Android’s Built-In Privacy Tools Are More Powerful Than You Think
When most people think about VPNs and private browsing on Android, they immediately reach for third-party apps — NordVPN, ExpressVPN, or Mullvad. These are excellent tools, but Android itself ships with robust built-in privacy infrastructure that most users have never touched: a system-level Private DNS setting that encrypts all DNS queries from every app simultaneously, a VPN framework that supports full device tunneling and split tunneling, and a per-app network access control system that prevents specific apps from sending any data at all. Understanding and using these built-in features can significantly improve your privacy and security without spending money on a third-party subscription.
Private DNS: Encrypt Every DNS Query on Your Phone
Every time you visit a website or connect to an online service, your device sends a DNS query — a request to translate a domain name (like google.com) into an IP address. By default, these queries are sent in plain text to your internet provider’s DNS servers, allowing your ISP to see every domain you visit. Android’s Private DNS setting encrypts these queries using DNS-over-TLS, hiding them from your ISP and any network monitors. To enable it, go to Settings > Network & Internet > Private DNS. Select “Private DNS provider hostname” and enter a DNS-over-TLS address. Recommended options: dns.google (Google’s encrypted DNS), cloudflare-dns.com (Cloudflare’s 1.1.1.1 with TLS), or dns.adguard.com (AdGuard’s DNS which also blocks ads and tracking). This setting applies to every app on your phone simultaneously — no per-app configuration required.
Setting Up a VPN Without a Third-Party App
Android includes a built-in VPN client that supports IKEv2/IPSec, L2TP/IPSec, and PPTP protocols. If your workplace, university, or a privacy-focused VPN provider gives you manual configuration credentials, you can connect directly through Android without installing any VPN app. Go to Settings > Network & Internet > VPN > + (Add VPN). Enter the VPN name, select the appropriate type from the dropdown, enter the server address, and input your username and password. Save and connect. The VPN runs system-wide and will appear in your status bar while active. For free VPN server configurations compatible with Android’s native VPN client, many countries’ public university networks provide compatible IKEv2 configurations for student use.
VPN Split Tunneling: Route Only Specific Apps Through the VPN
If you are using a VPN app that supports split tunneling (most premium VPN apps do), Android 17 allows you to configure which apps use the VPN tunnel and which use your regular internet connection directly. This is useful for routing only your browser and messaging apps through the VPN for privacy while allowing streaming apps like Netflix — which may block VPN IP addresses — to connect directly. In most VPN apps, find split tunneling under the app settings. In Android’s native VPN framework, split tunneling is managed under Settings > Network & Internet > VPN > [your VPN profile] > Allowed apps.
Network Access Control: Blocking Apps from the Internet
Android 17 introduced per-app network permission controls under Settings > Apps > [App Name] > Mobile Data & Wi-Fi. Here you can independently enable or disable mobile data, Wi-Fi access, and background data for each app individually. For apps that have no business reason to access the internet — offline games, local document editors, offline music players — disabling all network access prevents any unauthorized data transmission from those apps regardless of what permissions they have declared. This is a simple but powerful form of data exfiltration prevention that requires no technical expertise to configure. For more Android privacy guides, visit Android People.