Oh kids.

A VPN is only really good for plausable deniability. That is there is no direct correlation between the activity coming from an ISP’s IP address that is directly connected to your billing profile, home address, etc.

There are countless ways your identity can be gleaned from your digital exhaust. Fingerprinting just takes maybe four or five attributes your browser will hand over and from there, you can be reasonably identified with a high level of certainty.

For example, you might be using a Safari browser, your resolution is known (browser spills the beans to render pages), operating system, details about how your device performs a TLS (encryption) handshake, timing, any browser add-ons you might use etc.

See for yourself: https://demo.fingerprint.com/playground; there are countless pages that show you the same, this is just one.

If you think that a VPN is going to act as some sort of anonymizer, I’m afraid you’ve been misled. Even the act of setting up a machine/browser to be properly anonymous will generate signals which will make you stick out like a sore thumb.

VPNs are one small slice of the pie, they help but they don’t solve the problem of being identified online. If you’re going to do something that you REALLY don’t want anyone to see, you’re going to have to spend a lot of time learning–which is a signal also.