Why incognito mode cannot hide your browsing from ISPs or employers

Opening a private window can feel like drawing a curtain across your online activity. The browser may stop saving visited pages, search entries, cookies and form data on the device, which is useful when sharing a computer or using a borrowed laptop. That limited privacy is real, but it ends at the browser and the device.

Your internet service provider, workplace network, employer-managed laptop or monitoring software can still observe activity outside that private window. Incognito mode does not create an encrypted tunnel, change your network identity or override administrative controls. For Australians using the NBN at home, office Wi-Fi in Sydney or Melbourne, or public internet while travelling, the distinction matters.

What private browsing actually changes

Incognito mode, called InPrivate in Microsoft Edge and private browsing in some other browsers, mainly changes local storage. When the window is closed, the browser generally removes the session history, temporary cookies and data entered into forms. It may also prevent ordinary cookies from carrying over from your regular browsing session.

This is useful for separating sessions. A person using a shared family computer in Brisbane, for example, may avoid leaving a visible trail of shopping searches or account pages in the browser history. It can also reduce the persistence of advertising cookies on that particular device. It does not make the activity anonymous to websites, network operators or the owners of the computer.

Private browsing does not conceal your IP address. Websites can still see connection details, identify accounts when you sign in, and use fingerprinting or other signals to distinguish a browser. A private window also does not stop a website from collecting information under its own privacy policy. If you log into Google, Facebook, an employer portal or a bank, the service knows who is using the session.

What your ISP can still see

Your ISP carries your connection between your home, mobile device and the wider internet. It can usually see the destination IP addresses you connect to, the timing and volume of traffic, and often the domain names requested through DNS. Even when a website uses HTTPS, that encryption generally hides the page contents and specific URL path rather than the existence of the connection.

For example, HTTPS may prevent an ISP from reading the text of an article or the details of a form. It may still reveal that your connection reached a particular news organisation, streaming platform or online retailer. Traffic patterns can also disclose useful information: a large download, a video stream, repeated connections to a service, or activity taking place at a particular time.

DNS encryption can reduce the visibility of domain lookups, while newer protocols can conceal more connection information in some circumstances. These measures do not make the ISP blind. The provider still transports the traffic and may see IP addresses, timing and data volumes. Australian telecommunications providers also operate within laws governing assistance, interception and retained telecommunications metadata, subject to the relevant legal rules and safeguards.

Public networks introduce another observer. An airport or hotel operator may log devices, access times and destinations, while the airline Wi-Fi system can associate a session with a payment record or seat. The privacy implications of that setting are explored in this account of an airline Wi-Fi data trail, where convenience and visibility sit close together.

Why employers have a broader view

An employer may monitor activity at several layers. A workplace firewall or secure web gateway can record DNS requests, domains, connection times and blocked attempts. If a company controls the Wi-Fi, it can link traffic to a device, user account or network login. Incognito mode changes none of those records.

Company computers can go further. Device management tools, endpoint security products, antivirus systems and remote support software may record processes, browser events, screenshots, file transfers or security alerts. Some organisations install a trusted certificate that allows encrypted web traffic to be inspected through TLS interception. In that arrangement, the company device may trust the employer’s monitoring system as if it were a legitimate inspection point.

Browser privacy features cannot disable software running outside the browser. A logging agent can capture activity before it is encrypted or after it is decrypted. A web filter can block a category of site even when the browser is in private mode. An administrator may also prevent extensions, alter DNS settings or route all traffic through a corporate proxy.

The line between work and personal use becomes especially important with remote work. Someone in Perth using a company laptop on a home NBN connection may assume that the home router is the main source of monitoring. The employer’s endpoint controls can remain active regardless of whether the device is connected to office Wi-Fi, a home network or a phone hotspot.

Australian workplace and privacy context

Australian privacy law does not create a universal right to browse privately at work. The Privacy Act 1988 and the Australian Privacy Principles can apply to many organisations, though coverage and exemptions matter. The employee records exemption has historically limited how the federal privacy framework applies to certain employee information handled by private-sector employers. State and territory rules can add another layer.

Workplace surveillance is also regulated differently across jurisdictions. New South Wales has specific requirements under the Workplace Surveillance Act 2005, including rules concerning computer surveillance and notice. Other states and territories may approach monitoring through workplace, employment, telecommunications or privacy legislation rather than one identical statute. A policy hidden in a lengthy handbook is not necessarily the whole legal analysis, but written notice and a legitimate business purpose are significant practical considerations.

