How websites can still easily track you in incognito mode

We have some bad news...

Try 6 issues for £9.99 when you subscribe to BBC Science Focus Magazine!
Published: April 14, 2023 at 9:58 am

So, how incognito is incognito mode on your internet browser, really?

Not very.

When you turn on private mode or launch an incognito browser window, it’s a little like starting from scratch on a new computer. There will be no cookies to help your browser, so you will have to login to any website that needs your details all over again. When you’re done, the browser will delete all the new cookies and temporary cache files and will keep no history of your activity. As far as your computer is concerned, there is no record of your browsing, apart from any files you downloaded, or bookmarks saved.

But that’s not the whole story. For your computer to connect to the internet, it must go through your router. The router can monitor all web addresses that you visit. It’s very simple to go into the admin settings and tell the router to log Internet activity. (You can set the router to block users from visiting web addresses too – a handy tool for parents.) This will happen regardless of whether the user turns on private mode of the browser.

Even while you are browsing using incognito, you leave digital footprints all over the Web. Cookies may be deleted after you’re done, but while you’re browsing, the websites are happily storing information about your activities. If you log into any site while in private mode, you’ve given the game away instantly. You are identified by the site and all your activities will be tracked as normal. Your searches will be recorded, your browsing activities on any social media sites, and your purchases will all be stored. Through temporary cookies, your activities can be linked across multiple accounts and profiles, gathering ever more data about you.

So you decide to go incognito and not log into any site. You are still tracked through your computer’s IP address, which can locate you to your approximate region. It’s a method used in sales to figure out whether an anonymous potential purchaser has been clicking around. The IP address is tracked and emails are sent to the owner of the address with tempting offers to try and convert the interest into a sale. Combine the IP address with device type and browser details and it is possible to 'fingerprint' you – figure out who you are regardless of whether you give your name. Some browsers are trying to block this, but clever websites keep finding new ways to track you.

The best way to be really secure is to abandon standard software altogether. You’ll need to use a VPN (Virtual Private Network) which encrypts your internet connection and hides your IP address without logging your usage – you can ask it to pretend you are connecting from almost anywhere in the world. You’ll need to use a specialised search engine with tracking protection, such as DuckDuckGo, StartPage, SearchEncrypt or Qwant. You’ll need a specialised private browser, which bounces your searches via multiple servers around the world to hide your origin. And for the ultimate secret browsing, you might boot your computer from a special operating system designed with privacy in mind.

Just be aware that not every country’s government permits such tools, and some may require that logs are kept so that you could still be tracked…

Read more: