Correct.
Laws in America vary by state, and across the world by country.
My advice would be to use a VPN like you are doing, but ensure you're on with an anonymous payment method (bitcoin etc), and preferably choose a VPN provider based in a country other than the US or any of the 5, 9 or 14 eyes countries.
I would also advise using a virtual machine with the OS of your choice (Linux is strongly recommended), and encrypt the system partition using Veracrypt - using a password at least 25 characters long using numbers, special characters, letters both upper and lower case.