Why Incognito Mode Doesn’t Hide You From Your Internet Provider (And What Does)

Open an Incognito window, visit a site you’d rather keep to yourself, close the window. Nothing is saved on your laptop. Many people assume that means nothing is saved anywhere.

It doesn’t. Incognito cleans up after you on your own device. It does not change what leaves your device, and your internet service provider (ISP) sits on the road that traffic takes.

What Incognito actually does

Private browsing modes in Chrome, Edge, Safari and Firefox do one job: they stop the browser from keeping local records. When you close the window, cookies, site data, form entries and browsing history from that session are discarded.

That protects you from the next person who picks up your laptop. It is useful for a shared computer, a gift search, or logging into two accounts on one site.

Google’s own help page is direct about the limit. Incognito doesn’t make you invisible: websites you visit, the organizations that manage your network (a school, an employer, your ISP) and Google itself, through sites that use its services, can still see your activity.

The gap between what people believe and what the feature does was serious enough to end up in court. In Brown v. Google, plaintiffs alleged Google collected private-browsing data improperly. In April 2024 Google agreed to settle: it would delete or de-identify billions of records and change its disclosures. The Incognito screen now says the mode won’t change how data is collected by the websites you visit and the services they use, including Google. Google called the lawsuit meritless and paid nothing.

What your ISP sees

Your ISP carries every packet between your device and the internet. What it can read depends on how the site is set up.

Domain names. Before a secure connection starts, your browser sends a TLS handshake. In TLS 1.3 the first message, the ClientHello, is sent unencrypted and includes the Server Name Indication field, which names the site you want to reach, as Cloudflare explains. A network observer can read example-clinic.com straight from it. A newer standard, Encrypted Client Hello (RFC 9849), encrypts the ClientHello, but it only helps where both your browser and the site support it.

DNS lookups. Unless you changed your settings, your device asks your ISP’s resolver to turn a domain into an IP address. That is a second record of where you went.

Timing and volume. Even with the content encrypted, your ISP sees when you connected, for how long, and how much data moved. A short burst at 2 a.m. and a two-hour stream look different.

Your account. This is the part Incognito can’t change at all. The ISP knows who pays for the connection. Every record above is tied to a named household.

HTTPS protects the content of a page, such as what you typed into a form. It does not hide the fact that you visited the site. That is why “I used HTTPS and Incognito” is a weaker privacy position than it sounds.

Why this matters

ISPs do more with this data than keep the network running. In 2021 the U.S. Federal Trade Commission published a staff report on six large providers. It found they collect extensive data on their customers, combine it across product lines, and in some cases group people by sensitive traits. It also found that real-time location data reached third parties, and that privacy choices were hard to use. Several providers said they don’t sell personal data while still allowing others to use and profit from it.

None of that depends on whether you opened a private window.

What actually closes the gap

The fix is to change what your ISP can see, not what your browser remembers. The standard tool is a VPN.

A VPN wraps your traffic in an encrypted tunnel to a server run by the VPN provider. Your ISP then sees one thing: an encrypted connection to a single address. The websites, DNS requests and page timing move inside the tunnel. The sites you visit see the VPN server’s IP address instead of the one your ISP assigned you.

The part marketing leaves out

A VPN moves trust, it doesn’t remove it. The Electronic Frontier Foundation puts it plainly: a VPN hides your browsing from your ISP, but it’s all visible to the VPN provider. You are choosing which company sees your traffic, so the questions that matter are about the provider:

Logging policy. What does it keep, and for how long? A policy that spells out what it does not log says more than “no logs”. Atomic VPN, for instance, lists connection timestamps, assigned IPs, per-user bandwidth and DNS queries as things it doesn’t keep.

Jurisdiction. Where is the company based and which legal requests can reach it?

Verification. Has the claim been independently tested, and is the result public? Treat any provider that cannot answer this with caution.

A VPN also isn’t anonymity. Cookies, logins and browser fingerprinting still identify you. If you sign in to your Google account inside the tunnel, Google still knows it is you.

A practical setup

Use Incognito for what it is good at: local privacy on shared devices.

Add a VPN for the traffic your ISP can see, especially on public or work networks.

Switch your device to encrypted DNS so lookups don’t go to your ISP in plain text.

Keep HTTPS-only mode on in your browser.

Log out of accounts you don’t need during sensitive sessions.

FAQ

Does Incognito hide my IP address? No. Websites still see your IP address. Only a VPN or similar tool changes it.

Can my ISP see which websites I visit in Incognito? Yes, at least the domain names, because the ISP handles the connection regardless of browser mode.

Can my employer see Incognito activity? If you use a work network or work-managed device, the network owner can see the same things an ISP can, and a managed device can have monitoring software on top.

Is HTTPS enough? It hides page content, not the domain you visited or the timing of your visit.

Does a VPN make me anonymous? No. It hides your traffic from your ISP and your real IP from sites. Logged-in accounts, cookies and fingerprinting can still identify you.