The phrase in the title is a common trope that comes up when VPN services are discussed. While this statement is technically correct, it can be misleading, as it implies that all providers handle law enforcement requests and prepare for worst case scenarios similarly, so their conduct cannot be a differentiating factor when you evaluate them.
Yes? I work in the identified healthcare data space, but work close to people in the unidentified space and even something as personal as health data can be obfuscated in such a way it’s impossible to trace back to an individual. Not to mention whatever they’re logging is surely many orders of magnitude less identifiable. They also have an entire page dedicated to answering these types of questions and concerns.
I worked directly for one of the two biggest log and search systems for big data for years and I can tell you that there is always a way to correlate data lol. And the data you don’t have you can always buy to help put the missing pieces together.