The Australian setting includes ordinary situations where these questions arise: a personal email checked on an office laptop in Melbourne, a job application opened from a managed browser in Adelaide, or a staff member streaming music over a company network in Canberra. Whether monitoring is lawful or proportionate depends on the employer, the technology, the notice given, the workplace location and the information collected.

Employers also have genuine security reasons to inspect some activity. They may need to detect malware, stop data theft, investigate a compromised account or protect confidential customer records. That purpose does not turn every form of surveillance into a harmless practice. It does mean that privacy expectations should be assessed against the device, network, account and workplace policy involved.

What a VPN changes and what it cannot solve

A reputable VPN encrypts traffic between the device and the VPN server. The local ISP may then see a connection to the VPN rather than each destination, while the workplace network may lose visibility of ordinary domain requests and direct site connections. The VPN provider becomes a new party able to observe connection metadata and, depending on its design, retain logs.

A VPN is therefore a change in trust, not an invisibility cloak. It cannot prevent a website from recognising an account, stop cookies stored by the browser, or erase activity captured by employer software on a managed laptop. A company may also block or inspect VPN traffic, require its own corporate VPN, or treat unauthorised tunnelling as a policy violation.

VPN performance and jurisdiction matter too. A free service may finance itself through advertising, data collection or weak security. A commercial provider may have a more credible policy, yet users still need to trust its infrastructure and legal environment. Streaming services, banking systems and corporate platforms may flag shared VPN addresses, causing extra verification or access problems.

The same principle appears in other forms of digital compartmentalisation. Batching online tasks while moving between countries, as described in this content batching method, can organise activity and reduce repeated exposure on public networks, but it does not replace encryption or alter who controls the connection.

Better privacy habits for everyday browsing

Start by matching the tool to the threat. Use private browsing to keep local history and cookies from lingering on a shared device. Use HTTPS to protect content in transit. Use a trusted VPN when the concern is the local network or ISP, while recognising that the VPN operator becomes part of the trust chain. Use Tor when stronger anonymity is necessary and the associated speed, compatibility and account-verification limits are acceptable.

For work, the simplest boundary is often the most reliable: use a personal device and personal connection for personal activity. Do not assume that a phone hotspot makes a company laptop private, because endpoint monitoring remains on the laptop. Likewise, do not assume that a personal laptop on office Wi-Fi is outside workplace visibility. The network owner can still record traffic even when the device belongs to you.

Review browser permissions, remove unnecessary extensions, and keep operating systems updated. Encrypted DNS can limit casual DNS observation, while tracker protection can reduce some forms of commercial profiling. Separate browser profiles can help keep work and personal accounts apart, although profiles are an organisational measure rather than a shield against administrators.

Avoid using private mode as a substitute for reading policies. A work computer, a university network, a hotel login page and an airport access portal may all have different terms. Even a seemingly harmless activity, such as researching sensitive health information or gambling services, can create records through accounts, payment systems and network logs. A browser setting cannot delete those records. For a different perspective on how apparently specialised online behaviour can leave traces, these observations about blackjack card counting illustrate how context and activity patterns can matter beyond a single browser window.

The limits of deleting a digital trail

Closing an incognito window removes selected information from the browser’s local history, but it does not reach every place where data may exist. A website may keep server logs. An ISP may retain operational records. A workplace may store proxy logs in a security platform. A cloud account may preserve activity, and a payment provider may connect a transaction to the person who made it.

Even on a personal computer, other records can remain. The operating system may retain network information, security software may generate alerts, and a router may keep connection logs. These records are often incomplete and may not identify the precise page viewed, yet they show why “nothing was saved” is too broad a claim.

Privacy is better understood as control over exposure than as a single switch. The relevant questions are who owns the device, who operates the network, who controls the account, what encryption protects the connection, and what records each party is allowed or able to keep. Essays and commentary collected in these privacy essays explore that wider relationship between technology, power and everyday behaviour.

Incognito mode remains useful for its narrow purpose: reducing traces left on the device in front of you. It does not hide activity from an ISP, an employer, a website or monitoring software. The point to remember is simple: private browsing changes local browser storage, while genuine network privacy depends on the device, connection, encryption and organisations that sit around it.