Who Can See Your Incognito Browsing: School, Employer, Wi-Fi Owner and ISP

Incognito mode hides your browsing from the next person who picks up your device. It hides nothing from the network you are sitting on. Those are two completely different questions, and almost every argument about private browsing comes from mixing them up.

So the useful question is not whether incognito mode is private. It is who is watching, and from where. Your school sees one thing, your employer sees another, the person who owns the Wi-Fi sees a third, and your internet provider sees something different again. The answers are not the same, and some of them depend on whose laptop you are holding.

This page goes through them one at a time, using what Google, Mozilla, Microsoft and Apple each say in their own documentation rather than what privacy blogs say about them. It also corrects several figures that an earlier version of this page presented as research. Every number I rely on below carries its source, its sample and its date.

Author: David Miller Senior Privacy & VPN Architect

An earlier version of this page carried survey percentages, a consulting figure and a citation that did not support the claim attached to it. I wrote none of that from research, so I have removed all of it rather than looking for numbers that would fit. What replaced it is what the browser makers publish themselves, quoted and linked, so you can check every sentence against the vendor rather than against me.

My limits, plainly. I can tell you what each kind of network operator is technically able to see, because that follows from how the connection works and from documentation. I cannot tell you what your particular school or employer has chosen to log, or for how long, because that is a policy decision inside their building and it varies enormously.

What the Browser Makers Say Their Own Mode Does

Start with the vendors, because they are unusually direct about this and rarely quoted on it in guides of this kind. All four of the major browsers ship a private mode, all four document it, and none of them claims it makes you anonymous.

Google is the bluntest of the four. Its Chrome Help article on Incognito mode says: "While Incognito can help keep your browsing private on your device, it doesn't make you invisible." It then names the parties by role: "Websites you visit, including Google sites, and organizations that manage your network, like your school, employer, or internet service provider, may be able to observe your activity in Incognito."

Read that list again, because it is the structure of this whole page. Google is not describing a vague privacy risk. It is naming three specific categories of watcher, and the rest of this article works through them one at a time.

One thing Google does not do is mention your IP address. The phrase does not appear on that page at all. It talks about organizations being able to observe your activity, which is a broader statement and a true one, but if you see a guide claiming Google says incognito exposes your IP, that guide has not read the page.

The One Sentence That Settles the IP Question

Mozilla is the vendor that says it outright. Firefox's support documentation on what Private Windows do and do not protect states plainly: "It doesn't hide your IP address or your location."

The same page adds that "A Private Window doesn't make you anonymous online." It then names the watchers almost exactly as Google does: "Some activity in Private Windows may still be viewed by sites, search engines, internet providers, or your employer (if you're on a work/school network or computer)."

Microsoft's documentation for InPrivate browsing in Edge draws the same line in one sentence: "Other people using this device won't see your browsing activity, but your school, workplace, and internet service provider might still be able to access this data."

Apple makes the point by where it files things. Its Safari privacy document describes Private Browsing in local terms — "When Private Browsing is enabled, Safari doesn't remember the pages you visit, AutoFill information, and your open tabs aren't stored in iCloud or synced across your devices" — and documents hiding your address in a separate section about a separate feature. The two are never connected, which tells you plainly that one does not deliver the other.

So that is the settled part: four vendors, four private modes, and not one of them touches the address you connect from. If changing that address is the thing you actually wanted, it needs a different kind of tool, and the free ways to change the address a site sees, and the catch in each is the honest place to start.

None of the four passages quoted above covers the exposure that catches people who have done everything else right. A browser can hand out your real address through a feature meant for video calls, entirely separately from whether the window is private. How that leak works, and how to close it in Chrome and Firefox covers the case where even a tunnel does not save you.

Four Vendors, One Agreement

Put the four side by side and something more useful than agreement appears. On the address question they do agree. On everything else they are not equivalent at all, and most guides on this subject treat all four as the same feature.

Read the middle column again, because it is the part that gets flattened everywhere else. Firefox and Safari do real work against tracking inside a private window. Chrome and Edge, by their own documentation, mostly do not. "Incognito mode" is four different features wearing one name.

What none of them does is change the address you connect from, and that is the column on the right. Every cell in this table is a sentence the company that built the browser published about its own product, so you do not have to take a privacy site's word for any of it, including this one.

