* You only need two VPNs assuming you just want to protect against either of them linking your browsing history back to your identity and selling that information.

* The second one must be paid for in a reasonably anonymous manner (ex Bitcoin) and only ever accessed via the first VPN in the chain.

* You're fine to pay the first one in a more traditional manner.

* The two providers must be completely unrelated.

* It is highly preferable that the two providers be in different legal jurisdictions (both from each other and yourself).

* This won't protect against a highly motivated criminal investigation.