Now that CISA is law, there are many ways you can help protect your privacy while you are online.
Many would say a VPN is all you will need to protect yourself. But honestly that is just the tip of the iceberg, to take back privacy, one really needs to:
Switch to ProtonMail for email (Swiss based, end-to-end encrypted)
Switch to Signal or Telegram for messaging (also end-to-end encrypted)
Drop Facebook (This could be one of the hardest, hopefully a good alternative comes along)
I use TOR for browsing, its free and helps create better anonymity.
TOR has been broken into before. Using TOR and a VPN maximizes the security because not only does a hacker/attacker have to go through TOR but also a VPN, it's an extra layer of security which means an extra layer that a hacker/attacker has to go through.
If using TOR it's good to use the "New identity" feature to spoof around about every hour or so, as a hacker/attacker/tracker would lose your connection once you use it (that's if they weren't in your computer already and were trying to use TOR to get access).
TOR just had a recent update around the time CISA was passed though, which is good but it's not a stable release.
These are fairly simple ways to help secure and protect your time online. It is your right to protect your privacy and be able to do it without the scrutiny of others. Not everyone is a criminal because they want their privacy!