Your School: Whose Device, and Whose Network

This is the most common version of the question and it almost always contains two questions wearing one coat. Whose device is it, and whose network is it? They have separate answers and you can be caught by either.

On a school-issued laptop or Chromebook, the device itself is the exposure. Managed devices can carry monitoring software and policy settings that report activity regardless of which browser window you open, and on a managed Chromebook the administrator can switch incognito off entirely. Nothing you do inside the browser changes what an agent installed above the browser can record.

On the school network with your own laptop, the device is yours but the traffic is theirs. Every request leaves through their equipment, so the network sees which sites you connected to and when. Incognito mode never touches that, because the request has already left the browser by the time it reaches their router.

There is a third case that surprises people. Signing into a school or work account inside an incognito window links that session to the account regardless of the window, because the site you signed into now knows exactly who you are. Incognito clears what your browser stores; it cannot un-tell a service who just logged in.

The honest summary is the one students least want: incognito helps only with the case where a classmate picks up the same shared computer afterwards. For anything involving the school's own equipment or the school's own network, it does nothing at all, and Google, Mozilla and Microsoft all say so in the sentences quoted above.

Your Employer: The Same Structure, Higher Stakes

Work is the school question again with better funding. The same split applies — company device or personal device, company network or your own connection — and the same answer falls out of it.

A company laptop is the strongest case against incognito. Corporate devices commonly run management software, and a machine that is centrally managed can be configured to report far more than a browser window can hide. Incognito is a setting inside an application that the device owner controls.

A corporate VPN client is the part people miss. Its purpose is access to internal systems, but depending on how it is configured it can also carry your general browsing back through company infrastructure, so a work laptop at home on your own broadband is not automatically outside their view. Many are set up to route only internal traffic, which is why this one is worth asking about rather than assuming either way.

Email and chat are the quiet part. Anything you send through a company account travels through systems the company administers, so the browser window it was typed in never enters the question. People who worry carefully about incognito often forget the account they are signed into while using it.

What genuinely limits what an employer sees is your own device on your own connection, with nothing of theirs installed on it. That is a real boundary, and it has nothing to do with whether the window is incognito.

The Wi-Fi Owner, and What a Router Can Hold

Parents, landlords and flatmates are the version of this question people are most anxious about, and here the answer is more reassuring than the internet suggests — with one exception.

A household router can log the connections passing through it, and some keep a list of domains. That list is not a browsing history in the sense people fear: it does not contain the pages you read, the searches you typed or what you did on a site, because that content is encrypted between you and the site. What it can show is which domain was contacted and roughly when.

The exception is a router that has been deliberately configured to do more, or a parental-control service running on the connection. Those exist, they are sold openly, and they can log considerably more detail. If a household has set one up, the person who set it up knows.

Worth separating from the router question: the person who owns the Wi-Fi and the ISP behind it are not the same watcher. A housemate reading the router admin page sees whatever that box records. The ISP sees the connection itself, which is a different and larger view, and the next section covers it.

How much is kept depends entirely on the equipment. A basic router typically holds a short, awkward-to-read buffer that overwrites itself. A mesh system or a router with a parental-control subscription can keep weeks of per-device history in a phone app that is designed to be read easily. Assume the second until you know it is the first.

Your Internet Provider, and What Encryption Changed

Your provider carries every packet you send, so it is the watcher with the best seat. Incognito mode is invisible to it, because the browser setting never leaves your machine.

What has genuinely changed is how much of it they can read. With sites served over HTTPS, the contents are encrypted, so a provider carrying the traffic can see that a connection to a domain happened without seeing the page you were sent. The destination remains visible even when the content does not.

Name lookups are the part that often stays exposed. Before your browser can reach a site it asks a resolver to turn the name into an address, and unless that lookup is encrypted and pointed somewhere else, it goes to your provider's own resolver in the clear. That can amount to a list of the sites you opened, sitting with the company that sells you the connection. Caching means not every visit generates a lookup, and some browsers now encrypt these by default, so it is worth checking what yours is doing rather than assuming the worst or the best.

This is the one place on the page where the fix is genuinely straightforward, and it is not a browser setting. Moving both your traffic and your lookups through something your provider does not operate is what changes the answer, which is why checking whether a tunnel is actually carrying your DNS matters more than checking whether a window is incognito.

