It depends who you mean by "they". VPN services certainly have access to users' data. But it'd be commercial suicide to cooperate with authorities. HideMyAss lost considerable market share after it came it that they had pwned someone from LulzSec.
Still, it's prudent to assume that any VPN provider will give you up. And that's why I recommend using nested VPN chains. With three different VPN services, it'd be nontrvial for adversaries to obtain enough data.
Still, it's prudent to assume that any VPN provider will give you up. And that's why I recommend using nested VPN chains. With three different VPN services, it'd be nontrvial for adversaries to obtain enough data.