IMO you should never recommend:
1. "A VPN"
2. Tor
3. Blanket absolutist statements about protecting data privacy
Unless you are _very willing_ to explain the threat model you are working under and how you think what you are telling people will connect with that threat model.
If you aren't doing that or willing to do that you are doing people a disservice.