How Android’s Intrusion Logging Helps Track Security Issues

Back in May 2025, Google announced a new feature called Intrusion Logging for Android devices. This feature helps users track possible security issues and decide whether their private data has been exposed to hackers. However, the company has yet to roll it out to users. Now, a new report gives us a first look at how the feature could work and what it may offer once it becomes available.

Intrusion Logging lets users review device security logs

Folks over at Android Authority have reverse-engineered version 26.02.31 of Google Play Services to find details about Intrusion Logging. As you can see in the screenshots below, the Advanced Protection menu (in Settings) lists the Intrusion Logging option under Other features. The description reads “Preserve encrypted logs of some device activity in case of a security issue.”

During Device Protection setup, the screen shows the option to either continue or skip the feature, along with a clear explanation of how it works. It notes that all activity logs are end-to-end encrypted and stored on Google servers. The types of data include device connections, app installs, screen unlock times, browsing history, and other data. This can help users spot suspicious behavior on their devices.

The best thing is that Intrusion Logging is tamper-resistant, meaning hackers or anyone can’t alter the logs. Moreover, the system automatically deletes logs after 12 months. Note that you cannot manually delete these logs as they are required for a security investigation.

If you ever suspect your device has been compromised, you can download the logs locally for review. Accessing these logs requires both the Google account and screen lock, such as a PIN, pattern, or password. While Google has not confirmed a rollout timeline for Intrusion Logging, the outlet expects it could be part of the upcoming stable Android 16 QPR3. We’ll let you know when the feature becomes available to users.