The first and most important thing, which far too many people skip, is start to understand what threats there are to your privacy. Then reflect on what they mean to you. These threats can be many things, like activity tracking, personal information collection, profiling, etc. Then, based on what you are personally concerned about you can better choose which mitigation strategies to use against which invasive techniques, because you know what you're trying to work against and why.

Also don't trust people who are just trying to sell you a VPN. They don't make you "more private," whatever that even means, and those people just want a referral click and sale.

This seems to be a good practical and pragmatic intro into online privacy.

https://auth0.com/blog/practical-privacy-a-guide-for-everyone/