Depends where you live, she lives in the UK so what she is doing is very sensible, the most obvious issues being the Obscene Publications Act 1959 and the Criminal Justice and Immigration Act 2008 which makes viewing content illegal here, let alone planning a hookup or something else, do they actively seek out individuals and prosecute this law, no, have people been prosecuted under this law, yes.
You are leaking DNS, the sysadmin of any network you are on (i.e. work, hotel, retail establishment and most importantly your ISP) can see exactly where you are visiting if you aren't using a properly configured VPN or DNSSEC at the very least, this site has HTTPS which prevents most organisations (but not necessarily LEA) from knowing what you are doing while you are on the site but it doesn't protect you from being seen initially visiting the site because that will be logged by your DNS provider which in your case is most likely your ISP seeing as you haven't taken any precautions.
It's especially dangerous in the US where it's completely legal for ISPs to collect customers metadata and sell it, land of the free indeed, you can thank the FTC under a Republican administration for that one.
None of this includes all the other hops that could be logging your traffic besides your local network and ISP, you can add backbone providers to the list as well as the data center this site is hosted in.
So yes, use a VPN, if you live in the US you should have using one for almost everything with sensitive data already.
Buy the way
@JessWoof, yes everything you are doing is spot on, I'm a sysadmin and I also lead on infosec, it's exactly what I am doing but I also use Virtual Machine which is a bit of overkill for the average user.