A VPN provider is basically a choice to trade one country’s passive adversary for another. I.e., if you’re in the US and using a VPN with German corporate headquarters, then your Internet transactions are able to be wiretapped by the German government, but not by the US government. Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market—but not usually in a form that will result in legal problems for you, since ad-targeting data tends to be semi-anonymized (in the sense that it isn’t in a form where a court would accept it as evidence of who you are; not in the sense that it couldn’t be used to deanonymize you by a sufficiently-motivated private researcher.)