But clicking the “private” browsing option may not protect you as much as you think, some privacy experts say.
These options have different names: Private Browsing in Safari and Firefox and Incognito Mode in Chrome, but the functionality is similar in each. In these private modes, your chosen browser does not keep a record of sites visited, pages cached, or information saved, such as credit card numbers and addresses. It also prevents session information from being stored in the cloud.
While using these options adds some level of online protection, privacy experts say it doesn’t stop at preventing the user from being tracked entirely, which can limit the protections they can offer to women in this new legal landscape.
“We have to recognize that often simply turning on private mode does very little to prevent third-party tracking and especially law enforcement tracking,” said Albert Fox Cahn, founder and executive director of the Project Supervision of Surveillance Technology and member of the New York University School of Law.
What does private browser mode do?
As designed, private browsing modes are best suited to protecting your web activity from other people using the same device, experts say, but they don’t do much beyond providing that local shield.
“It can be useful, for example, for trans and queer kids who are worried about being tracked by their parents, and for people who might be in a situation where they can’t safely separate their computer from other people who might access browser history.” says Fox Cahn.
Private mode can also help reduce tracking on websites. In Chrome, for example, users are told: “Websites see you as a new user and won’t know who you are, as long as you don’t sign in.”
“People choose to browse the web privately for many reasons,” said Parisa Tabriz, vice president of the Chrome browser. “Some people want to protect their privacy on shared or borrowed devices, or exclude certain activities from their browsing history. Incognito helps with these use cases.”
Generally, when a person browses online, companies will use tracking devices known as cookies to keep track of digital activity from site to site for more targeted advertising. Depending on the browser and user options, private browsing mode may reduce the sharing of information between sites. But with some browsers, users need to know how to select these additional options, beyond simply choosing private mode.
Safari, for example, has a default Smart Tracking Prevention feature, which limits tracking between sites while allowing sites to continue to function normally. Its “Prevent Cross-Site Tracking” and “Block All Cookies” options are additional steps to protect users, but these features are separate from Private Mode. Chrome, meanwhile, advises users that they must choose to block third-party cookies, even in incognito mode. Firefox added new default features last year, including “full cookie protection” to prevent users from being tracked across the Internet, as well as “smart blocking” to allow third-party logins through sites like Facebook or Twitter while still working to avoid tracking.
Private modes also have limited effectiveness with respect to IP addresses, which are tied to the device and can be used to geolocate the user.
“Whether you are in privacy mode or not, your IP address should always be known to the recipient because when your browser sends the request for data, the server receiving the request needs to know where to send it data,” said Andrew Reifers, associate professor at the University of Washington’s school of information. An Internet service provider may also log a user’s online activity regardless of their browser’s privacy settings.
Some browsers offer additional protections to address this. Safari has a “Hide IP Address” selection separate from Private Browsing mode that, when enabled, sends information from the user’s browser to two different entities, one obtaining the IP address but not the website being visited and the other getting the website but not the IP address. . That way, neither has all the information about a user. Other browsers also have options to mask IP addresses, such as VPN extensions or “disable Geo IP” capabilities that prevent browsers from sharing a user’s location with websites.
What doesn’t private browser modes protect?
Online browsing is stored in two places: on your local computer and on visited sites. When a user in private browsing mode goes to Facebook, for example, there will be no stored record of that visit on their device, but there will be a stored record of that visit in their Facebook account logs and Facebook ad analysis.
The record users leave online, with or without private browsing options enabled, creates a lot of uncertainty about how that data could be used as evidence by law enforcement in states that criminalize abortion. Tech companies have said little about how they would handle such requests. Groups promoting digital rights and reproductive freedoms are now warning people in those states to safeguard their digital footprints when seeking abortion information and resources online, and are sharing tips on how to do so.
Also, if someone is working on a company or school laptop, private browsing mode won’t do much. “If you have a computer where someone is managing it, it’s not possible to have privacy against that person,” said Eric Rescorla, CTO of Mozilla. “If an employer owns your computer, they can put any kind of monitoring software on your computer that they want, and they can measure anything you do. So, no, it doesn’t protect you against that, but almost nothing would.”
Google Chrome also warns users that incognito mode cannot offer full protection in such cases. “When you’re in incognito mode, your activity may still be visible to the websites you visit, your employer or school, or your internet service provider. We make this clear when we open incognito mode incognito,” Tabriz said.
Users should also note that the protections offered in private mode are exclusive to web browsing, leaving any activity on smartphone apps vulnerable. As much as Private Browsing Mode works to protect user activity, it can’t help anywhere else. “A lot of the apps we use don’t have an incognito mode built in,” Reifers said. “You don’t really know what this app stores.”
What additional steps can you take to protect yourself online?
Beyond enabling private browsing modes and selecting additional privacy options that companies offer in their settings, there are a few additional steps users can take to try to maximize digital privacy,
A VPN, or virtual private network, hides an IP address to make a user more anonymous online, effectively protecting who and where the user is. “A good first step would be to use a private browsing mode and a VPN together,” Rescorla said.
But using a VPN can allow the VPN operator to access your browsing activity. “Many of these will sell that information or certainly make it available to the police if they provide a warrant,” warns Fox Cahn.
Internet users may also consider turning to a browser like Tor, a secure and anonymous option that uses multiple proxies to prevent any server from fully tracking activity, privacy experts say.
Above all, experts stress that Internet users must be aware that online activity is not essentially private, regardless of browser settings. And while clearing your browsing history and clearing your cookie cache makes data recovery difficult for third parties, it’s still not impossible with certain forensics tools and commands.
Fox Cahn stresses that those concerned about data privacy, such as abortion seekers, should take as many steps as possible, including buying a new device that is not traceable or using services like Tor. “It’s cumbersome, but this provides a lot more protection,” he said. “You have to keep in mind that all you can do is reduce the amount of risk. None of them are absolutely perfect.”