Incognito Mode Doesn’t Hide You From Websites

You open a private browsing window. You search for something you don’t want connected to your regular profile. You feel covered. The website you land on, however, can often tell it’s you anyway — the same you who visited last week, last month, from your regular browser.

Incognito mode does one specific thing: it stops your browser from saving cookies, history, and form data locally after you close the window. That’s the entire feature. It does almost nothing to stop the website on the other end from recognizing you. The tool that does that recognition is called browser fingerprinting, and it doesn’t need cookies at all.

What Incognito Mode Actually Blocks

To understand why fingerprinting bypasses incognito mode, it helps to know exactly what incognito mode does block:

• New cookies aren’t saved after the session ends
• Your browsing history isn’t added to your local history
• Autofill data from the session isn’t saved
• You’re logged out of accounts you were logged into in regular mode

That’s a real privacy benefit for shared computers — someone using your laptop after you won’t see what you searched. But none of these protections affect what a website can observe about you during your visit. Cookies are about what your browser remembers afterward. Fingerprinting is about what the website can read about your browser right now, in real time, regardless of mode.

What Browser Fingerprinting Actually Collects

A fingerprint is built from dozens of small technical details about your browser and device that, combined, create a profile unique enough to identify you specifically — even among millions of other users.

Canvas fingerprinting. Your browser is asked to draw an invisible image using your device’s specific graphics rendering engine. Tiny variations in how your GPU and drivers render that image create a unique signature, even between identical hardware models due to driver version differences.

Font enumeration. Websites can detect which fonts are installed on your system. The specific combination of fonts you have — from design software, language packs, or old installations — is often unique to your machine.

Screen and window properties. Resolution, color depth, available screen space, and browser window dimensions combine into another identifying signal.

Timezone and language settings. Your system timezone, locale, and language preferences narrow down who you are geographically and demographically.

WebGL and GPU information. Your graphics card model, driver version, and rendering capabilities are exposed to websites by default through WebGL.

Installed plugins and browser extensions. Even ad blockers can be fingerprinted — the specific way an extension modifies a page can itself become an identifying signal, which is a strange irony for privacy tools.

Audio context fingerprinting. Your browser’s audio processing stack has tiny hardware-dependent variations that can be measured without you hearing or seeing anything.

Individually, none of these signals are very identifying. A million people might share your screen resolution. But combined — your specific screen resolution, plus your font list, plus your GPU signature, plus your timezone, plus your installed plugins — the combination becomes unique enough to identify a single browser among millions. Research from the Electronic Frontier Foundation’s Panopticlick project found that the vast majority of browsers tested had a fingerprint unique enough to be individually identifiable.

Why This Works Identically in Incognito Mode

Here’s the part that surprises most people: every signal listed above is available to a website regardless of whether you’re in incognito mode or not. Your screen resolution doesn’t change. Your installed fonts don’t change. Your GPU doesn’t change. None of these are stored in cookies — they’re read directly from your browser and operating system in real time, every single page load.

This means a website that fingerprinted you in your regular browsing session can recognize that same fingerprint when you open an incognito window, because almost nothing about your underlying device changed. The only thing incognito mode hides is the cookie-based history — which fingerprinting doesn’t rely on in the first place.

Who Actually Uses Fingerprinting and Why

Fingerprinting isn’t a fringe technique — it’s mainstream infrastructure. Ad tech companies use it as a cookie-replacement strategy, particularly as Safari, Firefox, and increasingly Chrome restrict third-party cookies. Fraud prevention systems use it to detect when the same device is creating multiple accounts. Streaming services use it to enforce device limits even across incognito sessions. Some news sites use it to enforce paywall limits that survive clearing cookies entirely.

The shift toward fingerprinting has accelerated specifically because of privacy improvements elsewhere. As cookies became easier to block and clear, the advertising industry invested heavily in fingerprinting as a more durable alternative — one that survives the exact privacy habits people adopted to protect themselves from cookies.

What I Actually Found

I tested my own browser fingerprint using EFF’s Cover Your Tracks tool in both regular and incognito mode on the same machine, same session. The result: identical fingerprint in both modes. Same canvas hash, same font list, same WebGL signature. The only difference incognito mode produced was a fresh set of (non-identifying) cookies, which is irrelevant to the fingerprint itself.

What actually changed the fingerprint significantly: switching to Firefox with privacy.resistFingerprinting enabled in about:config. This setting rounds reported values to common denominators — screen resolution gets reported as a standard size rather than your exact resolution, timezone gets reported as UTC by default, and canvas requests return blocked or randomized data. It’s a noticeably more effective single setting than incognito mode, Brave’s default settings, or any combination of ad blockers I tested.

The honest tradeoff: resistFingerprinting breaks some websites’ layout and functionality, because sites that expect your actual screen size sometimes render incorrectly when given a rounded one. It’s the kind of friction that explains why fingerprint resistance isn’t enabled by default in most browsers — it costs convenience for privacy, and most browser vendors optimize for the former.

If you’ve already started auditing what your smart home devices collect or opting out of data broker listings, browser fingerprinting is the piece that operates beneath all of that — it’s how you get tracked even when every other privacy control is working correctly. None of the other protections matter much if your browser is broadcasting a unique signature on every page load. A VPN won’t touch this either — fingerprinting happens entirely at the browser level, regardless of what IP address your traffic is routed through.

What Actually Reduces Your Fingerprint

Method	Effectiveness	Tradeoff
Incognito/Private mode	✗ None	False sense of privacy
VPN	✗ None for fingerprinting	Helps with IP-based tracking only
Ad blocker (uBlock Origin)	◐ Partial	Blocks some fingerprinting scripts, not device signals
Brave browser (default)	◐ Partial	Built-in fingerprint randomization, some site breakage
Firefox + resistFingerprinting	✓ Strong	Significant site breakage on some pages
Tor Browser	✓ Strongest	Slow, blocks some normal browsing functionality

For most people, the realistic answer isn’t eliminating your fingerprint entirely — it’s understanding that the privacy habits you already use (incognito, VPN, clearing cookies) aren’t doing what you assumed, and choosing one stronger layer, like Firefox with resistFingerprinting enabled, for the browsing you actually want protected.