Tech Experts

Private browsing stops your browser from writing session history to local storage. That’s the entire feature. Your internet provider still logs every domain you visit. The sites you visit still record your IP address, device fingerprint, and session behavior. Cross-site advertising trackers still build a profile of you in real time, incognito window or not.

The deeper issue is what’s being collected. Companies increasingly care less about your name than about your typing rhythm, scroll speed, and the two-second hesitation before you click something — behavioral data that’s more predictive, and more valuable, than a static identity record. Incognito mode does nothing to stop any of it.

Most people use one primary email address for their bank, their healthcare portal, their social accounts, and their shopping. Experts call this the “master key” problem, and treat it as one of the highest-leverage weaknesses a person can have — because if that inbox is compromised, an attacker doesn’t just get one account. They can trigger password resets across every service that trusts that address as proof of identity.

This matters more in 2026 because AI-written phishing is personalized at scale, pulling details from LinkedIn, Instagram, and public records to produce a message that reads like it genuinely came from your bank. Peer-reviewed research on fully AI-automated spear-phishing found it converts on par with attacks written by skilled humans — 54% click-through in both cases, against a 12% baseline for generic phishing — without a human writing each one.

This isn’t a new observation, but generative AI has changed its scale. Years of accumulated searches, clicks, watch time, and location history are now raw training material for models built to predict — and nudge — future behavior.

Experts apply a simple filter: assume the exchange is happening, and spend thirty seconds figuring out which data and with what safeguards — instead of assuming a privacy policy nobody reads has already answered the question.

Security researchers monitoring breach data absorbed roughly 23 billion stealer-log records, including 1.3 billion previously-unseen unique passwords, into public databases in late 2025 alone. Separately, Specops’ 2026 Breached Password Report analyzed more than 6 billion passwords stolen by malware in 2025 — six times what it found the year before. Microsoft’s Digital Defense Report puts the scale in blunt terms: more than 97% of identity attacks in 2025 were password attacks, and identity-based attacks surged 32% in the first half of the year. Verizon’s most recent Data Breach Investigations Report found stolen or compromised credentials were the initial access point in 22% of confirmed breaches, and involved in 88% of attacks against basic web applications specifically.

This is the blind spot most people haven’t confronted yet, and it’s also the one with the most severe individual downside. The FBI’s Internet Crime Complaint Center dedicated a standalone section to AI-related fraud for the first time in its 25-year history in the 2025 annual report: 22,364 complaints and $893 million in adjusted losses, a figure the Bureau itself calls conservative, since AI is only counted when a victim recognizes and reports it. Within that total, investment fraud accounted for $632 million, business email compromise with a confirmed AI component for $30 million, and romance and confidence scams for $19 million.

McAfee’s testing found a convincing voice clone needs as little as three seconds of source audio to hit around 85% accuracy, rising to 95% with more training data. In its global survey of 7,000 people, roughly one in four had experienced an AI voice-cloning scam personally or knew someone who had, and among people who received a message from a clone, 77% lost real money, not just time. On the enterprise side, Gartner’s September 2025 survey of 302 cybersecurity leaders found 62% of organizations had experienced at least one deepfake-enabled attack in the prior twelve months — 43% involving audio calls, 37% involving video. The clearest documented individual case remains the engineering firm Arup, whose Hong Kong finance team wired $25.6 million after a video call in which every other participant — including the person appearing to be the CFO — was a deepfake.

Default app permissions, default browser tracking behavior, and default cloud-backup settings are shipped by companies whose business often depends, at least partly, on data collection. Experts audit their defaults on a fixed schedule instead of accepting them once at setup and forgetting about them. The highest-impact changes take about five minutes combined and require no technical background:

• Revoke microphone and location access from apps that don’t functionally need it
• Switch to an encrypted DNS resolver to stop your provider from logging every site you query
• Turn off ad personalization at the operating-system level, on both mobile platforms
• Enable link-tracking protection, now built into modern browsers by default
• Review which apps hold access to your contacts — that graph is rarely necessary and highly valuable to lose

As AI systems fold themselves into search, email drafting, and customer service, many people treat their output as settled fact. Experts treat it differently: these systems are trained on historical data, can be shaped toward outcomes their operators prefer, and don’t reliably distinguish between what’s true and what’s simply stated often. Verizon’s own 2025 breach data adds a workplace angle worth knowing personally too: among employees using generative AI tools on personal or corporate devices, 72% accessed them through personal accounts rather than authenticated, monitored ones — a habit that quietly moves sensitive data outside any organization’s visibility, and the same habit shows up in personal use.