Seems like it'd be easier to "unmask" someone's VPS account than figure out who someone is when they use a paid VPN service.

If you're worried about a government, your personal info from a VPS provider is just one court order away. If you use a VPN service that actually is serious about not keeping PII or logs, you might fare better there (they might be coerced to log future traffic of yours, but at least your prior activity is still secret).

If you're worried about ad tracking, a VPN just doesn't do you much good period: ad tracking is sophisticated enough to not care about your IP address.

But all of this "VPN for privacy" stuff is predicated on trusting faceless third-parties to help keep you safe, so it's generally a losing proposition. Agree that the only "safe" thing to use a commercial VPN for is to bypass geographical restrictions.

Every form of security has different threat models and appropriate countermeasures.

If you are trying to avoid your ISP knowing you are downloading movies a VPN is a good solution.

If you don't want others in the coffeeshop to be able to snoop on remaining unencrypted http traffic. VPN

If you don't want your employer to have a list of your web traffic from your personal device. VPN

If you don't want a service which you don't pay with a credit card to have a way to connect your pseudonym to your real name. VPN

If you want to opt out of some degree of dragnet surveillance/data collection via parties like your ISP. VPN

None of these are incredibly uncommon. VPSs work great for most scenarios. If your actions are dangerous to your continued existence or you need to keep your own government from watching you then you probably need to adopt far more stringent measures but I feel this is vastly less common than the above situations.

Perhaps it depends on the definition of privacy. Now your identity is tied to any and all traffic to/from that IP address for the duration of ownership.

The specific issue is the VPN provider harvesting data about your traffic and selling it.

I'm suggesting it's vastly greater effort to identify individuals in a VPN service than a VPS provider (shared vs dedicated tenancy).

If you're talking about bulk collection, then your ISP is probably already doing that.

If I use a public WLAN, a VPN like Mullvad is going to gain me privacy and security. Furthermore, I would get (for good or bad) "mixed" with the rest of the users (although in my case this does not apply as I use WireGuard to my home connection). If I use mobile, a VPN makes MITM more difficult.

If I pirate using a VPN in a country hostile to mine, the local RIAA/MPAA can't do anything. They probably already can't when VPN is in same country. A VPN doesn't stop a determined adversary, but if you worry about these you should probably use Tor or something like that, possibly without going back to clearnet.

While your stance is a good wake-up call, and perhaps a decent rule of thumb the above are reasonable exempts.

Except most providers worth their salt will require your credit card/paypal for a subscription. This adds another potential loophole for de-anonymization. At least with Mullvad you can pay in crypto or even mail them cash. Though it all depends on what you want to achieve I'd say a trusted VPN is much better than a VPS, esp one located in US or any of the five eyes countries.