Incognito is not a new computer. A VPN is not a new browser. Websites still read a pile of signals you never click “Allow” for.
What a private window does
Chrome Incognito, Safari Private, Firefox Private: cookies, site storage, and some history die when the window closes. That is useful. It is not a disguise.
The same JavaScript still reports:
- language and timezone
- screen and viewport size
- GPU name
- canvas print
- cores, memory, touch
Those values are properties of this device and this OS. Private mode does not rewrite them.
What a VPN does
A VPN changes the path packets take. The site sees the VPN exit IP instead of your home or phone IP. That is the part people mean by “hide my location.”
It does not change your timezone. A New York VPN with a Warsaw clock is a tell. It does not change your GPU or how this machine draws text. It does not stop the page from reading navigator and screen.
Some browsers leak the real IP through WebRTC unless that is locked down. That is a browser setting, not a VPN brand promise.
What still needs a click
Camera, microphone, and the precise geolocation prompt are not in the automatic dump. Those wait for Allow. Webcam test is that path. Photos are a different leak — GPS lives in the file, not the browser.
Check the live list
What websites know prints the dump this tab can already read. Open it in a normal window, then in a private window, then on a VPN. The IP story changes. The timezone, GPU, and canvas line usually do not.
That list is what websites can see about you without asking. It is not a uniqueness score and not a data-broker lookup.