What Incognito and Private mode actually do
Both modes do one thing reliably: they keep a session out of the browser’s own record on that device. Google is explicit about the mechanics — Chrome starts a separate session, temporarily holds cookies and site data only to keep pages working, and deletes that information once you close every Incognito window. Bookmarks and downloads survive; browsing and search history don’t. Apple’s version is similar: Safari’s Private Browsing doesn’t save pages visited or AutoFill details, and on iOS 17, iPadOS 17, macOS 14, or later, private tabs lock behind your passcode, password, Face ID, or Touch ID after inactivity.
That’s genuinely useful for one problem: someone else opening the same browser later and scrolling through history. It was never built to solve most of the others people assume it solves.
Everything it doesn’t hide
Here’s the honest version, because both companies now say this outright rather than leaving it implied.
- Your internet provider, school, or employer. Google states plainly that Incognito “doesn’t make you invisible” — organizations that manage your network, including your school, your employer, and your internet service provider, “may be able to observe your activity in Incognito” (Google Chrome Help). Private mode changes nothing about what leaves your device on the way to a website.
- The websites themselves. A site you visit while private still sees the visit. Google notes that “sites may still be able to gather information about you even when you’re not signed in,” and that sites using Google’s services share activity data with Google, including for advertising, just as they would outside private mode (Google Chrome Help).
- Google or Apple’s own account-level data. Private mode is a browser setting, not an account setting. Signing into a Google Account or a website inside a private window doesn’t retroactively make that activity private to Google or to the site.
- Anything after the fact, on the network. Your ISP’s equipment sits between your device and the internet no matter what mode your browser is in. The FTC’s 2021 staff report on internet service providers found many of the ISPs it studied can see 100% of customers’ unencrypted traffic, and even over encrypted connections, many still store the IP addresses customers access and thereby collect the domain names of sites visited — none of which private browsing changes. The report also notes encrypted DNS (DoH) limits this visibility, though its real-world impact depends on the browser and provider both using it.
- Anyone with router or account access. What a router logs depends on its features and configuration, but a private window doesn’t touch those logs, home Wi-Fi admin panels, or network-level monitoring. See what the Wi-Fi owner can see for what that access actually reveals.
Why Google had to rewrite the wording
This isn’t a new discovery — it’s a fight that already happened in court. A 2020 class-action lawsuit accused Google of misleading users into thinking Incognito meant Google itself wouldn’t track them. Google settled in 2024, agreeing to delete billions of browsing records and rewrite the language shown every time someone opens an Incognito window (Reuters via The Guardian). Google’s Chrome Help page now states plainly that Incognito “won’t change how data is collected by the websites you visit and the services they use, including Google” — spelling out, rather than implying, that Google’s own data collection continues. Nothing about the underlying technology changed — only the honesty of what Google tells you about it.
The one it doesn’t hide from at all: someone already watching your device
This is the part that matters most if you share a device, a network, or your accounts with someone you don’t fully trust. Private browsing was designed to hide activity from the next person who opens the same browser — not from someone who has installed monitoring software, has your passwords, or manages your family’s network.
If stalkerware is on a phone, it typically works below the browser entirely — capturing screens, logging what’s typed, or mirroring activity elsewhere — so a private tab shows up on its feed like any other page. The FTC’s own guidance on stalkerware lists “see what you’re doing online” among the capabilities these apps give an abuser, with no carve-out for private or Incognito windows. NNEDV’s Safety Net Project is direct about the limit: if spyware is on a device, “all activity including online chat, emails, and web searches, can be revealed to the abuser,” and the advice is to use a safer device — “one the person has not had physical or remote access to” — for anything sensitive.
The same logic applies to accounts. Signing into a shared Google Account, family Apple Account, or synced browser profile inside a private window doesn’t create separation — whoever else has access can still see what was searched or purchased, regardless of browser mode.
What actually helps for something sensitive
If you need to look something up and you’re worried about who might see it — a shelter’s phone number, a lawyer, a way out — private browsing on a device someone else controls isn’t the safeguard to reach for. Before doing anything else, read Safety first: before you remove anything; changing settings or clearing history on a monitored device can itself tip someone off.
What’s actually protective in that moment:
- A device the other person has never had access to. A friend’s phone, a library computer, or a device on a plan they don’t control removes the monitoring problem instead of trying to out-hide it. But treat a shared or public computer with its own caution: it can be administered or monitored by whoever runs it, and it may keep its own record of what you download. Use it to read, not to sign into anything sensitive, and close everything out when done.
- A different network for anything sensitive. Switching a shared home Wi-Fi connection to mobile data changes who can see the connection at all — see what the Wi-Fi owner can see for what a router administrator can and can’t observe.
- Signed-out, separate accounts. Search or browse from an account the other person has never seen, not a shared or synced one.
Private browsing is still worth using by default — a reasonable habit for shared family devices, public computers, or just not leaving a shopping search in your history. It just isn’t the tool for hiding something from a person who’s already inside your phone, your accounts, or your network. That distinction is the whole point.