What incognito actually hides and what it does not

Incognito creates a temporary browser session. In that session, the browser usually does not save browsing history, form data, new cookies, and site data after all private windows are closed; Chrome Help describes those limits directly.

But downloaded files and bookmarks created in a private window can remain on the device.

That is useful when:

• you search for a gift on a shared laptop;

• you open personal email on someone else's computer;

• you test a page without your normal logged-in state;

• you sign into a service briefly without mixing it with your main profile.

Incognito works at the device level. It helps reduce what remains where the browser is opened. It does not promise that the website, your provider, a workplace network, or analytics tools cannot see the visit.

If you log into Google, a marketplace, a bank, or a social network, the private window does not cancel the login. To the service, you are still the same account in a different session.

To a website, a private window is still the same browser making requests and running JavaScript. The site may see:

• your IP address, or a VPN/proxy address if you use one;

• User-Agent and browser version;

• language, timezone, screen size, and system signals;

• cookies and storage created inside the current private session;

• WebRTC and other browser networking mechanisms;

• page behavior: clicks, typing, timing, navigation;

• your account, if you sign in.

Incognito does not delete server-side logs. If the site records a login, payment, support request, or settings change, closing the private window does not erase that event.

That is the common mix-up: "it was not saved on my device" does not mean "the website did not record it."

A typical example is advertising after a search.

You search for a product on a laptop in incognito. Later, a similar ad appears in a social app on a phone connected to the same Wi-Fi.

That does not prove the phone listened to you, and it does not prove one website directly handed everything to that app. More often it is a chain of signals: a site loads an ad pixel, the pixel sends an event to an ad platform, and the platform may match that event to the public IP of the network, approximate location, accounts, click IDs, app data on the phone, or a lookalike audience. Google Ads documentation on geographic targeting explicitly includes signals such as IP, Wi-Fi, and location data.

Incognito changes almost none of that. It does not change the public IP of the home network. It does not control the phone's ad ID. It does not sign you out of apps. It does not stop a site from sending an event to an ad platform if the page includes that platform's code.

So the "searched on laptop, saw it on phone" scenario can happen even when browser history is clean. The relevant trail may be in network signals, accounts, ad scripts, and apps, not in Chrome history.

New cookies are usually removed after you close all private windows. That helps prevent your regular browser profile from continuing the same local session.

But cookies are only one way to recognize a browser. A site may connect activity through login, payment details, phone number, delivery address, email, a link from a message, or device/browser signals.

Then there is the browser fingerprint. It is not one secret ID. It is a set of signals: screen, fonts, WebGL, Canvas, language, timezone, browser settings, extensions, and other properties. Each signal is ordinary on its own. Together they may be unique enough to distinguish one browser from another; EFF Cover Your Tracks shows how rare those combinations can be.

The mechanism is explained in the article on browser digital fingerprints.

Incognito works well when the problem is on your device.

You do not want the next person to see your search history. You do not want your regular profile to remember a temporary login. You want to open a page without your normal cookies. Private browsing is a reasonable tool for that.

It also helps with troubleshooting. If a site behaves strangely in your normal profile, a private window can show whether old cookies, cache, or an extension are involved.

But it is not a system for separating work identities. If a marketer manages client dashboards or a freelancer keeps personal and work services apart, incognito quickly becomes too temporary. Each session disappears, settings do not live as a workspace, and the browser environment is still the same one.

If you open a private window, sign into a client account, then sign into your personal account on the same service, the local history may be gone after you close the window.

But the service saw the logins, IP, device, browser parameters, and actions. If two accounts were used from the same browser environment, incognito alone did not create isolation between them.

The same is true for ads. Incognito may remove old cookies from the regular profile, but if you log into an account, accept cookies, or interact with the same services, the site receives new signals.

Incognito does not create isolated environments. It is still one browser with one set of parameters.

Another case: some sites try to detect private browsing.

There is no universal isIncognito flag that works across every browser and version. Browsers close old methods, sites look for new indirect signals, and browsers adjust again. One class of signals comes from how private mode handles storage and quotas; MDN documents those browser storage differences.

But the class of problem exists. Private mode can differ from normal mode in storage behavior, storage quotas, API availability, write timing, or cookie behavior. A site may not get a perfect answer, but it can try to infer the mode.

This is usually not done for the user's privacy. It is used for paywalls, content limits, login prompts, or extra checks.

The practical takeaway is simple: incognito does not only fail to hide you from the site. In some cases, private browsing itself becomes another signal.

NOID does not promise that sites stop seeing you. Its job is more specific: separate browser identities.

NOID is a browser with identity isolation: separate profiles help keep cookies, storage, sessions, and work contexts from mixing.

One identity can be for personal email, another for a work dashboard, another for a client project. Each should have its own data and consistent browser environment. That makes cookies, sessions, and work context less likely to mix between tasks. If a separate network route is needed, it still has to be configured separately.

Incognito is not bad. It is temporary. NOID is useful when a separate context needs to live longer than one private tab.

You can inspect which signals a site may see in different identities with Check ID.

If you are doing a one-off search on a shared device, incognito is fine.

If you use a sensitive account on someone else's computer, incognito is better than a normal window, but you still need to sign out and close every private window.

If you separate personal, work, and client accounts every day, private browsing is a weak foundation. You need separate profiles, separate sessions, and a clear data discipline.

First you need to know where traces remain: on the device, on the website, in the account, in the ad system, or in the network route. Then it is easier to choose the right tool.

If this sounds like your situation, try NOID free for 7 days. No credit card is required.

Create one identity for personal browsing and one for work, then open Check ID in both and compare what sites see.

• What are browser digital fingerprints?

• Secure browser vs VPN

• Is using a VPN safe?

• Internet privacy in 2026