At this point one must assume that all traffic is monitored and stored, maybe it is or maybe it is not, but assume so. At least all metadata is stored for some time.
Using a VPN moves the point where this occurs and may obfuscate some things, but also realize that many VPNs are probably in some form associated with nation-states and therefore makes their job easier.
For example, my VPN is based in Thailand. For various legal reasons, it's very unlikely anything obtained by a nation-state actor in Thailand will be used for trivial stuff like, say, enforcing copyright legislation against individual consumers. Defense lawyers / barristers would have a field day. If you are planning terrorist acts, on the other hand...
