An exposed browsing history can betray personal circumstances, and work queries can give away business plans. To limit household members' access to data on the device, use screen lock and private windows. Monitoring on the network is a separate task: a VPN can hide from the local network the sites whose connections pass inside the tunnel, but it does not by itself cover every connection and does not protect against monitoring of a work computer. HTTPS, DNS over HTTPS and ECH already limit other means of observation.
Determine who can see your activity
Browser history and network observation are separate layers. Deleting visits on your computer does not remove anything an organisation or a network owner may observe about the connections themselves.
| Who is watching | Where information may be left | What to do |
|---|---|---|
| Family members with access to the device | History, downloads, open accounts | Screen lock, private windows |
| Owner of the home Wi-Fi | The traffic crossing the network | Use a VPN for the traffic you need |
| Corporate network administrator | Network traffic, including DNS requests | For personal tasks, use your own device and mobile network |
| Employer controlling the computer | Browser data and any monitoring tools | Do not use a work device for private matters |
DNS translates a website's name into a server address. What a network actually records depends on its configuration: browsers' own warnings note that organisations and network owners can observe activity, but the exact capabilities of any particular network need to be checked separately.
Restrict access to history on the device itself
Lock the screen whenever you step away from the computer. For a temporary session, open "New Incognito window" from the Chrome menu. According to Chrome's help pages, after you close all incognito windows, the browser does not keep the history of that session or its site data. Bookmarks and downloaded files remain. Firefox's private windows work under a similar limitation: end the session by closing the last private window.
Enlarge image
Bear in mind that searches performed whilst signed into an account can be saved by the search service even from a private window; manage such activity in the account's own settings.
An example scenario: you are searching for a gift on the family laptop. A private window removes the visits from local history after closing, but the downloaded receipt stays in the downloads folder. Check it and sign out of the shop before handing over the computer.
Limit observation from the network side
To limit which sites the local network can see, route the traffic you need through a VPN. HTTPS continues to protect the content of the connection. For a detailed comparison of the tools and the limits of protection, see the overview of who can see the sites you visit.
In Firefox, DNS over HTTPS can be disabled by organisational policies or fall back to the system DNS. Check the state of the protection, not just the selected setting. ECH technology additionally hides the site's name at the start of a protected connection, if the browser and the server support it. It does not work for all connections.
A VPN changes the route: the local network sees a connection to the VPN server, while the further destinations of traffic inside the tunnel are hidden from it. The fact of connection, timing and volume of transfer remain observable. As the EFF explains, trust shifts to the VPN operator; account logins and tracking by websites persist. For a personal device on a home network, I recommend CitadelVPN, after first reviewing its privacy policy. In the version dated 29.07.2026, the operator undertakes not to store browsing history, traffic content, DNS queries, original and egress IPs and connection timestamps. At the same time, it processes email, information about account status, term and limits, remaining traffic, payment confirmations and support requests. These are the operator's terms, not the conclusion of an independent audit: consider which data you are willing to place in its hands.
At work, separate personal and work-related activities
On a work laptop, monitoring capabilities depend on the company's configuration: the organisation controls the device and may use monitoring tools, and incognito mode does not disable them. The reliable rule is not to use a work device for private matters.
For personal browsing, use your own phone over the mobile network and turn off the work Wi-Fi. Keep in mind that your own phone may remain under the organisation's device management: if it is enrolled in a corporate management system, the observation capabilities depend on its settings. Keep work documents in the services approved by the company.
Additional questions
How can I limit an app's access to my precise location?
Check the app's permission to access geolocation and disable it if it is not needed for your task. Changing the network route via a VPN does not hide the coordinates an app obtains through GPS.
Does a VPN protect against a malicious file downloaded on a shared computer?
No, a VPN is not an antivirus. Do not consider a connection through a tunnel as confirmation that a file is safe; keep your system and applications up to date.
What to check before your next session
Protection depends on the observer: limit family members' access to the device, and against network observation use a VPN and verify that its DNS protection actually covers the browser you need.
- Close all private windows, and check your downloads.
- Check the DNS side of the browser's connection: run a DNS leak test whilst the VPN is on and compare the resolvers shown with your VPN provider's. A successful result confirms only that the tested DNS queries go through the expected resolvers — it does not prove that the rest of the browser's traffic passes through the tunnel. A third-party resolver is not always a leak: it can also result from intentional DNS over HTTPS.
- Do not consider a change of visible IP address proof that all applications and DNS requests are protected: such a check covers only the browser or tool you tested.
Set up the VPN on your own device and check DNS for the browser you need using the instructions above. This check relates to the network connection; household members' access to local history still needs to be restricted via device settings.