Everyday Privacy
What Incognito Mode Actually Does (and Doesn't)
The short version
Incognito mode stops your own browser from saving that session: history, cookies, site data, and form entries are discarded when you close the window. That is the entire feature. It does not hide you from the websites you visit, your internet provider, your employer's network, or anyone who already holds a file on you. It has no effect at all on data brokers, because their profiles come from public records rather than your browsing. Useful for shared computers. Useless as a privacy strategy.
What incognito mode actually does
Private browsing is local forgetfulness. When you close the window, your browser throws away the history, cookies, site data, and form entries from that session, so the next person to open the browser on that device sees no trace. Google's own Chrome documentation puts it plainly: after your Incognito session ends, Chrome does not retain site data or a record of the sites you visited.
A few useful details sit underneath that. Cookies still work normally during the session, which is why you can log in to things. Chrome blocks third-party cookies inside Incognito by default. Extensions are switched off in Incognito unless you go into the extensions page and allow each one individually. And anything you deliberately keep, keeps: Chrome retains bookmarks you save and files you download when you exit Incognito.
What incognito mode does not do
It does not make you anonymous. The moment you load a page in a private window, your device sends the same identifying information it always sends, and the site on the other end records it the same way it always does. Nothing about the request is hidden, encrypted differently, or routed anywhere unusual. Only the local record changes.
- It does not hide your IP address from the sites you visit.
- It does not hide which sites you visit from your internet provider or your employer's network.
- It does not stop browser fingerprinting, which identifies you from your device configuration rather than a cookie.
- It does not log you out of your identity: sign in to anything and that account now knows what you did.
- It does not block malware, phishing, or account takeover.
- It does not remove anything that already exists about you online.
Most people get this wrong, and there is research to prove it
This is not a niche misunderstanding. Researchers at Carnegie Mellon University surveyed 305 Mechanical Turk workers and 227 participants in a long-running browsing study, then asked them to sort true and false statements about private browsing. Even among people who used private browsing regularly, roughly half believed things that are simply not true.
| False statement about private browsing | Correct answers, survey 1 | Correct answers, survey 2 |
|---|---|---|
| "It lets me browse the web anonymously" | 51% | 52% |
| "Websites cannot get my IP address or details about my browser" | 61% | 58% |
| "My internet provider cannot see which websites I visited" | 66% | 69% |
| "What I send to websites gets encrypted" | 55% | 50% |
| "My browser sends no cookies to websites" | 24% | 26% |
Habib et al., "Away From Prying Eyes: Analyzing Usage and Understanding of Private Browsing," Carnegie Mellon University, USENIX SOUPS 2018. Figures show the share of private-browsing users who correctly identified each statement as false, across the study's two survey populations.
Read the bottom row again. Around three in four regular users thought a private window sends no cookies at all. The same study found that 12 percent of one group expected private browsing to protect them from malware and hacking, which the researchers flagged as a serious misconception.
Who can still see what you do
Four groups keep full visibility during a private session, and none of them are affected by which window you opened. Understanding who they are is the difference between using incognito sensibly and relying on it for something it was never built to do.
The websites themselves. They get your IP address, your browser and operating system version, your screen size, your language, and often enough small details to fingerprint you without any cookie at all.
Your internet provider. HTTPS encrypts what is on the page, so your provider cannot read the article you opened. But the domain name is normally still exposed through DNS lookups and the unencrypted server-name field in the connection handshake, so the list of sites remains visible.
Your employer, school, or network owner. Google's documentation says outright that organizations managing your network may be able to observe your activity in Incognito. A managed laptop may also run monitoring software that never cared which window you used.
Any account you sign in to. Log in to your email, your bank, or a social network in a private window and you have handed over your identity voluntarily. Mozilla's support pages make the same point: private browsing does not make you anonymous to websites, your internet provider, your employer, or search engines.
Incognito does nothing about data brokers
This is the gap that matters most, and almost nobody connects the two. The reason your name, age, address history, phone number, and relatives are sitting on a people-search site has nothing to do with your browsing. Brokers assemble those profiles from public records: property deeds, voter registrations, court filings, business licenses, plus data they buy from each other.
Browsing privately every day for a decade would not remove a single line from those profiles. If you want to understand how the profiles get built in the first place, we walk through it in what people-search sites are and why they have your data. The fix is a different action entirely: opting out at each broker, which is free and which our step-by-step opt-out guides cover site by site. California residents can use the state's free DROP platform to send one deletion request to every registered broker at once, explained in our California DROP guide.
Chrome, Firefox, and Safari are not identical
All three private modes share the same core behavior of discarding the session, but they differ in what they block while the session is running. None of these differences change the fundamental limits above; they only affect how much cross-site tracking gets through.
| Session discarded on close | Extra blocking in private mode | Hides you from your ISP | |
|---|---|---|---|
| Chrome Incognito | Yes | Third-party cookies blocked by default; extensions off unless allowed | No |
| Firefox Private Browsing | Yes | Tracking protection applied to private windows | No |
| Safari Private Browsing | Yes | Advanced tracking and fingerprinting protection on automatically; known tracking parameters stripped from URLs | No |
Compiled from each vendor's own documentation: Google Chrome Help, Mozilla Support, and the Apple Safari User Guide, checked August 2026.
The lawsuit that changed the wording
If you opened a fresh Incognito tab a few years ago and opened one today, the text is different, and that is not a coincidence. In January 2024, Google updated the Incognito splash screen to add a sentence it had never included before, days after agreeing to settle a class action over exactly this confusion.
