Private Browsing for Streaming: What Incognito Actually Hides (and What It Doesn't)
Incognito mode protects you from your roommate, not your ISP or the sites themselves. A clear-eyed breakdown of what each privacy layer does and doesn't cover.
“Use incognito mode” is the standard advice for private viewing. It’s also the most misunderstood feature in consumer browsers — a tool designed for one job (keeping your local history clean) that gets credited with powers it never had. Here’s the honest accounting of what each layer actually protects.
The Layers, Honestly
Layer │ Hides from local users │ Hides from ISP │ Hides from site
───────────────────┼────────────────────────┼────────────────┼─────────────────
Incognito/private │ Yes │ No │ No
Encrypted DNS │ No │ Partial │ No
VPN │ No │ Yes (mostly) │ Partial (IP only)
What Incognito Mode Really Does
It keeps your device clean. No history entries, no cookies persisting past the session, no autocomplete suggestions surfacing later, no “recently visited” surprises when someone borrows your phone. That’s genuinely useful — and it’s the entire feature set.
To your ISP, incognito changes nothing. Every domain you visit still resolves through their DNS, and every connection still flows through their network with destination IPs visible. To the site itself, you still arrive with a real IP address, a device fingerprint, and whatever tracking scripts they run — a fresh session isn’t an anonymous one.
What Your ISP Can Actually See
Even on HTTPS sites, your ISP sees:
- The domain you connect to (via DNS queries and TLS SNI — the hostname is sent in plaintext during the handshake unless encrypted ClientHello is in play)
- Traffic volume and timing — enough to fingerprint that you’re streaming video and roughly how long
- Not the specific pages or content inside the encrypted stream
Encrypted DNS (DoH/DoT) shrinks the first item — queries bypass the ISP’s resolvers. Pair it with a browser supporting ECH and the visible-metadata footprint shrinks further, though IP-based traffic analysis never fully disappears.
The Threat-Model Shortcut
The useful question isn’t “is this private?” — it’s “private from whom?”
- From someone using your device later: incognito is sufficient. Clear downloads too — files in your Downloads folder don’t care about browser mode.
- From your ISP / network admin / a shared router’s logs: you need a VPN or at minimum encrypted DNS. Note that a VPN shifts trust to the VPN provider rather than eliminating it — pick one with an audited no-logs policy, not a free one monetizing your traffic.
- From the site’s own analytics: nothing client-side fully hides you; tracker-blocking browsers (Brave, hardened Firefox) reduce profiling, but your IP is always visible to the server you’re requesting video from.
We’ve documented the leak paths we actually measured — including which browsers leak DNS outside the VPN tunnel — at Sextube Metrics privacy notes.
Bottom Line
Incognito is a housekeeping tool, not a privacy tool. Match the layer to the threat: local history → incognito; network observers → VPN; site-side tracking → tracker blocking. Most people need the first and none of the drama — just don’t expect the housekeeping tool to do the heavy jobs.