Try something. Open whox.com in a regular browser window and look at your fingerprint. Now open whox.com in incognito. Lay both results next to each other.
Identical.
Same canvas hash. Same WebGL renderer. Same CPU core count, same fonts, same audio fingerprint, same GPU timings. Every single WHOX check spits back the exact same answer in incognito as in normal browsing. Like photocopying a page and expecting the copy to show different words.
Cookies get scrubbed once you close an incognito window. History never hits disk. Form data vanishes. Full stop, that's the whole feature, and the fence ends right there. Fingerprinting doesn't want your cookies; it reads your browser, your hardware, your OS-level quirks, everything that stays bolted to your machine regardless of what mode you're in. None of those budge when you press Ctrl+Shift+N. Ask anyone on r/privacy and the refrain hasn't wavered in years: incognito hides you from your browser history, not from the web.
Answer Capsule: Incognito scrubs cookies and history on your device yet leaves every one of 300+ identification signals untouched. Your fingerprint in normal browsing and in incognito is the same.
What Google Knew
Law firm Boies Schiller Flexner dropped a class-action suit in 2020, Brown v. Google LLC, in San Francisco federal court. Charges were blunt: Google kept hoovering up user data through Chrome, Google Analytics, and Google Ads even while users had Incognito switched on.
Internal documents hemorrhaged out during discovery. Google's own engineers called incognito effectively a lie. A problem of professional ethics and basic honesty. Confusing mess. Not outside critics. Not reporters. Not activists. People who built Chrome's source code knew incognito was a falsehood and shipped it anyway, year after grinding year.
Both sides shook hands on a settlement December 28, 2023. April 1, 2024, terms went public. Headlines screamed five billion dollars. Zero dollars reached users. Not one cent for the plaintiff class. Across 136+ million Americans, each person got exactly nothing.
Per The Verge, Google was ordered to:
- Delete billions of private browsing records
- Partly strip IP addresses and flatten history down to domain level
- Block third-party cookies in incognito by default for five years
- Stop logging whether someone is using incognito
Most telling concession: rewrite the warning.
Chrome used to say Now you can browse privately. Current wording reads You can browse more privately. One word. More. Between privately and more privately sits a five-billion-dollar lawsuit and a court ruling that the first phrasing was a lie. Updated copy adds, with lapidary candor: Won't change how data is collected by websites you visit and the services they use, including Google. Google warning you about Google. That breed of frankness only materializes at the business end of a gavel.
Twice as Bad as Anyone Reckoned
When researchers say a third of top websites run fingerprinting, they're wrong. Not from mendacity. From broken instruments.
A team from UCL, UC Riverside, and Google Zurich published Beyond the Crawl at the ACM Web Conference in April 2025. Crux of the paper: every prior measurement leaned on automated crawlers, where a bot lands on a site, tallies loaded scripts, and counts fingerprinting calls. Bots don't log in, though. Don't click. Don't scroll. Don't crack CAPTCHAs. Don't sit idle for three seconds while a lazy script fires after a human gesture.
Researchers matched crawler data across 3,000 sites against real sessions from 30 living, breathing users. Automated crawlers missed nearly half of all fingerprinting deployments. Scripts walled behind login screens, scripts that only wake after a click or scroll, scripts rigged with bot-detection gates: all invisible to a crawler. Sending a mannequin through airport security and concluding nobody gets patted down gives you roughly the same epistemic outcome.
What slips through the net? Scripts that load only after login. Fingerprinting calls tucked behind CAPTCHAs. Trackers that stir after a scroll, a tap, or three idle seconds. Whole libraries that fire up only when bot-detection confirms a warm body. A crawler has no pulse. Walks right past everything.
Bare arithmetic: whenever someone cites a third of top sites, the honest figure lands closer to two-thirds. Every academic tally of fingerprinting reach is off by a factor of two. Each one of those sites reads your fingerprint identically regardless of incognito. Ctrl+Shift+N shifts nothing.
Why Your Fingerprint Stays Put
Fingerprinting works without writing a single byte to your device. Stateless by nature. Polls the browser: what User Agent? What screen resolution? What GPU? How many cores? Which fonts? How does audio render? How does canvas draw?
Incognito doesn't alter the answer to any of those queries. Your GPU doesn't metamorphose because you opened a private window. Fonts don't evanesce. Screen keeps its resolution.
Eckersley showed as much in 2010 across 470,161 Panopticlick users: minimum browser entropy hit 18.1 bits, one chance in 286,777. And that was with fifteen-year-old tooling, before WebGL, WebGPU, or GPU timing attacks existed. Laperdrix tested 118,934 users on AmIUnique in 2016 and found 89.4% of desktop fingerprints came back unique. Google and MIT for PoPETs'25 fed just 13 attributes from 8,400 users into their model and still hit 60.2% uniqueness at 12.1 bits of combined entropy.
