You open a private browsing window.
No history.
No saved cookies.
No stored sessions.
It feels like you’ve disappeared.
You haven’t.
That little icon, usually a spy figure or a mask, carries an enormous amount of implied promise. But what does it actually protect you from? And what does it leave completely exposed?
This article is the second in our series on privacy online. In the first article, we mapped the data trail created behind every click: your device, your local network, your ISP, DNS infrastructure, destination servers, and third-party trackers. Each layer sees something. No single layer sees everything.
Incognito mode operates at just one of those layers. Understanding which layers it impacts, and which layers it doesn’t, is the key to using it correctly.
What incognito mode actually does
When you open a private browsing window, your browser makes a specific and limited set of changes to how it behaves locally.
It does not save your browsing history.
Pages you visit in a private session are not written to the browser’s history log. Close the window, and those URLs are gone from the local record.
It does not save cookies between sessions.
Websites use cookies to identify returning visitors and maintain login sessions. Incognito mode discards these cookies when the session ends. A website that recognized you last week will not automatically recognize you this week if you visit in a private window.
It does not save form data or passwords.
Anything you type into forms: search queries, usernames, addresses , is not stored for autofill.
It does not write to the browser cache.
Normally, browsers save copies of images and page elements to speed up future visits. Your browser caches nothing to disk in a private session.
That is the complete list of what incognito mode does. Notice what it is: a set of decisions on how to store browsing data locally.
Incognito mode controls what your browser writes to your own device.
That is its scope. That is its boundary.
What Incognito mode does not do
The gap between the expectation that you have virtually disappeared and reality is significant.
Your IP address is still visible
Every request you make on the internet carries your IP address. This is a technical requirement: without it, responses could not find their way back to you. Incognito mode does not change or hide your IP address.
Every website you visit in a private window sees your IP address. Every server you connect to logs it. This has not changed.
Your ISP can still see which websites you access
As we described in the first article in this series, your Internet Service Provider routes all data that you send to or receive from websites. It sees the destination IP addresses of your connections. It sees when you connect, for how long, and how much data is transferred.
Incognito mode happens inside your browser. What your ISP handles is independent of your browser . Your ISP does not know, and does not care, whether you have opened a private window or not.
Your employer or school network still sees your traffic
If you are browsing on a managed network, a workplace, a school, a university the network operator may be monitoring traffic passing through it. This monitoring occurs at the network level, below the browser. Incognito mode does not change what the network can observe.
DNS queries are still generated
When you type a domain name into your browser, your browser sends a DNS request to resolve that name to an IP address. This request typically goes to your ISP’s DNS resolver, or whatever DNS server your network is configured to use.
That DNS request contains the domain name you are looking up. It is often unencrypted and logged by the resolver handling it.
Incognito mode does not change how DNS works. Using incognito mode will not hide the website you are visiting from your ISP.
Websites still fingerprint your browser
Modern websites collect far more than just your IP address. They observe a combination of signals that together create a unique profile of your browser and device:
- Your browser type and version
- Your operating system
- Your screen resolution and color depth
- The fonts installed on your system
- Your timezone
- Your language settings
- Whether certain browser features are enabled
This technique is called browser fingerprinting. Because these characteristics are collected from properties of your browser, not from cookies or history, they are not affected by incognito mode at all. A tracking system using fingerprinting can often identify you across sessions, whether you are browsing incognito or not.
Third-party trackers still operate
Many websites load scripts and resources from third-party services: analytics platforms, advertising networks, embedded widgets. Each of those external services receives a request from your browser, including your IP address and browser details, when a page loads.
Incognito mode does not block these third-party connections. They occur the same way in a private window as in a regular one.
Malicious actors can still access see your data
If another, possibly malicious individual has physical access to your device, or if malware or a keylogger infects your device, incognito mode offers no protection. The browser’s incognito mode affects only how the browser stores records. It cannot protect against anything that extracts data while the browser is running, especially if those mechanisms function at a deeper level of the operating system.
What Incognito mode is actually good for
Used correctly, private browsing is a genuinely useful tool. Its value lies in exactly what it does: controlling local storage.
Shared devices
If you are using a computer that other people also use, like a family computer or a library terminal, incognito mode ensures that your browsing session does not leave a local trace for the next person who uses the machine.
Logging into multiple accounts simultaneously
Because each private window starts with a clean cookie state, you can use a private window to log into a second account while your regular window maintains a different session. This is common for developers or people managing multiple accounts for work. Note that some browsers provide features with which multi-account-containers can be created to achieve this.
Avoiding session-based tracking between your own sessions
If you want to ensure that a website treats you as a new visitor rather than a returning one a private window resets your cookie state for that site. For example, when you want to avoid personalized pricing.
Keeping your browsing history clean for yourself
Sometimes the reason is simple: you do not want something appearing in your own history or autocomplete. Private mode handles this reliably.
For these use cases, incognito mode works exactly as intended. The problem is not the tool. It is the mismatch between what the tool does and what people believe it does.
Thinking in layers
The central lesson from our first article applies directly here.
Your online activity generates data across multiple independent layers: your device, your local network, your ISP, DNS infrastructure, destination servers, and third-party services. Each layer sees something. Privacy protection requires thinking about which layer you want to protect.
Incognito mode addresses one layer: the local browser record on your device.
If you want to reduce what your ISP sees, you should consider to use a VPN you can trust or Tor. For limiting DNS exposure, you need encrypted DNS and a first good measure could be to switch to a privacy friendly DNS service like quad9. Or if you would like to block third-party trackers, you need a content blocker. All of these measures work at different layers. They require different tools.
Measures which apply to one layer cannot account for threats to your privacy on another layer . Meaningful privacy online is built by understanding which threat you are addressing, and choosing the tool designed for the corresponding layer.
The Gap between the icon and the reality
Browser vendors have been increasingly transparent about the false expectation raised by the incognito mode in recent years. Many browsers now display a notice when you open a private window explaining exactly what the mode does and does not do.
But perception has been slower to catch up with the fine print.
Key takeaway
Incognito mode only prevents your browser from storing a local record of your session. It is useful for exactly and only that.
- It does not hide your IP address.
- It does not prevent your ISP from seeing which websites you access.
- It does not stop websites from logging your visits.
- And it does not block more advanced tracking methods like third-party scripts or browser fingerprinting.
Understanding this isn’t about distrusting the tool.
It’s about using it for what it is. and recognizing when a different level of protection is actually needed.