The old wording said that other people using the device would not see your activity. The new wording adds that this "won't change how data is collected by websites you visit and the services they use, including Google." That last clause is the admission: Google's own services keep collecting in Incognito.
The case, Brown v. Google, was filed in 2020 and reached a proposed settlement in April 2024. Under it, Google agreed to delete or de-identify billions of event-level records of private browsing activity, to strip identifying fields such as IP addresses and detailed URLs from what remains, and to keep blocking third-party cookies in Incognito for five years. Class members received no payment.
When incognito is genuinely the right tool
None of this makes private browsing useless. It solves one problem well, and that problem is real: keeping a session off the device you are sitting at. Used for that, it is exactly the right tool and takes one keyboard shortcut.
- Borrowed or shared devices. A hotel computer, a library terminal, a family laptop. Nothing is saved for the next person.
- Signing in to a second account without logging out of the first.
- Checking how a page looks to a stranger, such as your own search results or a listing, without your logged-in history shaping it.
- Gift shopping on a household computer, so the surprise survives the next autocomplete.
- Searching something sensitive you would rather not leave in the address bar, on a device other people touch.
What actually protects your privacy
Real privacy comes from layers, and each layer solves a different problem than the one incognito solves. None of these is difficult, and none of them requires trusting a single feature to do everything. Start with the ones that reduce data already in circulation, then work on limiting what you add.
- Opt out of data brokers. This is the only step that removes information that already exists about you. Everything else is prevention.
- Use unique passwords and two-factor authentication. This neutralizes most of the damage from breaches, which incognito does nothing about.
- Use a browser or extension that blocks trackers in normal browsing, not just private windows, since that is where you spend your time.
- Cut down what you hand over. Email aliases, a secondary phone number, and fewer accounts all shrink the pool. Our guide to shrinking your digital footprint has the weekend version.
- Check what is already out there. You cannot fix exposure you have not measured.
Incognito, VPNs, and opt-outs solve different problems
These three get discussed as if they compete, but they operate at completely different points in the chain. Confusing them is how people end up paying for a VPN to fix a problem it cannot touch. Here is the plain division of labor, with no product angle attached.
Incognito controls what your device remembers. A VPN hides your IP address and destinations from your internet provider by routing traffic elsewhere, which means the VPN company sees them instead, and it does nothing once you log in to an account. Broker opt-outs are the only one of the three that removes data already published about you. If your worry is a stranger finding your home address, only the third one helps.
Find out what is actually public about you
A private window will not tell you. Run a free exposure scan to see which data brokers likely list you, plus any breaches tied to your email. No account, nothing stored.
Frequently asked questions
Does incognito mode hide my browsing from my internet provider?
No. Mozilla's own support documentation states that private browsing does not make you anonymous to websites, your internet provider, your employer, or search engines. HTTPS encrypts the contents of a page, but the domain you connect to is still usually visible to your provider through DNS lookups and the unencrypted server name field in the connection handshake.
Can my employer or school see what I do in incognito mode?
Usually yes. Google's own Chrome documentation says that organizations that manage your network, like your school, employer, or internet service provider, may be able to observe your activity in Incognito. Managed laptops can also carry monitoring software that sees browsing regardless of which window you use.
Does incognito mode hide my IP address?
No. Every site you load in a private window still receives your IP address, along with details about your browser, operating system, screen size, and fonts. Private browsing changes what your own device stores after the session, not what your device sends during it.
Does incognito mode stop websites from tracking me?
Only partially, and only within the session. Chrome blocks third-party cookies in Incognito by default and Safari applies tracking and fingerprinting protection, which cuts some cross-site tracking. But sites can still fingerprint your browser, and the moment you sign in to any account you have identified yourself.
Are downloads and bookmarks saved in incognito mode?
Yes. Chrome's documentation is explicit that it retains bookmarks you save and files you download when you exit Incognito. The files stay in your downloads folder and the bookmarks stay in your bookmark bar. Only the downloads list entry is cleared in some browsers.
Does incognito mode remove me from people-search sites?
No, and this is the biggest gap. Data brokers build profiles from public records like property deeds, voter files, and court filings, plus data they buy from each other. None of that depends on your browsing, so private browsing has no effect on it. Removal requires opting out at each broker.
Is incognito mode the same as using a VPN?
No. Incognito controls what your browser saves locally. A VPN hides your IP address and browsing destinations from your internet provider by routing traffic through another server, but the VPN provider can see that traffic instead, and sites can still identify you once you sign in.
Does incognito mode protect me from viruses or hacking?
No. Private browsing offers no protection against malware, phishing, or account compromise. In the Carnegie Mellon study, 12 percent of one participant group expected private browsing to protect them from attacks like malware and being hacked. Use a password manager, two-factor authentication, and updates for that.
Sources: Google Chrome Help (Incognito behavior, third-party cookies, network visibility) and Chrome Enterprise Help (extensions in Incognito); Mozilla Support (private browsing and anonymity); Apple Safari User Guide (private browsing protections); Habib et al., "Away From Prying Eyes," Carnegie Mellon University, USENIX SOUPS 2018; 9to5Google, January 16, 2024 (Incognito disclaimer change); The Hacker News, April 2, 2024, reporting the proposed Brown v. Google settlement terms. More on everyday privacy.