My personal choice is privateinternetaccess.com: $40/year, unlimited bandwidth (cloak and many others limit bandwidth), multiple platforms (Windows/MAC/*nix/iOS/Android), multiple protocols (PPTP, OpenVPN and IPSEC/L2TP), multiple gateways (US/UK/Switzerland), and most importantly, NO user activity logs.

We utilize shared IP addresses rather than dynamic or static IPs, so it is not possible to match a user to an external IP.

Also:

We maintain logs describing the time at which a client connects, length of connection time, source IP, as well as payment information. We use custom hashing to maintain separation between our payments database and user database.

My interpretation is, under a court order, authorities can, with considerable difficulty, force a match between a criminal request and several users, but not one user.

Reasonable enough for me - I believe in good-enough security through obscurity given enough obscurity - YMMV of course.