Incognito Isn't Private. It Just Forgets.

The padlock means the connection is encrypted, so nobody in the middle can read the page, your searches or what you type. It does not hide where you are going. To reach a site your device first looks up its address, then connects to that address, and in most connections it announces the site's name in plain text before encryption starts. That field is called the Server Name Indication.

So whoever runs the pipe, whether that is Comcast, AT&T, Verizon, the hotel Wi-Fi or your employer, can see which sites you visit, when, how often and roughly how much data moved. Incognito sits inside the browser, upstream of none of this. Newer browsers support Encrypted Client Hello, which hides the site name, but only when the site's host supports it too.

In 2017 Congress used the Congressional Review Act to repeal the FCC's broadband privacy rule before it took effect. That rule would have required providers to get opt-in consent before using or sharing sensitive data such as browsing history.

Most websites are assembled from other companies' code. Google Analytics alone runs on 46.9% of all websites, according to W3Techs, and on 82% of the sites whose analytics tool it can identify. Add Google's ad tags, the Meta pixel, embedded maps and videos, and a single article can send requests to a dozen companies before you read the first line.

Those requests carry your IP address, your browser details and the page you are on. Cookies set during the session work normally until you close the window. Chrome has blocked third-party cookies in Incognito by default since 2020, so trackers lean on what is left: the site's own cookies, your IP address and your fingerprint. Sign in to a Google account in that window and everything after it belongs to the account.

A page can read dozens of ordinary details about your browser and hardware. None of them is secret. Together they form a fingerprint that needs no cookie, so a fresh Incognito window presents the same one. A newer variant, canvas fingerprinting, has the browser quietly draw an image and hashes the result, because tiny differences in graphics hardware, drivers and font rendering change the pixels. Researchers documented it in 2012.

How unique is a fingerprint? The EFF's 2010 Panopticlick study found 83.6% of 470,161 browsers unique, and 94.2% of those running Flash or Java. A 2018 study of about 2 million fingerprints from a major French site found 33.6% unique: 35.7% of desktops and 18.5% of phones. Browsers have closed some gaps since then. The honest reading is that a fingerprint is not a serial number, but combined with your IP address it is often enough.

In 2019 Google called fingerprinting wrong. From February 16, 2025, its ad platform policies stopped prohibiting it for advertisers that use Google's ad products. The UK Information Commissioner's Office responded: “We think this change is irresponsible.”