[wtbob]

It wouldn't matter if contacts were encrypted client-side, but Google seen to have a severe allergy to client-side encryption. Mozilla are really leading the way on this issue.

What I think is particularly sad is that Google could still make a huge amount of money without exposing one's private information directly.

[9point6]

Don't all the current nexus devices come with full-device encryption enabled?

[wtbob]

Full-device encryption does nothing when data are transmitted off-device.

E.g., as long as my photos stay on my phone, they are encrypted, but if I back them up to Google+ then Google may read them.

Which is really pretty crazy: Google don't need to read those photos (or my contacts, or my documents); my computers need to, and the computers of those I share the photos with need to.

I could encrypt each photo with a unique key, and encrypt that key with my own private symmetric key, as well as my friends' public asymmetric keys, and then both they and I could view the photos at any time (our devices knowing how to access the keys we have authorised for them), but Google would not.

[kasabali]

It doesn't make your synced contacts encrypted in client side, though.

[ansible]

I think it is turned on by default for 5.0. But it has certainly been an option before that. I turned it on with my Nexus 4 under 4.4.