Most privacy failures do not come from weak tools. They come from believing a tool does more than it does. These are the assumptions worth unlearning before you rely on any of them.
“Private browsing makes me anonymous”
Verdict: false.
It does not. Private or incognito mode stops your own device from saving history, cookies and form data. Your internet provider, your employer, the network administrator and the websites you visit all still see exactly what you do. It hides activity from other people who use the same device, and nothing more.
“A VPN makes me anonymous”
Verdict: false.
No. A VPN hides your traffic from your internet provider and your address from the sites you visit, but it moves that trust to the VPN company, which can see the same things instead. A no-logs policy is a promise rather than a guarantee, and a provider can be compelled or breached. A VPN is a privacy tool, not an anonymity cloak. Configure a VPN safely covers what it does and does not do in more detail.
“Tor is illegal, or only criminals use it”
Verdict: false in most countries.
Tor is legal in most countries and is used daily by journalists, activists, researchers, law enforcement, businesses and ordinary people who prefer not to be tracked. Criminals also use cars and email. The tool is not the crime.
“Tor makes me completely anonymous and cannot be broken”
Verdict: false.
Tor is strong, but it does not compensate for human error. People are routinely identified through their own behaviour: signing in to a real account, reusing a username, or being the only person using Tor on a small monitored network, which makes them the obvious suspect. The network usually holds. The person slips. How people get caught works through documented cases.
“Adding a VPN on top of Tor makes me more anonymous”
Verdict: usually false.
Usually not, and it can make matters worse. Tor already hides your address from the sites you visit and your destinations from your internet provider. Stacking a VPN on top adds little, shifts some trust to the VPN company, and a misconfiguration can reduce your anonymity.
There is one legitimate case. Your internet provider or network can see that you are using Tor, even though it cannot see what you do. Where that is itself risky, connecting to a VPN before Tor conceals the fact. However, the tool built for exactly that purpose is Tor bridges, which are included in Tor Browser and are usually the better choice. Running a VPN after Tor breaks the design and should be avoided.
“The padlock means I am private”
Verdict: false.
HTTPS encrypts the contents of a page in transit, so nobody can read the data in flight. It does not hide which sites you visit, does not make you anonymous to the site itself, and, unless you have enabled encrypted DNS, does not conceal your lookups. Encryption in transit is not anonymity.
“I cleared my cookies, so I am not being tracked”
Verdict: false.
Cookies are only one tracking method. Browser fingerprinting identifies you from your device’s particular combination of settings, fonts, screen size and hardware, with no cookie required, and your address and the site’s own server records persist regardless. Clearing cookies is hygiene, not invisibility. You can see what your own browser reveals.
“A new email alias makes me anonymous”
Verdict: false.
An alias protects your real inbox from spam and breaches, but it forwards to that inbox, so the alias provider knows the connection. Aliases reduce exposure; they do not create a new identity. True separation needs a fresh mailbox that was never connected to you. Set up anonymous email and payments covers the difference.
“Privacy tools are slow and only for technical people”
Verdict: mostly false.
The basics are quick and free. A tracker-blocking browser, encrypted DNS and a reputable VPN take minutes to set up and barely affect speed. Heavier arrangements exist for people at genuine risk, but everyday privacy is straightforward, and most of the friction people imagine is not real.
“A platform’s privacy setting protects my privacy”
Verdict: only partly true.
It protects you from other users seeing your data. It does not protect you from the platform, which still collects it. A private account and privacy from the company are entirely different things.
“I have nothing to hide, so privacy does not matter”
Verdict: privacy is about control, not secrecy.
Privacy is not secrecy. It is control over who knows what about you. You close the bathroom door without having anything to hide. Curtains, envelopes and PINs are not confessions of wrongdoing; they are sensible defaults. Privacy online is the same idea.
The thread running through all of these
Every myth above shares one root error: assuming that a single tool covers a problem it only partly touches. Real privacy comes from layering the right tools and building the habits around them, which is why Browse the web anonymously starts with your threat model and spends as much time on behaviour as on software.
Sources and further reading
- EFF: Surveillance Self-Defense (opens in a new tab)
- Tor Project: am I totally anonymous if I use Tor? (opens in a new tab)
- Tor Project: bridges (opens in a new tab)
- Mozilla: private browsing does not make you anonymous (opens in a new tab)
- EFF: Cover Your Tracks, a browser fingerprinting demonstration (opens in a new tab)
