Ask HN: When do ISPs begin selling your data, and is a VPN all that's needed?

When does the "ISPs selling your data" begin, and is a VPN without logging all that's needed?