There are many mechanisms, widely used, to aggregate information from many sources into a profile of you, and using your IP as an identifier isn't hard. Many lawsuits find their targets based on IP addresses, for example.

> easily obscured with a VPN

I think we can expect that commercial VPNs are compromised, at least by intelligence services. Imagine you opened a bar and advertised, 'dissidents come here to drink in privacy'. I'm sure you'd attract others too to an obviously target-rich environment.