Back when I had an old 2G featurephone, I inherited the exact same model from a friend (Sprint/CDMA). I used QPST to clone my ESN onto that one, to have a handy backup device.
When both were on, calling my number would ring both (I only ever checked this with them in the same cell). Picking up both I would hear audio in both until one of them "won". The ESN can't be considered any kind of secret, so the observed behavior makes it clear that there is no meaningful encryption.
We've had two generations of mobile protocols since then, but with Qualcomm et al's attitude of "lock things down harder" rather than Kerckhoff's principle and open review, I doubt security has gotten any better.
If you want meaningful mobile privacy, the only way to achieve this is with separate application/baseband processors that communicate over an auditable bus (so not a broken-by-design Qualcomm integrated chipset), with encryption done on the trusted application processor. The easiest way to realize this is using a mifi+vpn+voip. Note that this still leaves your location fully tracked, but most every use of the cell network will do that.