This long-due Android 16 Advanced Protection feature is ready for rollout - Android Police

Android 16’s Advanced Protection suite is finally close to gaining Intrusion Logging (also referred to as Intrusion Detection), a long-awaited tool designed to help users investigate what happened after a security breach.

Clues spotted in Google Play Services v26.02.31 show Intrusion Logging appearing at the bottom of the Advanced Protection menu under an “Other features” section. While the feature was manually enabled in testing and won’t activate just by updating Play Services, its presence suggests a public launch is imminent with Android 16 QPR3, expected in March 2026.

Why it matters: Advanced Protection consolidates Android’s strongest security tools in one place. It launched with Theft Detection, Offline Device Lock, Unknown App Protection, and more—but Intrusion Logging has been the missing piece since Android 16 went stable in June 2025.

What Intrusion Logging does: It preserves encrypted records of select device activities so you can review them after a suspected compromise. Google reiterates that these logs are protected end to end and are not accessible to the company. Your device may recommend enabling the feature during protection setup, but it remains optional.

What gets recorded:

• Device connections (like USB events)
• App installs
• Screen unlock events
• Browsing history
• Additional relevant security signals

Data handling and retention:

• Logs are encrypted and tied to your account
• Google cannot read the logs
• Logs auto-delete after 12 months and cannot be removed manually

Rollout timeline: Intrusion Logging is expected to ship broadly with Android 16 QPR3 in March 2026. Until then, seeing it in Play Services indicates Google is finalizing the feature’s settings and placement.

Source: https://www.androidpolice.com/android-16s-intrusion-logging-looks-ready-to-be-rolled-out/