Your Incognito Mode Is Lying to You

Here's the deal: incognito mode (or "private browsing" or whatever your browser calls it) does exactly one thing well. It doesn't save your browsing history, cookies, or form data after you close the window. That's it. That's the feature.

The problem is that most people think it does a lot more than that.

What People Think Incognito Does

Based on conversations I've had (and a depressing amount of Reddit threads), people seem to believe incognito mode:

• Makes them invisible to websites
• Hides their IP address
• Prevents tracking
• Makes them anonymous
• Protects them from their ISP seeing what they're doing

None of that is true. Not even a little bit.

What Actually Happens in Incognito

When you open an incognito window, your browser creates a temporary session. It starts with no cookies, no stored data, and no history from your normal browsing. When you close the window, it throws all of that away.

That's genuinely useful for some things. Logging into a second account. Checking what a page looks like without your cached CSS. Buying a plane ticket without the airline's cookie-based price manipulation (though whether that actually happens is debatable).

But while you're browsing in that incognito window? You're just as visible as you are normally.

The Fingerprint Doesn't Change

This is the big one. Canvas fingerprinting, WebGL rendering, audio context fingerprinting, your installed fonts, your screen resolution, your timezone, your language settings - none of that changes in incognito mode. Why would it? Your hardware is the same. Your OS is the same. Your browser engine is the same.

I tested this with my own fingerprinting tool. Opened a normal window, ran the scan, noted the results. Opened incognito, ran it again. Identical fingerprint. Same canvas hash. Same WebGL renderer string. Same audio context signature. Same everything.

The only differences were the things incognito is designed to clear: cookies and local storage were empty, and document.cookie returned nothing. But the hardware-based identifiers - the stuff that actually makes fingerprinting work - were completely unchanged.

Your IP Address Is Still Your IP Address

Incognito mode does not route your traffic through any kind of proxy or VPN. Every website you visit in incognito sees the same IP address they'd see in a normal window. Your ISP sees every domain you connect to (unless you're using DNS-over-HTTPS, and even then they see the IP addresses).

This shouldn't be surprising, but it catches people off guard constantly. Incognito is a local privacy feature. It protects you from someone who picks up your laptop and checks your history. It does nothing about network-level observation.

WebRTC Still Leaks

This one's extra annoying. WebRTC can leak your local and sometimes public IP address through STUN requests, completely bypassing proxy settings. This works the same in incognito as it does in a normal window.

So even if you somehow are using a proxy, WebRTC might still rat you out. Incognito mode doesn't disable WebRTC or change how it behaves.

Logged-In State Doesn't Matter (Much)

"But I'm not logged into anything in incognito!" Sure. You don't have your Google session cookie. But if you immediately log into Google in your incognito window (which most people do), you've linked all your incognito browsing to your account for that session.

And even without logging in, the combination of your fingerprint + IP address + browsing patterns is usually enough to correlate your incognito session with your normal browsing.

What Chrome Actually Says

Credit where it's due: Chrome's incognito page now explicitly says "your activity might still be visible to websites you visit, your employer or school, and your internet service provider." They're being honest about it. Most people just don't read it.

Firefox is similarly upfront. Safari less so, but the behavior is the same across all of them.

What Should You Actually Use Instead?

Depends on your threat model (I know, annoying answer, but it's true):

Just don't want targeted ads following you around? uBlock Origin + Firefox with Enhanced Tracking Protection. Kills most third-party tracking. Won't make you anonymous but seriously reduces the commercial surveillance.

Don't want your ISP snooping? A reputable VPN (emphasis on reputable - the free ones are the product). DNS-over-HTTPS helps too but isn't sufficient on its own.

Actually need anonymity? Tor Browser. It's the only mainstream browser specifically designed to make all users look identical. It standardizes window size, blocks fingerprinting APIs, routes traffic through multiple relays, and generally does what people think incognito does.

Want to see what you're actually leaking? I built a thing for that: benploni.com/aboutyou. Run it in your normal browser, then run it in incognito, and compare. The results should be educational.

The Real Question

Incognito mode isn't broken - it does what it's designed to do. The problem is a massive gap between what it does and what people believe it does. And that gap has real consequences when people use incognito as their primary "privacy tool" and assume they're protected.

The browser vendors could do more to close this gap. More prominent warnings. Automatic WebRTC blocking. Built-in fingerprint resistance. Some of this is happening (Firefox's resistFingerprinting flag, Brave's randomized fingerprints), but it's opt-in and most users will never find it.

Until that changes, incognito mode's main practical use remains what it's always been: keeping your local browsing history clean. For everything else, you need different tools.