Browsing the Internet in anonymous mode? This is what really happens in "Incognito Mode"

For hundreds of millions of users worldwide, clicking the "New Incognito Window" button in the browser feels like an action that ensures complete privacy. However, reality paints a completely different picture: the well-known feature does not provide comprehensive protection from tracking, but rather performs a local action only, deleting browsing history and cookies from the personal device the moment the window is closed.

This means: While the incognito window is open, the entire chain of entities on the network—from the internet provider, through employers on organizational networks, to the websites themselves and the tech giant Google—can continue to record the user's activity in real time.

These revelations were at the center of a federal class action lawsuit in the United States, also known as the "Brown v. Google" case, in which the internet corporation was accused of misleading users about the level of privacy provided by the product. The legal proceedings ended in a settlement, under which Google committed to destroy billions of data records collected from incognito browsing mode, to block third-party cookies by default, and to update the wording of the disclosures presented to users.

Internal documents revealed during the trial showed that senior executives at the company were aware of the gap between public perception and the technical capabilities of the tool. Among other things, a correspondence from 2019 was uncovered in which Google’s Chief Marketing Officer approached the company’s CEO, Sundar Pichai, and warned that Incognito mode should be made “truly private,” since the use of the word “private” creates a false impression.

The company chose not to change the brand name or the icon in order not to harm advertising revenue.

The technological mechanism: digital fingerprint

The main reason that deleting cookies does not prevent tracking is the development of advanced identification technologies, primarily browser fingerprinting.

When loading a web page, the browser transmits technical data to the server, including screen resolution, graphics card model, installed fonts, time zone, and operating system version. Studies estimate that the combination of this data is unique to about 83% of devices on the network.

An even more advanced technique, called Canvas Fingerprinting, uses the device's graphics processor to draw a hidden element and generates a unique identifier for the hardware, all without relying on cookies.

When loading a web page, the browser sends technical data to the server that includes screen resolution, graphics card model, installed fonts, time zone, and operating system version. Studies estimate that this combination of data is unique to about 83% of devices on the network.

An even more advanced technique, called Canvas Fingerprinting, uses the device's graphics processor to draw a hidden element and generates a unique hardware identifier—independent of cookies.

In addition, built-in analytics tools such as Google Analytics, which operate on hundreds of thousands of leading websites, transmit immediate data to the company's servers the moment a user enters the site. This information is cross-referenced with the IP address and the device's fingerprint, allowing continued targeted tracking.

Information security experts clarify that incognito browsing is effective for only one purpose: preventing other users on the same physical device from accessing the browsing history. Against external parties, internet providers, and advertising systems, the browsing remains visible.

The core group of technology companies continues to rely on data collection as a central business model, with the basic rule on the internet remaining unchanged: in the absence of direct payment for the service, users' information and activity are the products being sold to advertisers.