Browser Privacy Basics: Who Can See What You Browse

Browser privacy discussions usually collapse into a single vague question — "is this private?" — which cannot be answered. Private from whom? Different parties see different things, and different tools address different parties.

Here is who is actually watching, and what each one can see.

1. The website you visit

Sees the most, unavoidably. It has to, in order to serve you the page:

• Your IP address, which gives approximate location.
• Your browser and operating system, via the user agent.
• Screen size, language, time zone.
• Which pages you viewed and for how long.
• Anything you type into it.
• Who you are, if you are signed in.

No browser setting hides you from the site you are deliberately loading. Incognito does not. A different browser does not. This is the foundational point that most confusion comes from.

2. Third-party trackers embedded in that site

The more interesting category. Most pages load resources from other companies — analytics, ad networks, social buttons, fonts, embedded video.

Each of those gets told which page you are on. When the same tracker appears across thousands of sites, it can assemble a picture of your browsing across all of them. That is the mechanism behind ads that follow you around.

This is the part actually worth defending against, because it is the one collecting data across contexts you never connected.

3. Your internet service provider

With HTTPS — which is now nearly everything — your ISP sees:

• Which domains you connect to.
• When, and roughly how much data moved.

It does not see:

• Which specific pages within a site.
• The content of pages.
• Anything you type.

So your ISP knows you visited a news site, not which articles. Depending on jurisdiction, that record may be retained and may be accessible to authorities.

4. Your network operator

On workplace, school or public Wi-Fi, the network operator sees roughly what an ISP sees. Managed devices with an installed certificate can potentially see considerably more — that is the point of corporate device management.

5. Your browser and your device

Your browser stores history, cookies, cached files and autofill data locally. Anyone with access to your unlocked device can read it.

This is the only party that incognito mode addresses. It is a local-records feature, not a network feature.

What each tool actually does

HTTPS

Encrypts traffic between your device and the site. Stops your ISP and network from reading content. Does nothing about the site itself or its trackers. Now the default nearly everywhere.

Incognito / private mode

Stops the browser recording that session on your device. Nothing more. Covered in detail in what incognito mode actually does.

Tracker blocking

Prevents third-party trackers loading, which addresses category 2 — the most valuable single measure. Note that not every browser does this, and you should not assume one does without checking. The Sqrl Browser listing does not describe tracker blocking, so pages generally load with their analytics and advertising intact.

A VPN

Hides your traffic and destinations from your ISP and local network, and hides your real IP from sites. It does not stop trackers, cookies or fingerprinting, and it moves your trust from your ISP to the VPN provider — which may or may not be an improvement.

Clearing cookies

Breaks tracking continuity. Effective, and mildly annoying because it signs you out of things.

Matching the tool to the concern

• Someone using my device — incognito, clear history, a device passcode.
• Advertisers profiling me across sites — tracker blocking, clear cookies regularly, turn off ad tracking in iOS settings.
• My ISP or network seeing destinations — a VPN, from a provider you have reason to trust.
• The site itself knowing what I did there — nothing helps. Do not sign in, or do not visit.

Worth doing on an iPhone

1. Settings › Privacy & Security › Tracking — turn off Allow Apps to Request to Track.
2. Clear cookies periodically in whichever browser you use.
3. Use incognito for sessions you do not want recorded on the device.
4. Review site permissions — see how to manage browser permissions.
5. Assume anything typed into a site is known to that site. That assumption is always correct.