Also many people forget its not just the VPN, its the combination of the VPN and your browser. There are many ways to unmask you even if the provider does everything right. They can't protect against attacks like dom battery monitoring, complex fingerprinting, UDP timing attacks, etc... read the Mullvad audit for more details. They cite the need to enable DAITA by default as a shortcoming. https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Pub...