There are many finger-printing and tracking methods of which cookies is but one. A couple of them can effectively “break” the private/incognito barrier (perhaps with less accuracy and/or precision, but given enough data-points discrepancies can be averaged out).