- My ISP knows all my normal internet traffic, and all the caveats that apply (HTTPS, SNI, IPs, etc)
- My VPN knows a much smaller subset of traffic used for a different purpose. Also, do this in a VM, or on a separate computer, or otherwise somehow containerize your cookies and browser and things. (no, I still don't think people are correlating between profiles using webgl in any large-scale way. If they were, I'd be getting fewer CAPTCHAs.)
Yes, the VPN could presumably violate their privacy statements and sell your information, but that still avoids the primary concern: an ad domain that lives on the two websites you'd like to visit (ie, the normal vs the private site) With a new IP, and a different host (VM, physical computer, etc) there's nothing to correlate. The website in question doesn't know it's you -- only the VPN does. And it doesn't seem likely they're going to sell your information in such a way that the website can figure out which cookie to correlate with which identity.
So, the primary tracking method of the internet should be defeated in this way.
And if IP obfuscation is that important, you'll likely be using TOR, not a VPN (which have proven to be a nearly transparent shield).
That's my plan -- that there is no bridge between the profiles. I'll admit, the likelihood that I'm doing this perfectly is definitely not 100%. But I'll bet it covers most cases.
[0] https://en.wikipedia.org/wiki/Room_641A
[1] https://www.usatoday.com/story/tech/news/2017/04/04/isps-can...
2) I trust a company who’s entire value proposition is privacy more than one who’s value proposition is having a monopoly on the local fiber.
I wouldn't believe any corporation who says this. A profile of a self-identified private person's traffic is likely worth a lot more than what a niche audience will pay for privacy.
VPNs have a history of lying about their business models, about how private their service really is. International contract enforcement won't exactly leave you with a lot of leverage if (pragmatically, when) they lie to you.
And merely being international certainly won't stop a state level actor who is intent on gaining access to your traffic.
Many of the VPN providers are suspiciously cheap.
If a no-name company starts selling suspiciously cheap smartphones, the odds of those smartphones being backdoored/stolen/broken goes up pretty dramatically. That doesn't mean that every company selling smartphones is equally untrustworthy.
Of course it's a problem how hard it is to tell if a VPN company is trustworthy, but that's a problem that exists for almost every 3rd-party relationship I enter into.