Android Intrusion Logging: understand the 12-month commitment before opting in

An additional decision inside Advanced Protection

In its October 1 update, Google describes Intrusion Logging as an optional part of Android Advanced Protection that requires a separate manual opt-in. The announcement places the new capabilities on Android 17 and says existing Advanced Protection users will be notified when they arrive. The logging setup requires Advanced Protection Mode.

Preserving evidence for an investigation

Google says the feature records security and network events for later forensic examination. The intended use is to help a trusted specialist investigate suspected compromise. Recording an event is not a promise to prevent an attack, detect every intrusion or establish what happened without analysis.

Google describes the stored logs as end-to-end encrypted and accessible only to the user. That is the vendor’s security claim, not an independent audit by The Illustral.

Switching it off does not erase the history

The support documentation says stored logs remain for 12 months and cannot be manually deleted early, even after disabling the feature or closing the account. Turning logging off stops new collection, but previously collected, unsent logs are uploaded before deactivation completes. Treat the switch as a decision about future collection rather than immediate deletion.

Consider what the record exposes

Google lists app activity, network connections and other device events among the recorded data. It says Incognito tabs can still generate logged network events. Downloading and decrypting the files also shifts responsibility for protecting those copies to the user.

That tradeoff may matter differently to someone preparing for a forensic investigation and someone simply exploring security settings. Review the retention rule and the support page’s risks before deciding. We have not tested collection, encryption or recovery, and this explainer does not recommend enabling the feature for everyone.