[geofft]

Not that I disagree with you about whether the average person realizes it, but it's not just a risk because Google has JavaScript trackers on your porn site. Google could just make a deal with the porn site to access their server logs and correlate data that way. The fact that you disclose information to the sites you visit means they may, in turn, disclose information to whomever else.

As a totally non-web example of this, as of 2017, "Google’s third-party partnerships ... capture approximately 70% of credit and debit card transactions in the United States." https://adwords.googleblog.com/2017/05/powering-ads-and-anal...

When you buy something with MasterCard, in person, with a magstripe or even an old-school carbon-copy imprinter, MasterCard can go give that data to Google.

I think the incognito warning could say "Websites you visit, and anyone those sites share data with" to draw attention to this, but I'm not sure if that's quite enough. I'm leaning towards the argument from this article that "incognito" itself is simply a poor name.