You can see the script they currently use to detect incognito in different browsers + rules they use to allow browsers even if they haven't logged in (e.g. social browsers and their apps)

https://gist.github.com/jeroenvisser101/9f8119cfa91371dd6e1a...

Source: nytimes.com's sourcemaps