusion Logging records app process starts, app installs and updates, Wi-Fi, Bluetooth, DNS and IP activity, USB file transfers, system certificate changes, and lock or unlock events. It is intended to preserve context that an attacker on the device might otherwise erase. The cloud copy is end-to-end encrypted and rolls off after 12 months. Google says neither the user nor Google can delete stored logs early, even if logging is switched off. A downloaded, decrypted copy is then the user's responsibility to protect.

This is useful forensic context, not a complete packet capture. Google warns that heavy activity can reduce event frequency and that Chrome Secure DNS can leave DNS events out. Chrome Incognito activity can still leave domain or IP evidence in the log. That creates a real privacy trade-off for people who opt in. Teams recommending this feature to staff should explain both the security value and retention consequences before an incident, then check the exact device model for USB and failed-authentication protections.

The forensic log is separate and user-controlled

Google calls Intrusion Logging a way to preserve security and network events for investigation. The events are end-to-end encrypted, stored in the cloud and retained for a rolling 12 months before deletion. Google explicitly makes this feature optional even for a user who already has Advanced Protection. It requires a separate manual opt-in in the settings page.

That separation is sensible for a sensitive log, but it also means a responder should not assume the evidence exists after an incident. An organisation handing high-risk Android devices to staff should decide in advance whether to recommend the logging setting, how users would recover the data, and how those records fit its own incident process. Google's announcement does not claim the feature provides central collection for an enterprise security team.

What to check on an actual phone