"Private Browsing Keeps You Anonymous" — And Nine Other Privacy Myths

When you open a private browsing window, your browser simply skips writing your session to local storage. Your ISP still logs the domains you connect to, and websites still see your IP address and any identifying cookies or login sessions you carry. Google's own disclosures in Chrome note that activity may be visible to websites, employers, and ISPs even in Incognito mode. For a fuller picture of what sites collect, see what websites actually know about you.

A VPN routes your traffic through an encrypted tunnel and substitutes the VPN server's IP address for yours. However, if you are signed into any Google or Meta account, those services can track your behavior regardless. Browser fingerprinting — which identifies you by your device's unique combination of settings, fonts, and plugins — also bypasses VPN protections entirely. The difference between encryption and anonymization is significant; encryption vs. anonymization explains why these are fundamentally different tools.

When you delete a file or clear browser history, most operating systems and browsers mark that storage space as available for reuse rather than immediately erasing the content. Forensic tools used by security researchers and law enforcement can frequently recover this data. Secure deletion requires specialized software that overwrites storage multiple times, or physical destruction of the media. Cloud-synced data adds another layer: even if you delete locally, copies may persist on servers according to the provider's own retention schedule.

HTTPS protects your data from being intercepted while traveling across the network — a meaningful security benefit. But the padlock icon in your browser's address bar only indicates that the connection is encrypted. The website itself may still harvest your personal information, sell it to third-party advertisers, or be operated by bad actors. Phishing sites routinely use HTTPS. Equating a padlock with trustworthiness is one of the most persistent and consequential privacy misconceptions.

Privacy matters well beyond concealing wrongdoing. Consumer data brokers compile detailed profiles — including inferred attributes like health conditions and financial stress — that are sold to marketers, insurers, and employers. Research has documented how behavioral data influences the prices individuals are shown online and the credit products offered to them. The premise that "I have nothing to hide" misunderstands how data is used commercially and legally. Our overview of why digital privacy matters covers this in depth.

A long, random password does protect against brute-force guessing. But if that password is reused across sites and one site suffers a breach, attackers can attempt that credential on hundreds of other services automatically — a technique called credential stuffing. Additionally, even the strongest password offers no protection against a phishing page where you enter it yourself. Two-factor authentication adds a critical second layer of defense that passwords alone cannot provide. Password reuse remains a leading cause of account takeovers.

Airplane mode cuts cellular and Wi-Fi signals, but GPS receivers are typically hardware components that continue to function offline. Many apps log your location while offline and sync that data the next time a connection is available. Bluetooth, which can be enabled independently of airplane mode, is used by retail tracking beacons. Additionally, your carrier retains tower-connection records that create a historical location trail independent of your phone's settings.

The phrase "if you're not paying, you're the product" is a simplification, but the underlying dynamic is well-documented. Advertising-supported apps and platforms collect behavioral data — what you tap, how long you linger, what you search — and use it to build profiles that are valuable to advertisers. App store permission requests for location, contacts, and microphone access are often tied to data collection rather than core app functionality. Reviewing permissions before granting them is one of the consistently recommended steps in practical privacy guidance, as outlined in everyday privacy practices that make a real difference.

Some browsers are built with stronger privacy defaults than others, but switching browsers does not automatically protect you. Most browsers, regardless of brand, arrive configured to enable third-party cookies, JavaScript, and location access out of the box. Meaningfully improving browser privacy requires adjusting settings, understanding which extensions help versus which introduce their own risks, and recognizing that browser choice is only one variable in a larger equation. Browser privacy settings that actually help walks through what actually matters.

Federal privacy law in the United States is organized by sector — healthcare data under HIPAA, financial data under GLBA, children's data under COPPA — with no comprehensive federal consumer privacy statute covering general internet use as of this writing. States like California have enacted broader protections through the CCPA, but coverage varies significantly by state. A privacy policy published on a website satisfies most current disclosure obligations, even if its terms are extensive and rarely reviewed by users.