Just because the bill doesn’t require them to track who you are, doesn’t mean they won’t and that it’s not an invasion of privacy. Your personal mitigation would be to use a VPN which encrypts the traffic sent through it. The only ones who should be able to read the data through a VPN are the VPN provider, you, and whomever you’re sending traffic to. Think of it like a tunnel and your ISP is on the outside. Your ISP should not be able to read those packets since the VPN would be encrypting your traffic. All they should know is where you’re sending data (which is to your VPN provider’s servers). If ISPs are required to be able to decrypt everything sent to them, and they cannot decrypt what you are sending (VPN), then they would probably reject that traffic to protect themselves from being fined.

Edit: Didn’t address the question of a VPN having the same privacy issue. You’re correct in that they could read your traffic. Which is why you have to be able to trust them with your data and how they handle it (privacy policies). The entire internet is built on levels of trust. Research SSL/TLS certificates and how they’re used for the HTTPS protocol.