[bigiain]

Agreed.

You need to determine who your adversary is (at least the category of adversary they're in).

If your adversary is The NSA, you're probably fucked already - get off the internet.

If your adversary is your local drug or anti-terror law enforcement, they're probably getting "hints" from the NSA and likely parallel reconstructing evidence against you based on that.

If your adversary is closer to local cops, MPAA/RIAA, your boss, your parents, your ex-wife's lawyer, or your ISP - this list provides a great deal of useful information.

[narrowrail]

What if your adversary is the pervasive data collection entities in the business of selling eyeballs (aka ad networks and that related ecosystem)?

[bigiain]

Good question - I guess the quick answer is "the most anonymous and secure VPN in the universe isn't going to help if you browse to pages with Facebook like buttons in the same browser where you've got an actively logged in Facebook session - or even non-logged-in session cookies". (Substitute Twitter/Google/Yahoo/whoever as appropriate)

Browser/cookie hygiene is orthogonal to VPN/network hygiene.