Technical Error Correction Collective

Claim: Incognito Mode Keeps You Private

, by:

Over the years there has been a lot of misinformation and misunderstanding around private browsing, culminating in a recent $5 billion class action lawsuit being filed this last month alleging Google has lied about the use cases of the technology. A federal judge recently decided that the case had enough merit to move forward.

What the case alleges however, is not what the feature was ever designed for, nor what it’s clearly labeled to do.

Private browsing, also known as “incognito mode”, is a broadly used feature of all major web browsers. Now ubiquitous, it was first released in 2005 as part of Apple’s Safari web browser and within three years it was implemented by other browser vendors (Mozilla even has a version of Firefox that is only privacy mode called Firefox Focus).

It was originally designed to prevent users of shared computers from accidentally leaving data laying around about their browsing session that the next user could access. Yes, this has had one very obvious adult-themed use case (which was pointed out even then), but it is also extremely useful for public computers at places such as internet cafes and libraries, which was important back before most of us managed to get broadband or mobile Internet access.

All implementations boil down to giving you a browser session that is cleared of any and all data that browsers keep locally (which can be used to track and share information on various sites). After the private browsing window is closed, all locally-stored data accrued in it is immediately deleted.

There are many technologies a website can use to keep such local data with your browser and access it next time you visit: perhaps most familiar are cookies, but many others exist.

These technologies are used by websites to enable a number of features that everyone just expects to work. Most are quite useful, necessary even, such as saving your shopping cart before checking out on an online store.

Others are sadly more nefarious, such as Facebook using it to track which sites you visit so that ads can be precociously tailored to your interests, even if you may not prefer that Facebook knows what you view. There are examples of such tracking bringing people grief by continuously showing ads reminding them of past relationships or personal tragedy.

This is where private browsing comes into play. While this feature is turned on, all the tracking data your browser collects, along with your browsing history, are walled off from your regular browser profile, and are gone the moment you close the incognito window.

Basically, private browsing mode is like dressing up fancy, taking on a fake name, getting black out drunk and screaming at a bar two towns over where no one knows you. Everything you did happened, and everyone remembers it, but no-one can tell it was you. Unless of course during your rampage you tell someone your real name or where you live: then it’s a lot easier for the police to find you the next morning.

Similarily, private browsing mode also cannot protect you if you start handing out any data that can be linked back to you. For example, the moment you log into your Facebook account while using that feature, you’ve just told the company who you are, and all the tracking data you’ve accrued in that incognito session is now linked to your real Facebook account.

That is to say: this browser mode isn’t a silver bullet; for instance, it does not (as the lawsuit attests Google lied about) prevent your IP address from being geo-located to your neighborhood in New Jersey, and it doesn’t protect against even more sophisticated tracking schemes used by cybercriminals, governments, and Big Tech.

Google lays this out quite clearly in their own explanation, as does Firefox, and Apple’s Safari. In all three instances using privacy mode/incognito seeks to replicate a freshly installed browser, nothing more nothing less.

You could combine incognito/private browsing mode (which handles the browser tracking data) with a VPN (which hides your real IP address from websites you browse) for some additional protection. Or use the Tor Browser if you really want to stay private on the Web.

However, even Tor network won’t help you if you give away your real name (or log-in to your real Facebook account), and for the vast majority of people incognito mode is quite enough.