Who Can See Your Incognito Browsing, and Exactly What They See

Here are the watchers from the sections above, in one place. Read across the row for your situation rather than looking for a single verdict on incognito, because there is not one.

The pattern is in the third column. One row says yes, one says partly, and the four in between all say the watching happens somewhere a browser setting cannot reach — which is the same thing Google, Mozilla and Microsoft each said in their own words further up this page.

Why Websites Recognize You Anyway

The last row deserves its own section, because deleting cookies is the thing incognito genuinely does and people reasonably expect it to work.

The problem is that cookies are no longer the only way to be recognized. A browser volunteers a great deal about itself to render a page properly — screen size, time zone, language, fonts, how it draws graphics — and that combination can be distinctive enough to identify a browser without storing anything on it at all.

There is a real measurement of this, and it is usually quoted with neither its date nor its caveat. Peter Eckersley's study "How Unique Is Your Web Browser?", published by the Electronic Frontier Foundation, reported that "In this sample of privacy-conscious users, 83.6% of the browsers seen had an instantaneously unique fingerprint". The sample was 470,161 browsers, the data was "collected between the 27th of January and the 15th of February, 2010", and the paper says of itself that "our sample of browsers is quite biased".

So it is sixteen years old, it measured a web that still ran Flash and Java, and the people it measured had volunteered for a privacy test. Treat the percentage as a historical finding rather than today's number for the general public. What has not aged is the mechanism, which is why two of the four browsers now ship defenses against it. How recognition works after you clear cookies or switch devices covers where that has gone.

You can see your own case rather than take the general point on trust. Check how distinctive your browser's graphics rendering is in a normal window and then in a private one, and compare. In Chrome and Edge, watch how little moves. In Firefox and Safari, watch whether their built-in protection changes the reading — that difference is the whole point of the table above.

What Actually Changes the Answer

If incognito is not the lever, it is fair to ask what is. Three things move the answer more than any browser setting, and a fourth defeats all of them.

Whose device you are holding is the first and the strongest. A personal device carries nothing that someone else installed, and no browser setting can reproduce that on a managed one. Everything else on this page is secondary to it.

Whose network you are on is the second. Traffic that leaves through someone else's equipment is visible to whoever runs that equipment, which is why the same laptop gives different answers in different buildings.

Whether your traffic and your name lookups are encrypted and routed elsewhere is the third, and it is the only one that is a tool rather than a circumstance. That is the layer where a VPN operates and where a browser setting cannot. It is also the layer that fails quietly rather than loudly, which is the reason it is worth testing rather than assuming.

The fourth thing defeats the other three, and it is the one people forget: signing in. The moment you log into an account, the service knows who you are no matter whose device, whose network or whose tunnel carried the request. No setting on this page survives that.

Where Incognito Genuinely Earns Its Place

None of this makes the feature useless. It makes it narrow, and narrow is fine when you know the width.

It is the right tool for a device other people touch. A shared family computer, a library machine, a hotel business center, a friend's laptop — in every one of those the threat is a human being opening the same browser afterwards, and incognito removes exactly that.

It is also genuinely useful as a clean session. Signing into a second account, checking how a page looks to someone who is not logged in, or testing a site without your saved cookies are all things a private window does well, because a blank profile is precisely what it gives you.

What it is not is protection from anyone upstream of your browser, and the value of knowing that is knowing when to reach for something else. What a site can work out from your address alone covers the other half of the picture, which is what the destination learns about you regardless of the window.

The Short Version

Incognito mode is mostly a local feature. It clears the record on your device, and in Firefox and Safari it also fights trackers and fingerprinting, but in none of the four does it change the address you connect from — which is where every watcher in this article is standing.

Who can see your incognito browsing depends on whose device and whose network, not on which window. School and work see it through their own equipment, and a Wi-Fi owner may hold a list of domains.

Your provider sees destinations and, usually, your name lookups. Websites recognize the browser itself, cookies or no cookies.

The four companies that build the browsers all say a version of this in their own documentation, which is the most useful fact on this page, because it means you never have to take a privacy site's word for it. If clearing the record is what you were actually after, which already-recorded records you can get deleted, and which you cannot deals with the part incognito cannot reach, and what a VPN still leaves visible is worth reading before you assume the next tool solves it either.