Sixty percent. Thirteen parameters. A single visit. Commercial systems harvest orders of magnitude more, and each added bit of entropy doubles the telling-apart power. Math here is remorseless.
Forrester pegs private browsing usage at 23% of American adults. One in four users believes they're shielded. Fingerprinting works identically in both modes.
Bleakest finding from PoPETs'25: low-income users turned out more exposed to fingerprinting. Older, cheaper hardware is rarer, which makes it more distinctive. Every MacBook Pro M3 shares the same WebGL renderer, a homogeneous flock. A bargain-bin 2018 Acer laptop running Intel HD Graphics carries its own singular signature, like a zebra whose stripes differ from every other zebra in the herd. Poverty literally makes you more legible in digital space, a fact DefCon speakers have been hammering since at least 2019. Incognito doesn't mend any of it.
Researchers also found that a browser fingerprint can betray gender, age, income bracket, and race. Fingerprinting isn't merely a tracking tool. Profiling engine. In incognito and out.
Storage Quirks: Incognito Makes You More Findable
Here is where the story buckles into risible absurdity.
In normal mode, Chrome lets a site claim up to 60% of disk space. In incognito, that quota plummets to 5%. Logic seems sound on its face: if an incognito tab writes as much to disk as a regular one, data outlives the window, so the quota gets slashed for privacy's sake.
Snag is blunt. navigator.storage.estimate() hands that quota value to any site that asks. Site sees a user's quota sitting at 5% instead of 60%. Alone, that fact works as an incognito tell, as legible as a poker player's twitch across the felt.
Chrome versions 74 through 84 made the leak cruder still. navigator.storage.estimate() returned a hard ceiling of 120 MB for incognito. One hundred and twenty megabytes. Any site could fire one line of JavaScript, get the number back, and know instantly: user was in incognito. Six Chrome versions. Billions of sessions. One API call. Flawless detection.
Google patched that hole in Chrome 84 by rounding quotas to 1 GB. Gap between regular and private mode lingered all the same. Normal-mode quota still betrays rough disk size: a 256 GB SSD and a 2 TB drive return different numbers. WHOX flags this through signal F26, one of the most overlooked fingerprint vectors.
Bottom line: incognito doesn't hide you from fingerprinting. It adds a fresh signal that sets you apart. Camouflage that fluoresces in the dark.
Chrome's Privacy Kabuki
All of this unfolds against a remarkable corporate charade.
In 2019, Google stated We believe that this subverts user choice and is wrong. Referring to fingerprinting. January 2020, Google pledged to strip third-party cookies from Chrome by 2022. Bumped the deadline to 2023. Next to 2024. Late 2024. April 2025 they scrapped the plan altogether.
Come December 2024, Google quietly greenlit fingerprinting for advertisers. Britain's data watchdog, the ICO, called the move irresponsible. Five years prior Google had labelled fingerprinting wrong. Now they'd formally blessed it. Five years of legerdemain. Zero contrition.
Cookie partitioning, Privacy Sandbox, Topics API: all looks like earnest privacy work. In practice it's stage furniture. While Google rearranges props under the spotlight, backstage every American's data gets broadcast through RTB auctions 747 times a day, roughly 490 billion requests total. Each request carries a device fingerprint. No cookies needed. Partition them, burn them, salt the earth. Chrome partitions cookies while fingerprinters read your GPU renderer straight off the wire. Two parallel realities: one minted for press releases, another humming in ad-auction pipes. Krebs has chronicled similar corporate doublespeak in security for over a decade, and calling Google's version mere theater would be charitable.
What About Apple?
Safari 17 shipped Advanced Fingerprinting Protection for private browsing. Noise injection into canvas, WebGL, audio. Sounds hefty. Audio fingerprints get jittered at ±0.001 amplitude, per the WebKit source code.
FingerprintJS broke through it in 7.5 milliseconds. On an M1 MacBook. Method: gather 262,144 noised copies of the audio buffer and compute the mid-range between floor and ceiling. Noise is random and symmetric, so extremes cancel. 262,144 samples suffice. Noise melts away. Clean original remains. Much like averaging out a roomful of shouting voices to recover the one quiet sentence underneath.
Seven and a half milliseconds. A defense Apple spent months forging, undone in less time than a human blink. User never feels the delay; script finishes gutting the randomization before anyone can flinch.
iOS 26 turns Advanced Fingerprinting Protection on for all modes by default. Progress, sure. Even so, audio bypass still lands. Canvas noise, as the Breaking the Shield paper at WWW'25 showed, is statistically detectable. Anti-fraud systems draw canvas with known colors, read pixels, catch deviations. Any drift from expected values flags noise injection. Defense itself becomes a beacon: user runs Safari 17+ with randomization on. Candidate pool narrows. Protection that outs you. Again.
