But then how do you stop your VPN company from doing the same? You essentially have two ISPs now.
(Longer answer: This boils down to the weighted probabilities; if the ISP was meaningfully regulated such that it was legally restricted from doing certain things with my data, that might matter, and one should also play in the exact likelihood that either party is selling my data. In my case the weighted probability is wildly in favor of a VPN, but I suppose I can imagine situations where that wouldn't hold.)
They probably could sell my traffic, but I estimate it (based on vibes) as being less likely than for most other intermediaries
Wouldn’t that address your concern?
Skipping the broader discussion of AI, the ridiculous amount of automatic and human impossible pattern, matching and correlation with seemingly harmless data is something that I don’t think we are equipped to fully comprehend.
The time at which I hit some meta CDN, seems harmless. Until combined with some cookie and some access time to some asset it uniquely identifies me to previously anonymized data.
So no, I do not think HTTP and a good DNS are enough.
Yes.
> who has all the same incentives.
And no. The ISP has little to no competition or incentive to not sell my information, while the VPN provider has loads of competition and often has user privacy as a core part of their value proposition.
Besides - even if both of the did have the same incentives, one openly says they're selling my data and one says they're not. At worst it's a gamble between the VPN lying and the ISP telling the truth.
Hi! /waves I use a VPN to stop my ISP from monitoring my traffic and selling my personal information. My VPN (usually) exits in the same "region" as my real location; I guess if I hit a geoblock I could look at that, but it hasn't come up.