Those are the essentials I think that any VPN provider, and any provider of any service, really, should have to be even considered by me:

• Tor support - that means having an onion mirror for the VPN site itself; Tor with the VPN itself is not necessary, as Tor is kind of easy to set up, at least on Linux
• If it's paid, Monero acceptance - obviously, one might not want to be using some kind of anonymity-hating VPN, like with the point above
• No personal data for registrations - that means confirming your phone number is out
• Compatibility with standards - in the case of VPNs, that's OpenVPN or possibly WireGuard
• No Cloudflare - MitM, especially Clownflare, likes being a honeypot: https://codeberg.org/baobab/cloudflare-tor (clear net only)
• not a privacy-related issue, but if the service likes to go down often, it goes out too

Okay, I don't actually pay with Monero or any other cryptocurrency, but other people might, so if I'm going to recommend a service, I want to check that.

Covers or at least block ipv6. Some VPNs are leaking out the real ipv6!

email verify is out too, just let users register with username and password, and they have to complete non js 8 or more character image captcha. how hard is it to store usernames and passwords in db, prune old/unused accounts that haven't logged in for a while. no log vpn.

Actually, e-mail verification is fine for me, as long as it will let me use aliases, like those Riseup has. But yes, I do hate CRAPTCHAs, especially the Goolag one. Sure, I can use Buster (https://github.com/dessant/buster, clear net only), but it doesn't really help when you're continuously using a service that requires it because you're still supporting the cancer.

Depends on what you need it for, and what you need it to do. Considerations could be:

1. No logs policy (backed up in it's TOS), and preferably certified by a 3rd party.

2. Based outside the 14-Eyes jurisdiction.

3. Reliable kill-switch.

4. No leaks.

5. GUI client.

6. Compatible with your OS.

7. Uses compatible protocol (IKEv2, Wireguard, L2TP, OpenVPN, etc.).

8. TOR friendly.

9. Multi-hop.

10. Unlimited bandwidth/fast speed.

11. No auto-renew or ability to disable it.

aka ..... ExpressVPN (in carribean domicile)

There are others based outside 14-Eyes, but ExpressVPN ticks more boxes than them, so I guess it could be pick of the litter.

WARNING regarding :

"guess it could be pick of the litter"

Spooks claim any VPN that well run, domiciled that close to USA shores, is run by the Chinese military via paid proxies.

That rumor is spread by jew Mossad, US LEA, and others, and its a 10% chance that ExpressVPN makes most of its real money from the pension fund of the Chinese Military... but no proof.

The only proof is:

"Express VPN is just too good"

At least though, for a non-chinese citizen and those not planning to visit China, that 10% chance is not dire.

90% of all legacy VPNs are run by nation states (CIA in the mid 2000s in terror war), just like 90% of high speed Tor exit points are run y nation states.

so 10% chance that ExpressVPN is chinese government is no big shock if true.

Just do not use ExpressVPN to undermine china, and use other vpns if needed, and you are fine.

A new-hire Hong Kong VICE PRESIDENT of ExpressVPN "Harold Li" a famous Freedom Fighter, does speak perfect Chinese and ExpressVPN was third largest VPN in China, but the chinese that run ExpressVPN is not proof that the Chinese government pays to run ExpressVPN

https://profiles.forbes.com/members/tech/profile/Harold-Li-Vice-President-ExpressVPN/9fa5774b-54e2-4388-bafb-df66714ce2a1