It is easy to expose users' secret web habits, say researchers

Start paying twenty bucks a year for a VPN. Use Linux instead of Windows (even if just through a bootable flashdrive). Download the Tor Browser Bundle and start getting the hang of it. For everyday surfing, use Firefox as your browser, with the extensions Adblock Plus, Adblock Plus Pop-Up Addon, AdNauseum, BetterPrivacy, Decentraleyes, Element Hiding Helper for Adblock Plus, Flashblock, Ghostery, HTTPS Everywhere, NoScript, Privacy Badger, Random Agent Spoofer, RequestPolicy Continued, Self-Destructing Cookies, TrackMeNot, U2F Support Add-on, uBlock Origin, and uMatrix, so that when one add-on fails you another can fill the gap. Use two-factor authentication, including paying ten bucks for a physical U2F dongle to plug into your USB port (and a second dongle to keep at home as a backup), and preferably not using SMS messages sent to your phone. Start teaching yourself about particular items such as various cryptocurrencies, BitMessage, and Ricochet. Don't forget the basics, like clearing your Google and Youtube histories, and turning off personalized ads.

And, even if you start doing all of that right now, it'll still take time and practice to avoid various privacy-destroying mistakes. So it's better to get the practice period over as soon as possible, so you can then spend as much time as possible browsing with a modest level of privacy.

If you want to know more best practices for protecting your privacy, as well as alternative applications (say email) that respect privacy there is a compilation: https://www.privacytools.io/

It also has recommendations on VPN's and such. A common recommendation is to use linux instead of windows, but if you find this to be very inconvenient there are many settings in windows 10 that can be changed to disable telemetry (such as blocking in firewalls), these are gathered into one place by the application: https://www.winprivacy.de/english-home/