To enhance user privacy, Android 9 introduces several behavior changes, such as limiting background apps' access to device sensors, restricting information retrieved from Wi-Fi scans, and new permission rules and permission groups related to phone calls, phone state, and Wi-Fi scans.
These changes affect all apps running on Android 9, regardless of target SDK version.
android:usesCleartextTraffic
Indicates whether the app intends to use cleartext network traffic, such as cleartext HTTP. The default value is "true".
When the attribute is set to "false", platform components (for example, HTTP and FTP stacks, DownloadManager, MediaPlayer) will refuse the app's requests to use cleartext traffic. Third-party libraries are strongly encouraged to honor this setting as well. The key reason for avoiding cleartext traffic is the lack of confidentiality, authenticity, and protections against tampering: a network attacker can eavesdrop on transmitted data and also modify it without being detected.
This flag is honored on a best effort basis because it's impossible to prevent all cleartext traffic from Android applications given the level of access provided to them. For example, there's no expectation that the Socket API will honor this flag because it cannot determine whether its traffic is in cleartext. However, most network traffic from applications is handled by higher-level network stacks/components which can honor this flag by either reading it from ApplicationInfo.flags or NetworkSecurityPolicy.isCleartextTrafficPermitted().