Private mode is about hiding a trail from yourself rather than the websites you visit. They still get all your request logs.
My own experiments with GL and the timing-based methods is that they just don’t work well (compared to say, cookies) when delivered via an advertisement. Plugins and fonts work very poorly as well, lately.
I don’t think anyone is using these methods to target advertising, and state-level actors don’t have to (they just bug your ISP).
Who are you trying to protect against?