Incognito Mode: What It Actually Hides — and the 5 Things It Doesn't

Incognito mode — called Private Browsing in Firefox and Safari, InPrivate in Edge — is one of the most misunderstood features in consumer technology. A 2018 University of Chicago study found that a majority of users believed incognito mode hid their activity from their internet service provider, employer, or the websites they visited. None of those beliefs are correct. Google settled a $5 billion class-action lawsuit in 2024 over allegations that it tracked users in Chrome's incognito mode — a case that highlighted just how misleading the feature's name is.

What incognito mode actually does: it prevents your browser from saving your browsing history, cookies, site data, and form inputs to your device after the session ends. That's it. When you close an incognito window, the browser deletes the local record of what you did. This is useful for: preventing other people who use your device from seeing your browsing history; logging into a second account on a site without logging out of the first; and preventing sites from reading cookies set by previous sessions.

What incognito mode does NOT hide: your activity from your internet service provider (your ISP sees every DNS request and connection you make, regardless of browser mode); your activity from your employer or school (if you're on a corporate or school network, the network administrator can see your traffic); your activity from the websites you visit (sites can still see your IP address, track you via browser fingerprinting, and log your activity on their servers); your activity from Google if you're signed into a Google account; and your real IP address from anyone.

The Google lawsuit is instructive. Even in incognito mode, Chrome was sending data to Google through Google Analytics, Google Ad Manager, and other Google services embedded in websites. The lawsuit alleged that Google collected enough data to identify users' browsing habits despite their use of incognito mode. The $5 billion settlement — while not an admission of wrongdoing — resulted in Google updating its incognito mode splash screen to more clearly disclose what the feature does and doesn't do.

For genuine privacy from your ISP and network administrator, you need a VPN — it encrypts your traffic so your ISP sees only that you're connected to a VPN server, not what sites you're visiting. For privacy from websites and advertisers, you need a combination of a privacy-focused browser (Firefox, Brave), a content blocker (uBlock Origin), and ideally a VPN. For anonymity — hiding your identity from the sites you visit — you need Tor Browser, which routes your traffic through multiple relays to obscure your origin.

The right mental model for incognito mode: it's a local privacy tool, not an online privacy tool. It protects you from people who have physical access to your device. It does nothing to protect you from the network, the websites, or the advertisers. Use it for what it's good at — keeping your device's browsing history clean — and use a VPN and privacy browser for everything else.