First off, I would be careful around browser-based VPNs, especially free ones. If it’s in the browser it’s often just a proxy (as opposed to wireguard or openvpn), which is potentially bad for normal functionality or privacy. Also, if it’s a free service then it almost certainly collects your data itself, and won’t necessarily be allowed by sites either.

That being said, there are two ways to layer the two type of tunnels:

Connecting to the VPN first is relatively common. This means that your ISP can’t see you connecting to Tor. Furthermore, VPNs are designed to tunnel your entire system, while Tor generally is not. Thus, you can have some traffic that is merely VPN protected and some that runs through the Tor network as well. In this situation my ISP knows which VPN provider I use, my VPN provider knows (1) my identity and (2) my network activity outside of Tor, and sites that I visit can only see that I use Tor.

The other direction is to connect first to Tor, and tunnel the VPN connection through there. This is very much not intended: Tor only tunnels TCP, while most VPN protocols use UDP (only, or more efficiently). The reason is that it’s actually quite difficult to hide your identity from your VPN provider. If the VPN is the innermost tunnel, then that means that it has access to all your network traffic. I’ll assume that all of it is encrypted with TLS (but be careful because a single error is bad). Then, the VPN only knows which domains you visit, how long, how much data, and at what times. This is still quite significant. Then there’s the issue of payment. If you choose a free service, it almost certainly means it’s selling your data. I will say that this is better than most other uses for free VPNs, but it’s still pretty sketchy. If you’re paying, then you need one which accepts payments in monero (or zcash or another private cryptocurrency) or cash by mail.

Overall, Tor over VPN is relatively normal. I use this configuration regularly. VPN over Tor is highly unusual, and you should consider if you need it. If you need a recommendation for a VPN though, Mullvad supports both monero and cash by mail (sweden), and is generally a good all around VPN (as long as you don’t need port forwarding). One final thing to note: If for some reason you want to use a VPN on both sides, do not use the same VPN, even with separate accounts. Probably, they won’t check, but at that point you might as well just use straight Mullvad VPN.

One thing that’s worth keeping in mind: physical retailers may have cameras, but they (in general) rotate their recordings and don’t provide an API for law enforcement. By contrast, any data that an online service gets is probably stored forever, possibly across multiple companies. If you do pick up the online package at a physical store, then you’re losing most of the benefits, so you also need to provide an address.

That being said, much of China and some of the US have significant outdoor surveillance camera networks. These usually do provide law enforcement with real time, AI search, and may keep recordings for a very long

For me, as a Canadian, I’d consider physical stores more private, maybe putting on generic clothing and a mask if it’s really important. If your city has its own surveillance system, that might be different for you. Though really, in that case, you should be more concerned about pushing for the cameras to be removed, or failing that looking into moving elsewhere: it is not sufficient to have privacy only online, only from major storefronts.

That’s not a bubble. AI is a bubble, other people wanting your data will go on until there is cultural and political will to prevent it, and there’s no guarantee we’re moving in the right direction. See the recent situation with chat control: it was postponed, but it will be back; and even when this particular attack is well and truly destroyed, there will be another. Privacy and digital rights are a never-ending fight, but a necessary one for the sake of human rights in general.

Aren’t AI tools supposed to be bad with adversarial examples? Someone could make an app that generates an image which (independently) appears to be you and also appears to be old enough.

I’m glad they at least tried to make an alternative to the stupid AI estimation. Even if this is hardly any better. I wonder if a VISA Debit card would pass muster, or do they have those in the UK.

Of course, the primary harm of kids not being able to use social media is also pretty significant—but there’s only so much you can do when you’re actually breaking the law. Except switch to dread, I guess.