Incognito is not a secure way to browse. I don't know why people think this.
Tor is probably what most people should use if they are concerned about being spied on. And I'm pretty sure tor isn't as secure as it's made out to be.
Also google is an advertising company. If you don't want to be sold to an advertising company don't use google. Mozilla is in advertising too but at least firefox lets you disable pretty much all the trackers
Tor can be very dangerous if you don't compartmentalize it enough and use the wrong software with it. Its pretty well documented that if you request a normal http page (not https) malicious tor nodes are constantly checking for it so they can attempt to serve you bad shit to steal info. You never really know when your computer on say, a windows machine, will make a bad request. So it becomes imperative to use operating systems and technologies that limit that issue. (Re: use tor only on the tor browser, or use qubes+whonix to compartmentalize potential bad requests).
The most secure 'every day' thing someone can do is use almost any linux distro, mullvad browser (or a normal hardened firefox), and a trusted vpn (proton, mullvad, ivpn, out of these three mullvad is probably the best).
the most secure thing possible (re dont do this its ridiculous for 99.9% of people) is probably a sneaky self-made wireguard vpn entry node + tor + qubes/whonix. and by sneaky wireguard vpn i mean doing stuff and things in order to not pay for an ISP with your vpn server. that means you have pivpn or something setup on a hidden raspberry pi on a network you probably dont have permission to run vpns on.
You should never be on a regular http site though and every browser has a scare page or a red alert icon in the URL space telling you not to. Simply listen to it and don't go there.
Tor with JavaScript disabled is one of the most secure and private tools we have, since it protects against browser fingerprinting.
Don't go to sites without https under any circumstances.