Tl;dr, your mobile carrier (at least if you live in the US) sells your account information meaning any website can buy it in order to correlate you to your mobile IP address (and, thus, what you do online). Some more technical demos and proof-of-concepts here.

So, on the one hand, this is from the website of a VPN provider,1 so they have a financial interest in scaring you with this information. That being said, this sort of customer data selling and big data correlation is both commonplace and legal… in the US. Because the US has no privacy laws, basically. Individual actions, such as using a VPN service, won’t fix the issue,2 although it’s in the tech industry’s interest to try and convince you they will, because the alternative—e.g. legislating to introducing EU-style privacy laws—will literally cause most big internet companies to go bankrupt.

  1. Disclaimer: It’s the VPN provider I use, when I feel the need to use a VPN, which is both rarely and a whole post in-and-of-itself… []
  2. Quite literally: All it does is shifts the focus of who does the data selling from your ISP to your VPN provider. []