How Private Browsing Actually Works Under the Hood
A 2018 University of Chicago survey of 460 internet users found deep confusion about what incognito mode actually blocks, and honestly, that confusion hasn't closed much since. The mode deletes cookies and history from local disk the moment the window closes. So why does your ISP still see every domain you visit, and why does every site still log your IP address?
- Session cookies get wiped the moment a private window closes, resetting login states and site personalization.
- Local browsing history and autofill entries never get written to the device's history database.
- Downloaded files land on the hard drive permanently. They stick around long after the private session ends, and plenty of people forget this until a file turns up where it shouldn't.
- Bookmarks saved during a private session persist permanently, which contradicts what most people assume about the mode.
- Third-party cookie blocking, when you toggle it on in browsers covered by McAfee's guidance, stops some cross-site ad tracking during that session.
The mechanism here is a local privacy switch, not a network privacy switch. The browser is the only party that agrees to forget anything. The router still sees the request. The ISP still sees it. The website's server sees it too, in full. That's the core misunderstanding baked into the feature's name: incognito mode was never built to hide traffic from anyone outside the device itself.
Why This Gap Persists: the 2018 Study and What It Still Tells Us
The confusion above isn't anecdotal. It's measurable, and it traces back to that same University of Chicago survey, still the most-cited reference point in this space. The study hasn't lost relevance because the architecture behind incognito mode hasn't changed. It's still a local-only feature bolted onto a network protocol that was never designed for anonymity in the first place.
- 460 respondents in the University of Chicago survey showed measurable gaps in understanding what incognito mode actually protects against.
- Your ISP has full visibility into every domain a device contacts, Incognito or not.
- Websites still see a device's IP address and the physical location derived from it during a private session.
- Malware and virus exposure doesn't change in private mode. It's a browsing history feature, not a security sandbox, and treating it like one is a mistake.
- Amazon-style account personalization disappears in private mode only because you're logged out, not because the tracking stopped.
Private browsing usage keeps climbing as people react to data breach headlines and ad-tracking controversies, yet the feature set behind the incognito icon has barely moved since Chrome first introduced it. The practical takeaway for a developer or anyone paying attention: treat Incognito as a shared-device tool. Good for hiding a search from a roommate, or clearing a login before testing a site as a new visitor. Pair it with a VPN or Tor when the actual goal is hiding traffic from an ISP or a website's server logs. The question this post opened with, why your ISP and every site you visit can still see you, has a clear answer: incognito mode erases local traces, not network ones. Anyone reaching for it expecting IP-level anonymity is using the wrong tool for the job, and no browser vendor's documentation says otherwise once you read past the marketing copy.