Fingerprinting Incognito at Commercial Scale
FingerprintJS claims it can spot incognito on every major browser. Chrome, Edge, Firefox, Safari, Opera, Brave. Each one seeps through its own fissure:
- Chrome/Edge: write timing to the temporary file system runs faster in incognito
- Firefox:
indexedDB.open()throws an error in private mode, working from Firefox 88 onward - Safari before version 11:
localStorage.setItem()threw QUOTA_EXCEEDED_ERR; patched since, other vectors remain
None of this dwells in academic journals alone. A commercial product runs across thousands of sites right now. Fingerprint.com claims 99.5% accuracy for the paid tier against 40-60% for open-source alternatives. Chasm is staggering. Incognito doesn't merely fail to hide you. Switching it on gets detected and folded into your profile as one more signal. You flipped a toggle to vanish. Became more visible instead.
Cold Numbers
| Metric | Result | Source |
|---|---|---|
| Unique fingerprints, 13 attributes | 60.2% | Google+MIT PoPETs'25 |
| Unique fingerprints, 118K users | 89.4% | Laperdrix et al. 2016 |
| Minimum entropy, 470K users | 18.1 bits | Eckersley 2010 |
| Fingerprinting reach missed by crawlers | ~50% | Beyond the Crawl, WWW'25 |
| Safari audio defense bypass | 7.5 ms | FingerprintJS 2024 |
| Users in Google lawsuit | 136+ million | AP News, April 2024 |
| Money paid to users | $0 | AP News, April 2024 |
| RTB broadcasts per American per day | 747 | Iccl / EFF, 2025 |
Incognito mode does exactly one thing: keeps history and cookies off your disk. If your threat stands behind your chair, waiting for you to step away from the keyboard, incognito works beautifully.
If your threat lives on a server and wants to know who you are, incognito is worthless. Worse: after Beyond the Crawl, we know twice as many such servers exist as anyone reckoned.
You aren't hiding from the internet. You're hiding from your spouse.
Try It Yourself
Open WHOX in a regular window and again in incognito. Compare the F-score for fingerprint, C-score for consistency, and A-score for anonymizer. All three will match. Lone exception: signal F26 for storage quota, which in incognito can betray the very fact you're in private mode.
Frequently Asked Questions
Does incognito protect against fingerprinting? No. Incognito wipes cookies and history on your device, but none of the 300+ fingerprinting signals like canvas, WebGL, audio, fonts, and GPU shift when you turn on private browsing.
Why is the fingerprint identical in regular and private mode? Fingerprinting is stateless. Queries hardware and software traits that have nothing to do with whether cookies get written to disk. Your GPU, fonts, and screen stay the same.
Can websites tell you're in incognito? Yes. FingerprintJS claims incognito detection across all major browsers at 99.5% accuracy. Vectors include file system write timing in Chrome, indexedDB errors in Firefox, and shrunken storage quotas.
How widespread is fingerprinting? Per Beyond the Crawl from WWW'25 and Google Research, true spread is roughly double what earlier studies suggested: around 60-70% of top websites, not 30-35% as once believed. Crawlers miss scripts behind login walls and bot-detection gates.
What does incognito actually hide? Only local traces: history, cookies, and form data on your device. Helpful if your threat is someone with hands-on access to your machine. Useless against servers that pick you out through browser fingerprinting.
Read Next
- The First 100 Milliseconds: What Servers Know Before the Page Loads > How servers pin you down through TCP, TLS, and HTTP/2 protocols
- The Privacy Paradox: Protection Makes You More Visible > Why privacy extensions backfire
- 300+ Signals: The Entropy Map > Which browser signals carry the most weight
- What Actually Works: An Honest Guide > Three privacy tiers and a list of things that only make it worse
Sources: Google+MIT PoPETs'25, Beyond the Crawl WWW'25, Laperdrix et al. AmIUnique, Eckersley Panopticlick 2010, The Verge Jan 2024, FingerprintJS audio bypass, FingerprintJS incognito detection, ICO response Dec 2024, EFF RTB Jan 2025, AP News April 2024, Forrester, web.dev Storage API
WHOX - We tell real signals from manufactured ones. Check your fingerprint at whox.com and find out what signals leak from your browser and how unique you are.
Related Articles
The First 100 Milliseconds: What Servers Know Before the Page Loads
Servers identify your OS, VPN, and browser within 100ms through TCP, TLS, and HTTP/2 protocol fingerprints > before any JavaScript runs or cookies are set.
BlogYour Cursor Already Told Them Who You Are
Mouse movements, typing rhythm, and scroll patterns strip anonymity from 84-95% of users inside 60 seconds, even after an IP swap, a cookie wipe, and a fresh browser.
BlogPrivacy Paradox: Your Shield Is Your Fingerprint
So goes every browser session where you've loaded privacy extensions, cranked an ad blocker with twenty filter lists, and dialed your settings to fortress mode. You don't fade. You fluoresce. And honestly, that's the cruelest joke in modern web security.