You disable the VPN, they show “unprotected”, come on, I’m not really unprotected, why such a dramatic word, I just disabled the thing a little, I’m “disconnected” but it doesn’t mean I’m actually unprotected, the same way it doesn’t mean I’m actually protected if I’m using a VPN.
There are cases where Iranian feminist authors and freedom fighters live in exile — for instance in Germany — and use their phones completely normally, whether Apple, Android, or whatever else. Yet Iranian agents still manage to track them. The reason is that the data is simply bought from data brokers: the Iranian regime purchases it and then sends people to observe these women in person.
Data broker tracking can be curtailed with a VPN, but a VPN alone does relatively little. What matters more is blending into the largest possible crowd. The point of using something like a default Firefox setup isn’t the browser itself — it’s that you end up with the same screen resolution, the same fonts, the same default settings that the largest number of people on the planet also have. If your browser deviates from that baseline, then details such as when you’re online, which apps you’ve installed, which websites you visit, which fonts and add-ons you have, your browser settings, your user agent, and so on, can uniquely identify you or single you out. The whole game is to keep the indistinguishable mass as big as possible: if someone knows the person they’re hunting is in a certain group, you want that group to be huge.
Once that fingerprint is known, you can be re-identified even under a different IP. So the data brokers who buy data from Facebook, Instagram, or wherever still have what they need. It’s also been shown that apps communicate with each other in ways that allow unique attribution across them. And depending on which country you live in, default regional versions — US builds, Apple US, and the like — aren’t necessarily privacy-compliant; whether that’s actually illegal depends on the jurisdiction.
On a desktop PC, the situation is similar. There it depends heavily on which browser you use. If you take a browser with completely default settings and then surf either with or without a VPN, you’ll be recognized all the same — meaning users can be de-anonymized regardless. So it really doesn’t help much at all.
And while we’re at it — go on, tell me what exactly in my last message you think I didn’t come up with myself. Be specific. Which sentence, which idea? I’d genuinely like to know what you think was put in my head.