Is Private Browsing Really Private?

To a tech-savvy audience its more obvious that private browsing modes don't offer that.

This discrepancy is something that people have genuine concerns about and want to see either more features to protect their privacy, or better transparency in naming/explaining/disclaiming these modes.

Initially we started this survey out of our own interest so a few of those decisions are rooted from there.

1) Agreed, however we've already divided out the people who previously learned about private browsing. This leaves us with a cohort of users who have used private browsing, thought it protected them more and learned that it was wrong. It's very unlikely in any case that there would be positive emotions experienced. In our background research before the final survey we were only focusing on if users had a positive or negative experience. In this final major survey we wanted to get a better understanding of what those negative emotions were and so teased it out more.

I agree that a skewed set of options can bias a question but it is case-by-case. Example if I ask "how do you feel when your ice cream falls on the floor?" and the options are "Happy, Joyful, Amazing, Wonderful, Excited, Sad" you'll still likely pick sad.

2) A good point. This question is one that is linguistically challenging. We want to use phrases like "it only does X" to stress limits, but those can be misinterpreted. I agree you may see some shift if you ask the question as a feature list, but I think in the question we're looking at it would still fall well within the margin of error. I'm curious to run some tests on it either way!

3) We didn't release those in the whitepaper as they were broken down by browser since each browser has different feature sets. We wanted to keep this report agnostic of browser. We're not looking to shame anyone, we're trying to support the conversation around the education gap for the average non-technical internet user. They are telling us they want more privacy, and don't feel that it is being provided or explained well enough.

Overall, I really appreciate the feedback - it is more important than ever to question and discuss the things we see online. Hope this sheds some light on why we made the various decisions we did! :)

Disabling JS from iffy marketing companies mostly solves the problem. (From a legal standpoint, not a security standpoint). It's illegal under wiretapping rules to share communication with a third party. (but if the user's browser hits a third-party data collection endpoint, that's somehow okay. See 'in re doubleclick'). Firefox tracking protection uses the disconnect.me list https://disconnect.me/trackerprotection/blocked to get rid of all of these it can.

If the adversary isn't a marketing firm that has to comply with the law, ignore the above. Then you're looking at browser flaws (canvas fingerprinting) and session inference (using client IP, URL, browser-agent, & timestamps to reconstruct identity from behavior).