I was speaking of plausible deniability on the social level not from a criminal perspective.
A VPN would stop them in their tracks because there would be no logs to read except you connecting to the VPN on the ISP side.
You can also use a VPN -> Tor -> VPN in which case it is almost impossible to trace anything unless you examine the whole internet connection map which is thousands of hours of effort.
Thanks for the info, this likely explains why they dropped private payments. Large corporations hate privacy for their customers but love it for themselves.