Private browsing may not protect you as much as you think

What does private browser mode do?

According to experts, private browsing modes are best suited to protecting your web activity from other people using the same device, but they do nothing but offer this local shield.

“It can be useful, for example, to transgender and gay children who are concerned about keeping track of their parents and for people who might be in a situation where they cannot securely separate their computers from other people who have access to their browser history,” says Fox-Kahn.

Private mode can also help reduce tracking across websites. On Chrome, for example, users are told: “You see websites as a new user and you won’t know who you are, as long as you’re not signed in.”

“People choose to browse the web privately for many reasons,” said Parisa Tabriz, Vice President of Chrome Browser. “Some people want to protect their privacy on shared or borrowed devices, or exclude certain activities from their browsing history. Incognito mode helps with these use cases.”

Usually when someone is browsing online, companies will use tracking devices known as cookies to keep up with digital activity from one site to another for better targeted advertising. Depending on the browser and user options, private browsing mode can reduce information sharing across sites. But with some browsers, users should know how to select these additional options, other than just choosing the private mode.

Safari, for example, has a default Smart Tracking Prevention feature, which limits cross-site tracking while enabling sites to continue to function normally. Options “Prevent cross-site tracking” and “Block all cookies” Additional steps to protect users, but these features are separate from the private mode. In the meantime, Chrome advises users that they should choose to block third-party cookies, even in incognito mode. Firefox added new default features last year, including “full cookie protection”, to prevent users from being tracked online, as well as “smart blocking” to allow third-party logins via sites like Facebook or Twitter while still working to prevent tracking .

Private modes are also limited in their effectiveness when it comes to IP addresses, which are associated with the device and can be used to determine the user’s geolocation.

“Whether you are in privacy mode or not, the recipient should always know your IP address because when your browser sends a request for data, the server receiving the request needs to know where to send that data back,” said Andrew Rivers, assistant professor in the College of Information The University of Washington ISP can also log a user’s online activity regardless of the browser’s privacy setting.

Some browsers offer additional protection to handle this. Safari has a “Hide IP Address” setting separately from Private Browsing mode which, when enabled, sends the user’s browser information to two different entities, one that gets the IP address but not the website being visited and the other that gets the website but not the IP address . This way, neither of them owns all the user’s private information. Other browsers also have options to mask IP addresses, such as VPN extensions or “disable Geo IP capabilities” that prevent browsers from sharing a user’s location with websites.

What private browser modes do not protect?

Online browsing is stored in two places: on your local computer and on visited sites. When a user goes private to Facebook, for example, there will be no history of that visit stored on their device, but there will be a history of that visit stored in their Facebook account logs and by Facebook ad analytics.

Users leave records online, with or without private browsing options enabled, creating a lot of uncertainty about how this data is used as evidence by law enforcement in countries that criminalize abortions. Tech companies haven’t said much about how they will handle such requests. Groups that promote digital rights and reproductive freedoms are warning people in these states to protect their digital footprint when searching for information and resources about abortion online, and sharing tips on how to do so.

Moreover, if someone is working on a laptop owned by a company or a school, then the private browsing mode won’t do much at all. “If you have a computer that is managed by someone else, having privacy against that person is not really possible,” said Eric Rescorla, chief technology officer at Mozilla. “If your business owner owns your computer, they can put any kind of monitoring software on your computer they want, and they can measure anything you do. So, no, it doesn’t protect you from that, but almost nothing will.”

Google Chrome also warns users that incognito mode cannot provide complete protection in these cases. “When you are in incognito mode, your activity may still be visible to the websites you visit, your employer or school, or your ISP. We make this clear when you open incognito,” Tabriz said.

Users should also keep in mind that the protection offered in private mode is limited to web browsing, leaving any activity on smartphone apps vulnerable. No matter how well a private browsing mode works to protect user activity, it can’t help anywhere else. “A lot of the apps we use don’t have incognito mode built in,” Reifers said. “You don’t really know what this app stores.”

What additional steps can you take to protect yourself online?

Besides enabling private browsing modes, and selecting additional privacy options companies offer in their settings, there are some additional steps users can take to try to maximize digital privacy,

A VPN, or Virtual Private Network, hides the IP address to make the user more anonymous online, effectively protecting the user’s identity and location. “A good first step would be to use private browsing mode and a VPN together,” Riscorla said.

But using a VPN could potentially allow the VPN operator to access your browsing activity. Fox Cahn warns that “many of these will sell that information or certainly make it available to the police if they submit a warrant.”

Internet users can also consider turning to a browser like Tor, which is a secure and anonymous option that uses multiple intermediate servers to block any one server from full tracking activity, according to privacy experts.

Above all, experts emphasize that Internet users should be aware that online activity is essentially not private, regardless of browser setting. And while clearing your browsing history and emptying your cookie cache makes data recovery more difficult for third parties, it still isn’t impossible with some forensic tools and safeguards.

Fox Cahn stresses that data privacy seekers like abortion seekers should take as many steps as possible, even buying a new untraceable device or using services like Tor. “It’s stressful, but it offers a lot of protection,” he said. “You have to keep in mind that all of these things you can do is reduce the amount of risk. And none of them are absolutely perfect.”