Online Privacy Myths That Most People Still Believe

The name "incognito" suggests invisibility, but the feature was designed for a much narrower purpose: stopping your browser from storing a record of visited sites, cookies, and form data on your device. That matters if you share a computer, but it does nothing about the network traffic leaving your home or office.

Your internet service provider (ISP) — the company that delivers your internet connection — can still log the sites you visit. So can network administrators on workplace or school Wi-Fi. The websites themselves receive your IP address (a numeric label identifying your connection) and can profile your session just as they would a regular visit. For a fuller comparison of what incognito and VPNs each actually do, see what private browsing can't do.

Public Wi-Fi at coffee shops, airports, and hotels is often unencrypted or weakly encrypted at the network level. When a network lacks strong encryption, a person on the same network using freely available tools can potentially capture data passing through it — a technique known as a man-in-the-middle attack.

The speed of your task is irrelevant to this risk. Logging into your email account takes seconds, but the credentials you submit travel across that shared network just the same. Sites using HTTPS (the padlock icon in your browser's address bar) do encrypt data between your browser and the website, which reduces — but does not eliminate — exposure. For a practical breakdown of what specifically can go wrong, see what public Wi-Fi risks look like in practice.

Data breaches at companies — where attackers access stored user credentials — happen regularly across industries. When that occurs, the strength of your individual password matters far less than the protective measures the company had in place. If your email and password combination leaks from one service, attackers will try it on others, a tactic called credential stuffing.

Two-factor authentication (2FA) addresses this gap by requiring a second verification step — typically a time-sensitive code sent to your phone or generated by an app — in addition to your password. Even if your password is compromised, an attacker without access to your second factor cannot log in. Enabling 2FA on email accounts is particularly high priority, since email is often used to reset passwords for every other account.

HTTPS (HyperText Transfer Protocol Secure) means your browser and the website are communicating over an encrypted channel — a meaningful protection against eavesdropping on public networks. But the padlock only verifies that the connection is encrypted. It does not verify that the website is honest, well-run, or operated by who it claims to be.

Phishing sites — fake pages designed to steal login credentials — routinely use HTTPS. Scam e-commerce pages do too. The padlock is a floor, not a ceiling. Before submitting payment details or personal information, look for additional trust signals: a verifiable physical address, clear contact information, and an independently confirmed reputation. See also how phishing tactics work for more on how convincing fraudulent sites can appear.

When you use an app, data — including your location history, usage patterns, account information, and in some cases contacts — is frequently transmitted to and stored on the company's servers. Removing the app from your phone or tablet clears the local installation but has no effect on what the company holds remotely.

To request deletion of your stored data, you generally need to use the account deletion or data removal option within the app before uninstalling, or submit a formal request through the company's privacy settings or support channels. Under some US state privacy laws, consumers have the right to request deletion of their personal data — though the scope and enforcement of these rights vary by state. Learn more about how personal data is collected and stored covers the full picture of what gets collected and why.