Ask the Decoder: How private is private browsing, really?

Editor's Note: This is the second installment of The Decoder, a column that's part of the Living with Data series exploring how our online data is tracked, collected and used. Do you have questions about how your personal data is being used? Curious to learn more about your daily encounters with algorithms? Email The Decoder at thedecoder@aljazeera.net or submit your question via the form here. Screen shots and links are helpful clues!

My close friend Jen and I were working together one day this summer. (Actually, it was an excuse to hang out with her new puppy all day.) Taking a break, she opened Facebook in a new tab. She turned her laptop toward me, freaked out that all the ads she saw were for either specific items she had looked at or websites she recently visited. She was being bombarded by retargeted ads similar to ones we explored last week.

But the surprising thing for Jen wasn’t the ads themselves but that they were showing up while browsing in incognito mode in Chrome. She didn’t expect to see that kind of personalization while browsing in what she thought was a private setting, deleting her browsing history along the way.

We wondered, how private is private browsing, really? She recounted the incident:

I followed up with Jen and she explained that she uses private browsing all the time on her work computer because it feels safer to automatically get rid of cookies and browsing history. Months later, she’s still using it, even though she’s not sure it’s doing much to control what is collected from her browsing.

Jen was surprised by the retargeted ads because she knew they were based on cookies and history, but she thought she wasn’t leaving those trails behind her. Upon further inspection she realized that cookies are deleted only after she closes out all the incognito windows. Like a lot of us, Jen doesn’t often shut down her computer completely, and she keeps a few regular tabs open most of the time. It seems like incognito mode wasn’t really designed to protect that kind of browsing behavior.

The real disconnect for Jen was that private browsing mode clears your browsing history only from your local machine, whether its your computer or your phone. Not from anywhere else.

All the major browsers have some form of private browsing: Chrome, Firefox, Safari, Internet Explorer and Opera.

Here’s how Google describes the incognito browsing function: “If you don’t want Google Chrome to save a record of what you visit and download, you can browse the Web in incognito mode.” You can use this mode on desktop and mobile Chrome browsers. Google describes incognito mode in cute animated movie as a way to keep surprises (such as an anniversary party) secret from people who share your computer.

But private browsing doesn’t mask your activity from Internet service providers, search engines or websites that you visit. Sites that you go to still receive information about you like location, browser information and IP address. Cookies are still dropped and are cleared only when you close the window. IP addresses detailing the direction of traffic still travel over your Internet service provider’s network. And it doesn’t hide documents you download.

Depending on what information you are trying to protect and from whom, private browsing might not be the right solution.

Browsing with Tor can help mask your IP address, as can using a VPN. The Guardian Project’s Orbot mobile browser uses Tor as well. But Tor works only when enough people are also using it. Alternative search providers like Duck Duck Go compete with Google by promising not to save your searches at all.

Mobile private browsing is especially tricky, suggests Nathan Freitas of the Guardian Project. On our phones, browsing data is stored all in one place and is often shared across apps. It’s difficult to be sure, even after a private browsing session is closed, that other details aren’t discoverable on the device. Mobile privacy is starting to get better, with iOS 8 allowing users to choose Duck Duck Go as their default search engine.

There are plenty of reasons you might want to keep your browsing from others. Maybe you’re looking for birthday gifts. Maybe you just want to window-shop in peace without socks stalking you. Maybe you want to entertain your hypochondriac WebMD searches without worrying about future embarrassment or contributing to flu trends research. Maybe you are using it for the most obvious unmentionable, porn. Or maybe you are an activist in a war-torn country at risk of physical harm.

No matter what you are trying to do, it’s important to know what “private” really means in private browsing.

Do you have questions about how your personal data is being used? Curious to learn more about your daily encounters with algorithms? Email The Decoder at thedecoder@aljazeera.net or submit your question via the form here. Screen shots and links are helpful clues!