How to start an incognito web session?

In short, probably not.

There is no default option for this in the documentation (as I'm sure you're aware). Without a change to the internals of the function, this probably only leaves you with the option of running e.g. Javascript code via WebExecute[]; however, this doesn't seem like it will be fruitful based on discussion in How to open a page in incognito mode from HTML?.

Javascript test

WebExecute["OpenPage" -> "https://www.wolfram.com"]
WebExecute["JavascriptExecute" -> "window.open('https://www.wolframalpha.com', '_blank')"]

Success["OpenPage", 
Association[
 "MessageTemplate" :> "Page `page` opened successfully.", 
  "MessageParameters" -> Association[
   "page" -> "https://www.wolfram.com"]]]

WebExecute["JavascriptExecute" -> "windows.create()"]

Failure["InvalidInput", 
Association[
 "MessageTemplate" -> "`command` failed.", 
  "MessageParameters" -> Association[
   "command" -> "JavascriptExecute"], "Element" -> "windows.create()"]
 ]

Additional Comments

With an internal change to the function, Chrome could probably be opened in incognito mode easily via chrome -incognito, but that may introduce unexpected behavior (i.e. it may not be a quick addition to StartWebSession[] functionality). If you wish to make a feature request, I suggest you contact Wolfram Support per the guidelines on meta and cite this question.

The simple workaround is to tweak to WebUnit`Private`setsession by adding the --incognito arg:

setsession[Pattern[sessionInfo, Blank[]], "Chrome", {Rule[Visible, True]}] := post[
    sessionInfo, "/session", {
        "desiredCapabilities" -> {
            "browserName" -> "chrome",
            "chromeOptions" -> {"args" -> {"--incognito"}} (* <= fix *)
       }
    }, {"sessionId", "value"}
]