Private Browsing Mode: What Incognito Actually Does (and Doesn’t Do)

The name “Incognito” has done enormous damage to people’s mental model of browser privacy. Google’s choice of branding implies something closer to invisibility than the limited local-state-clearing that the feature actually provides. A 2020 lawsuit against Google alleged that the company continued tracking users in Incognito mode; Google settled for $5 billion in 2024, agreeing to additional disclosures about what the mode does not protect. The feature works as documented. The documentation just wasn’t in front of most people when they needed it.

What Private Browsing Actually Does

When you open a Private Browsing window (or Incognito window in Chrome), the browser creates an isolated temporary profile. When you close the window:

• Browsing history is not saved to your history.
• Cookies and session data are deleted. Sites you logged into in the private window are logged out.
• Form data and searches are not saved to autocomplete.
• Temporary files and cache downloaded during the session are deleted.

That’s the complete list. These are local-state changes. The private window does nothing about network-level activity.

What happens to that cleared state matters too: other open windows and your normal browsing profile cannot see into the private window’s state while it’s open. It’s genuinely isolated from your main profile — private window cookies are separate from your regular cookies even while the window is open. Closing the window clears all of it.

What Private Browsing Does Not Do

Your IP address is visible. Every connection from the private window goes through your regular internet connection with your real IP. The sites you visit, the CDN servers you load resources from, and the ads that appear all see your IP address. Your ISP sees every connection.

DNS queries are not private. Unless you’ve configured DoH at the system or browser level, your DNS queries — which translate domain names to IP addresses — go to your ISP’s resolver and are visible to anyone on your network path.

Your employer, school, or network administrator can see your traffic. Corporate and school networks often run packet inspection or logging at the gateway. Private browsing doesn’t encrypt traffic beyond what HTTPS provides, and HTTPS doesn’t hide which sites you’re visiting (only the content of the connection).

Browser fingerprinting still works. Canvas fingerprinting, WebGL fingerprinting, font enumeration, and screen resolution are not changed by private mode. A determined tracker using fingerprinting techniques gets the same values as from a normal browser window. EFF’s Cover Your Tracks tool demonstrates this — run it in private mode and in normal mode, compare the results.

Extensions still run. In Chrome Incognito, extensions are disabled by default, but users can enable them per-extension in the extension settings. In Firefox Private Browsing, extensions that are marked “Allowed in Private Windows” run normally.

You’re still logged in to sites. If you open an Incognito window and type facebook.com, Facebook doesn’t know who you are — until you log in. Once you authenticate, the session is identical to a normal window from the site’s perspective. Many users misunderstand this: logging in to Google in Incognito means Google gets the browsing history from that session, associated with your account.

Google still tracked Incognito users. The 2024 settlement outcome is illustrative: Google used third-party tracking components (Google Analytics, Google Ad Manager, and other scripts) embedded on third-party sites that sent data back to Google even when the browser was in Incognito mode. The browser itself cleared local data, but the data that left the machine was still collected server-side.

Browser-Specific Differences

Chrome Incognito: Extensions disabled by default. Google’s stated policy post-settlement is to disclose more clearly what Incognito does not cover. No changes to fingerprint or IP.

Firefox Private Browsing: Enhanced Tracking Protection is active in private windows even if your normal mode is Standard — the private window defaults to Strict ETP. This blocks more trackers than Chrome Incognito. Extensions marked “Allowed in Private Windows” run.

Safari Private Browsing: Blocks known trackers, cross-site tracking prevention via Intelligent Tracking Prevention (ITP) is active. Additionally, in Safari 17+, tabs in private mode are isolated from each other by default — separate private tabs don’t share cookies with each other. This is stronger isolation than the other browsers’ private mode defaults.

Brave Private Windows: Brave’s Shields are active. The “Private Window with Tor” option in Brave routes traffic through the Tor network — this is the only mainstream browser offering Tor routing as a private mode option.

What Private Mode Is Actually Good For

Given the limitations, private browsing is useful for a specific set of purposes:

Shared computers. Logging into a bank or email on a library or airport computer in private mode means your credentials and session don’t persist after you close the window. This is the clearest use case.

Avoiding cookies from one-off site visits. If you want to visit a site without that site being able to track your return visits via cookie, private mode works — the cookie is deleted when you close the window.

Testing sites without your logged-in state. Web developers use private mode constantly to test how a site behaves for logged-out users, to test different user roles, or to see the non-personalized version of a page.

Keeping sessions separate from your main profile. If you need to log into a service as a different account temporarily without logging out of your main account, private mode gives you an isolated cookie jar for the duration.

Searching without your history influencing results. Search results in Chrome are personalized based on your history. A private window starts with no history, so results are less filtered.

What You Actually Need for Stronger Privacy

If private browsing’s limitations matter for your use case, the tools that address them:

VPN. Hides your IP from visited sites, hides your traffic from your ISP. Does not protect against fingerprinting or logged-in tracking. The VPN provider sees your traffic.

Tor Browser. Routes traffic through multiple relays, uses standardized fingerprint values, and provides strong anonymity against both the sites you visit and network observers. Not fast, not convenient for everyday use. The Tor Project maintains it. See our Tor Browser guide for details on what it does and doesn’t protect.

Firefox with Strict ETP + uBlock Origin + containers. For everyday privacy against tracking, this combination is substantially better than private mode while being usable for normal browsing.

DoH. Encrypts DNS queries. Should be configured in your browser settings regardless of private mode use.

FAQ

Does Incognito hide my activity from Google? From Google as a first-party in the Chrome browser: somewhat, if you’re not logged in. From Google as a third-party analytics and ad provider on other websites: no. Their scripts run on those sites and send data to Google’s servers regardless of your browser’s private mode.

Can my employer see what I do in Incognito on my work computer? Yes. If your employer runs monitoring software or network-level traffic logging, Incognito doesn’t bypass it. The browser clears local state; it doesn’t prevent data from leaving your computer.

Does private mode protect against malware? No. Malware running on your computer can read your browser state, intercept network traffic, and log keystrokes regardless of private mode. These are OS-level concerns that a browser mode cannot address.

Is “Private Browsing” the same across all browsers? The local-state-clearing behavior is similar. The tracking protection during the session varies: Firefox’s default Strict ETP in private windows, Safari’s cross-tab isolation in private mode, and Brave’s Tor routing option differentiate themselves from Chrome’s baseline Incognito. The fundamental limitation — your IP is visible, fingerprinting works — is universal.