Online Privacy: Separating the Myths from the Reality

Private or incognito browsing is a local privacy tool. It stops your browser from storing cookies, form data, and history on your device after the session ends. But every website you visit still logs your IP address, and your ISP still sees which domains you connect to. If you're using a work or school network, administrators may also have full visibility into your traffic. Incognito is useful for keeping searches off a shared device — it is not a cloak of anonymity on the internet.

The 'nothing to hide' argument conflates privacy with secrecy. In practice, your browsing habits, location history, purchasing patterns, and health searches are routinely collected, packaged into profiles, and sold to third parties. This data can be used to manipulate purchasing decisions, influence what content you see, or — in the event of a breach — expose you to identity theft. Privacy is a safeguard against misuse of your information, not a cover for bad behavior. For a look at how social platforms specifically handle your data, see how social media privacy settings actually work.

Data breaches expose billions of passwords each year. Even a complex, unique password can end up in a criminal's hands through no fault of your own. Two-factor authentication — which requires a second verification step such as a code sent to your phone or generated by an authentication app — means that a stolen password alone cannot unlock your account. Security professionals broadly recommend enabling 2FA on any account that supports it, particularly email, banking, and social media accounts.

Operating large-scale digital services is expensive. When there's no subscription fee, the business model typically involves collecting user data — browsing behavior, location, app usage, demographic information — and using it to serve targeted advertising or selling aggregated data to data brokers and researchers. This isn't universally true of every free service, but it's a common enough practice that reviewing an app's privacy policy before downloading is a reasonable habit. Many privacy policies are long and difficult to parse, but focusing on the sections about data sharing and third-party access can clarify what you're agreeing to.

A Virtual Private Network (VPN) routes your internet traffic through an encrypted tunnel to a server operated by the VPN provider. This means your ISP sees encrypted traffic rather than the sites you visit, and those sites see the VPN server's IP address rather than yours. However, the VPN provider itself can see your traffic, making the trustworthiness of that provider critically important. VPNs also do not prevent websites from tracking you through cookies, browser fingerprinting, or logged-in account activity. They are a useful tool in a broader privacy strategy, but not a standalone solution. For a more detailed breakdown, see our article on what end-to-end encryption actually does and doesn't do.

A shared Wi-Fi password — the kind posted on a coffee shop chalkboard — grants entry to the network but does not create a private, encrypted channel between you and the router. Other users on the same network may be able to intercept unencrypted traffic, and a rogue hotspot with a convincing name can capture everything you transmit. The risk level depends on what you're doing: logging into sensitive accounts or transmitting personal information on open networks carries meaningfully more risk than casual browsing of HTTPS-secured websites. Learn more in our piece on what you're actually risking on public Wi-Fi.