Is Incognito Mode Actually Private? What It Hides

You open an Incognito window before searching for a medical symptom, shopping for a gift someone in your household might otherwise see, or looking at job listings from your work laptop. The browser shows you a reassuring screen — a hat-and-glasses icon, a line about browsing privately — and it feels like you’ve stepped behind a curtain. So is Incognito mode actually private? It does one specific thing, and it’s genuinely useful. It’s also far narrower than the name suggests, and the browser makers themselves now say so in writing.

What Incognito actually does

Incognito mode (Chrome’s name; Firefox calls it Private Browsing, Safari calls it a Private Window — same idea) changes how your browser treats local storage on your own device.

In a normal window, your browser saves your history, keeps cookies so sites remember you, and fills in forms and passwords from what it has stored. In a private window, it does none of that for the duration of the session. When you close the last private window, the browser discards the cookies and site data from that session and doesn’t add the pages to your history. Downloads you saved and bookmarks you made stay.[1]

Mozilla puts the scope plainly on its own site: private browsing “keeps your browsing history private. That’s it.”[4]

That “that’s it” is the whole point. Incognito protects you from one specific person: someone else who picks up your device later. A partner, a family member, a flatmate, the next person at a shared library terminal. For that threat — and it’s a real, common one — it works exactly as intended.

Who can still see everything

Everyone who isn’t sitting at your computer.

Your internet provider, your employer, your school. Incognito doesn’t encrypt anything or change how your traffic is routed. The network you’re on still sees which sites you visit. Google’s support page says it directly: “Organizations that manage your network, like your school, employer, or internet service provider, may be able to observe your activity in Incognito.”[1] Mozilla is blunter still — private browsing “does not make you anonymous to websites, your internet provider, your employer, or search engines”[5] — and its plain-language version puts it as: it “won’t keep your internet service provider (ISP) from seeing where you’ve been online.”[4] Opening job listings in a private window on your work laptop hides them from the next person to use that laptop — not from the company that runs the network.

The websites you visit. A private window still sends your real IP address, which is enough for a coarse location and often an ISP name. It still runs the site’s JavaScript, which can read your browser fingerprint — screen size, fonts, graphics hardware, and dozens of other attributes that together often single out your specific device, with no cookie required. And the moment you log in to anything — email, a shopping account, a social network — that site knows exactly who you are. Incognito starts you logged out; it doesn’t keep you anonymous once you sign in.

The search engine, and Google specifically. This is the part that ended up in court.

Chrome now says this on the screen itself

Until 2024, Chrome’s Incognito splash screen read: “Now you can browse privately, and other people who use this device won’t see your activity.”

A US class action, Chasom Brown v. Google, filed in the Northern District of California in 2020, argued that this wording misled people — that Google continued to collect data from Incognito sessions through Analytics, Ad Manager, and site plugins regardless. Google settled in 2024. Under the settlement, filed before Judge Yvonne Gonzalez Rogers, Google agreed to delete the historical Incognito browsing data it had collected, to block third-party cookies by default within Incognito for five years, and to change the disclaimer to say plainly that it can still track. Plaintiffs had sought $5 billion in damages; Google paid nothing.[3]

The screen you see in Chrome today reflects that. It now adds: “This won’t change how data is collected by websites you visit and the services they use, including Google.” That sentence shipped in Chrome 122, in early 2024.[2] The litigation has continued to generate appeals — in April 2026 the Ninth Circuit affirmed the denial of a bid by a separate group of 185 Chrome users to intervene and preserve class-wide damages claims[8] — but the settlement stands and none of it changes what the mode does. The product now describes its own limits.

The IP-address gap, and the fix that didn’t ship

The single biggest thing Incognito doesn’t do is hide your IP address from the sites and trackers you load. Google actually built a feature to narrow that gap — IP Protection, an Incognito-only system that would route certain third-party requests through two chained proxies (one run by Google, one by an outside CDN) so no single party saw both your address and your destination.[6]

It was always limited by design: it only covered third-party requests, only for domains on a curated list, and only inside Incognito. And in October 2025, Google retired it — along with most of the rest of the Privacy Sandbox project — citing “low levels of adoption.”[7] The one mainstream attempt to fix Incognito’s IP gap from inside the browser never became a default. The gap is still there.

Incognito is not a private browser, and not a VPN

Think of tracking as happening in layers. Incognito touches none of them except the local one.

The device layer — what’s stored on your computer. This is Incognito’s layer, and it does the job. If that’s your actual concern (a shared computer, a borrowed phone), it’s enough on its own.

The network layer — what your ISP, your employer’s network, or the Wi-Fi operator can see. Incognito does nothing here. Closing this gap takes a VPN, which encrypts your traffic to a server elsewhere so the local network sees only an encrypted connection, not the sites. Firefox’s own documentation names a VPN as the tool for exactly this — “VPN services route traffic through remote servers, so it looks like you’re browsing from another location”[4] — right after listing what private browsing can’t do. Our Best VPN for Privacy picks are the audited, no-logs options.

The application layer — what the site’s own code learns about your browser and device. Incognito does nothing here either. Your fingerprint is the same in a private window as a normal one. Reducing it takes a browser built to resist fingerprinting — that’s the entire private browsers category, and Does a VPN Hide Your Browser Fingerprint? walks through why this layer is separate from the other two.

Summary

Incognito mode does exactly what its more careful description says: it doesn’t save your history, cookies, or form entries on the device after you close the window. That protects you from other people who use the same computer, and it’s a legitimate use.

It does not hide your browsing from your internet provider, your employer, the websites you visit, or the search engine — Chrome’s own splash screen now says as much, after a lawsuit made Google spell it out. If you need the network layer covered, that’s a VPN. If you need the sites themselves to learn less about your device, that’s a privacy-focused browser. Incognito is neither, and it was never meant to be both.