TL;DR
Screenshots and code in Google Play Services 26.02.31 indicate Android 16’s Intrusion Detection (Intrusion Logging) is being prepared for release inside the Advanced Protection settings. The feature will store encrypted device-activity logs for post-breach analysis, auto-delete them after 12 months, and is expected with Android 16 QPR3 in March 2026.
What happened
Android Authority spotted references to an Intrusion Detection (also called Intrusion Logging) setting inside Google Play Services build 26.02.31, showing the option appearing under Advanced Protection’s new “Other features” section. The screens describe preserving encrypted logs of device activity — including connections, app installs, unlock events and browsing — for use if a device is compromised. The Play Services build had the feature manually enabled for testing and will not flip the switch for users automatically. The settings note logs are end-to-end encrypted, inaccessible to Google, and are removed automatically after 12 months; users cannot delete them manually. Android 16 reached stable in June 2025, but Intrusion Detection had not been widely available by January 2026. The reporting says the feature is expected to ship with Android 16 QPR3, targeted for March 2026.
Why it matters
- Provides a consolidated, post-breach source of device activity that can help users and investigators understand what happened after an intrusion.
- Putting Intrusion Detection under Advanced Protection centralizes security controls, making them easier for users to find and manage.
- End-to-end encryption and a claim that Google cannot access the logs aim to preserve user privacy even while retaining forensic data.
- Automatic 12-month deletion reduces the window of long-term exposure for sensitive activity records.
Key facts
- Intrusion Detection (Intrusion Logging) was identified in Google Play Services version 26.02.31.
- The Play Services build shown had the feature manually enabled; that build will not enable Intrusion Detection for all users.
- The option appears in Advanced Protection under a new 'Other features' section.
- Logged activities include device connections/USB events, app installs, times the screen was unlocked, browsing history and more.
- Logs are described as end-to-end encrypted and not accessible to Google.
- Logs are automatically deleted after 12 months and cannot be deleted manually, per the settings panel.
- Android 16 reached stable release in June 2025, but Intrusion Detection was not available as of January 2026.
- The feature is expected to arrive with Android 16 QPR3, which is slated to roll out in March 2026.
What to watch next
- Whether Intrusion Detection is included in the Android 16 QPR3 stable release when it arrives in March 2026.
- Whether future Play Services updates will enable Intrusion Detection by default or still require user action — not confirmed in the source.
- Which device models and carriers receive the feature and how broadly Google rolls out Advanced Protection changes — not confirmed in the source.
Quick glossary
- Advanced Protection: A consolidated security setting in Android that groups multiple privacy and protection features under a single menu.
- Intrusion Detection / Intrusion Logging: A feature that preserves encrypted records of device activity so users can review events after a suspected security breach.
- End-to-end encryption: A method of encrypting data so that only the endpoints (the user’s device and intended recipient) can read it, not intermediaries.
- Google Play Services: A background service and API layer on Android that delivers app services, security features and updates independently of the OS release.
Reader FAQ
What does Intrusion Detection do?
It preserves encrypted logs of certain device activity (connections, app installs, unlocks, browsing) for review after a suspected breach.
Will Google be able to read these logs?
The settings state logs are end-to-end encrypted and Google cannot access them.
Can I delete the logs myself?
According to the settings panel, logs cannot be deleted manually and are automatically removed after 12 months.
When will the feature arrive for most users?
The reporting expects Intrusion Detection to land with Android 16 QPR3, targeted for March 2026.
This long-due Android 16 Advanced Protection feature is ready for rollout Credit: By Karandeep Singh Oberoi Published 26 minutes ago Karandeep Singh Oberoi is a Durham College Journalism and Mass…
Sources
- This long-due Android 16 Advanced Protection feature is ready for rollout
- 4 essential facts about Android 16's Advanced Protection …
- Advanced Protection: Google's Strongest Security for …
- Google to enhance security with Advanced Protection …
Related posts
- I Decentralized My Phone: Watch the Video Walkthrough and Its Impact
- Subway Surfers City arrives on iOS February 26 with new modes
- YouTube hosts over 100 classic Sesame Street episodes, including 1969 premiere