Last checked: October 15, 2026.
We make Incognito Browser, an Android web browser.
How we know: measured by our own scanner. On October 15, 2026, it requested the home pages of 500 popular sites, and 467 answered with a usable page. The same day we checked our own home page with the same settings. What we say about Brave and Firefox comes from their makers’ pages and their Google Play listings (see Sources).
A website’s first reply can set cookies, and its HTML names the advertising and analytics code the page uses. We counted both on the 467 popular sites that answered, and we name none.
What the scanner did
- One request per site, home page only. It followed redirects and read the reply that delivered the page.
- It ran once, on October 15, 2026 (UTC), from one computer on one connection.
- It identified itself as desktop Chrome on a Mac, clicked no consent banner and did not sign in.
- It did not run JavaScript.
- It matched the whole HTML of each page against 89 named signatures. 41 are advertising or social-media code, 43 are analytics or marketing tools, and 5 are functional, such as bot checks and error reporting. Below, “advertising” includes the social-media code.
- It tried all 500 sites on our list. 33 sent no usable page: the connection failed or timed out, or the reply was an error or not HTML. Every figure below comes from the 467 that answered.
What these numbers cannot show
- The real cookie and signature figures are higher. Pages fetch more code by script after the first reply, and we ran no scripts. Cookies set during a redirect are missed.
- A signature is a mention, not proof. It shows the HTML refers to that code, not that it ran or what it sent. Some matches are loose: the bot-check signature matches the word “recaptcha” anywhere in the page.
- “Popular” depends on the list. Our notes say we drew up the list of 500 in September 2026, starting from Tranco, a research ranking of popular sites, and filtering out network and ad-industry names. The Tranco list date and the exact filter were not recorded, and the filter was not complete. Many of the 500 are company and developer sites. The 33 with no usable page are missing, and at least 9 of the 467 answered with a sign-in, age-check or bot-check page.
- One day, one connection, one desktop browser. A phone, another country or another day may get a different page.
- No breakdown by type of site. Our scanner files most of these sites under “General”, so its categories are too rough to report.
What the first reply contained
| In the first reply | Sites out of 467 | Share |
|---|---|---|
| Final address used HTTPS | 467 | 100.0% |
| HSTS header | 330 | 70.7% |
| Content-Security-Policy header | 235 | 50.3% |
| Permissions-Policy header | 64 | 13.7% |
| Any cookie set | 279 | 59.7% |
| Any advertising signature | 115 | 24.6% |
| Any analytics signature | 278 | 59.5% |
| Advertising or analytics signature | 308 | 66.0% |
| Functional signatures only | 22 | 4.7% |
| No signature from our list | 137 | 29.3% |
Basic protections
HSTS tells a browser to use HTTPS on later visits. A Content-Security-Policy restricts what code on a page may do. A Permissions-Policy allows or denies browser features such as the camera. 46 of 467 sites (9.9%) sent all three headers and 94 (20.1%) sent none. We checked only that each header was present.
Cookies
279 of 467 sites (59.7%) set at least one cookie, 922 in all. Not every cookie is a tracker. Our scanner knew 244 of the 922 (26.5%) by name: 231 were security, bot-check, load-balancer or session cookies and 13 had advertising or analytics names. We cannot say what the other 678 are for.
Advertising and analytics code
The most common signature was Google Analytics or Google Tag Manager, which our scanner counts together: 193 of 467 sites (41.3%). By the names on our list, the two most common advertising signatures were Google DoubleClick on 70 of 467 (15.0%) and Google AdSense on 29 (6.2%).
Functional tools are counted apart: the reCAPTCHA bot check matched on 83 of 467 sites (17.8%) and Sentry error reporting on 10 (2.1%).
Our own home page
Our site is not one of the 500. On October 15, 2026, a check of incognitobrowser.io with the same settings found HTTPS, none of the three headers, no cookie on the first reply and a Google Analytics or Tag Manager signature.
What you can do
The free Incognito Browser app has a built-in ad blocker. If you want trackers blocked, another browser that blocks them by default is the better choice: Brave and Firefox are free to install on Android, and both say they block trackers by default. We tested no browser against these pages, ours included. Our app’s Google Play Data safety section says it may collect crash logs, diagnostics and other app performance data, for analytics.
Sources
Brave’s and Firefox’s pages were re-read on October 15, 2026. The other outside pages were read on October 6, 2026.
- Our scan records of October 15, 2026, and our check of our own home page the same day.
- Tranco: https://tranco-list.eu/
- MDN Web Docs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security , https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP , https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
- Tool makers’ pages: https://marketingplatform.google.com/about/analytics/ , https://marketingplatform.google.com/about/tag-manager/ , https://policies.google.com/technologies/ads , https://adsense.google.com/start/ , https://cloud.google.com/security/products/recaptcha , https://sentry.io/welcome/
- Brave: https://brave.com/shields/ , https://play.google.com/store/apps/details?id=com.brave.browser
- Firefox: https://www.firefox.com/en-US/download/android/ , https://play.google.com/store/apps/details?id=org.mozilla.firefox
- Our app’s Data safety section: https://play.google.com/store/apps/datasafety?id=com.androidbull.incognito.browser
David Shadrake works on Incognito Browser’s website and its free privacy tools.
