Phones and operating systems
"Network may be monitored" on Android: meaning and removal
Network may be monitored"Network may be monitored" means a certificate authority has been added to your Android device's trusted credentials, and whoever controls that CA could decrypt HTTPS traffic from apps that trust it. It is a notice, not an error, and does not prove that anyone is watching.
Where the text appears
The wording depends on the Android version:
| Android version | Where you see it |
|---|---|
| 4.4 to 6.0 | Notification titled "Network may be monitored", with "By an unknown third party" |
| 7.0 and later | Notification titled "Certificate authority installed" (or "authorities"), with "By an unknown third party", "By your work profile admin" or "By example.com" |
| 7.0 and later | Quick Settings footer "Network may be monitored"; Settings dialog with the same title |
The Settings dialog explains: "A third party is capable of monitoring your network activity, including emails, apps, and secure websites. A trusted credential installed on your device is making this possible." Manufacturers often reword these strings in their own Android skins.
How much risk it creates
The risk depends on two things: who holds the private key of the added CA, and which apps trust it. Since Android 7.0, apps that target API level 24 or later trust only the system CAs unless their developers opt in, so most banking and shopping apps ignore a user-added CA. Browsers and apps built for older API levels may still trust it. Interception also needs something in the traffic path, such as a VPN app, a proxy setting or a network device, that uses the CA. A CA you installed for one debugging session on a test phone is a small risk; an unexplained CA on your everyday phone is not.
Common causes, most frequent first
1. You installed a CA for debugging or a tool
Developers install the root of Charles, Fiddler, mitmproxy, Proxyman or a packet-capture app to inspect HTTPS. The warning stays until the CA is removed.
2. A VPN, ad-blocker, parental-control or antivirus app
Apps that filter HTTPS content need a CA to do it and ask the user to install one during setup. Desktop security suites do the same, see antivirus HTTPS scanning. Check recently installed apps and their setup steps.
3. Your employer or school manages the device
With a work profile or a fully managed device, the notification names the work profile admin or the organization's domain. Corporate TLS inspection uses such a CA, see corporate SSL inspection. Ask IT before removing anything; the policy will usually reinstall it.
4. Wi-Fi or VPN setup that imported a CA into the general store
Some enterprise Wi-Fi or VPN instructions have users install a CA certificate. If it went into the general CA store rather than being used only for that connection, it triggers the warning.
5. An unknown or malicious certificate
If you cannot explain the certificate, treat it as a risk: stalkerware and malicious profiles use the same mechanism.
Confirm which certificate is responsible
- Tap the notification or the Quick Settings footer and choose to check the certificate. The dialog lists the CA names.
- Or open Settings > Security (or Security & privacy) > More security settings > Encryption & credentials > Trusted credentials and select the User tab. Every entry there is user-added.
- Tap an entry to see its issuer, validity and fingerprint. Names such as "Charles Proxy", "mitmproxy" or an app vendor identify the source.
How to fix it
Remove the CA and the app that installed it; on a managed device, ask IT instead.
Remove a CA you no longer need: in Trusted credentials > User, tap the certificate and choose Uninstall. Pixel phones also offer Encryption & credentials > User credentials to remove specific credentials, or Clear credentials to remove all user certificates.
Remove the app that installs it: uninstall the VPN, filter or capture app first, otherwise it may add the CA again.
Managed devices: leave the CA in place if your organization requires it, or ask IT to remove the work profile.
Developers: keep debugging CAs on test devices only. In your app, trust them only in debug builds:
<network-security-config>
<debug-overrides>
<trust-anchors>
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
Android's documentation notes that debug-overrides applies only when android:debuggable is true, so release builds are unaffected.
How to verify the fix
- The Trusted credentials > User tab is empty, or contains only CAs you have decided to keep.
- The notification and the Quick Settings footer no longer appear after a restart.
- Open a site you know in Chrome, tap the icon left of the address and check that the certificate is issued by a public CA rather than a proxy or filter product; compare with the SSL checker.
FAQ
Does "Network may be monitored" mean someone is reading my traffic right now?
No. It means interception is possible because a CA you or an administrator added is trusted. Whether traffic is intercepted depends on whether a proxy, VPN app or network device is using that CA. Find out who installed it before deciding.
I removed the certificate but the warning came back. Why?
An app or device policy is reinstalling it. On a managed or work device, the organization's MDM reapplies its CA. On a personal device, look for a VPN, ad-blocking, parental-control or "security" app that asks to install a certificate, and uninstall that app first.
Is it safe to keep a CA I installed for debugging?
Only on a test device, and only while you need it. Anyone with that CA's private key, for example the debugging proxy's generated key on your laptop, can decrypt your HTTPS traffic in browsers that trust user CAs. Remove it when testing ends.
Why do some apps still fail after I installed the CA for debugging?
Apps targeting API level 24 or later ignore user-added CAs unless their network security configuration opts in, often only in debug builds through debug-overrides. See Android apps ignoring user CAs.