Rise in VPN Sales Raises Concerns Over Security

No matter what kind of content you’ve been watching on YouTube lately, whether it’s gaming, politics, or lengthy video essays, chances are you’ve come across an advertisement for virtual private network (VPN) services. These ads are often promoted by influencers who claim that their VPN offers military-grade encryption and the ability to stream content from anywhere, as long as you use their special code at checkout. This allows them to receive a commission from the sale.

VPN ads aren’t just everywhere on YouTube. Since the beginning of 2016, VPN companies have collectively sponsored about 247,000 YouTube videos, according to Daniel Kohn, founder of influencer marketing consultancy ThoughtLeaders. It came to nothing before that, which points to a rapid growth in the rise of both influencer marketing and VPN companies.

For YouTubers, it’s a profitable and consistent way to fund their aspirations. For VPN providers, it helps bring an obscure security product into the mainstream. But to the casual observer, the surge in VPN ads adds to the confusion and jargon surrounding cybersecurity — and may mislead us about how safe we really are.

“If you think of it as an education, it might be the most common form of security education,” said Dave Levine, an assistant professor of computer science at the University of Maryland.

Researchers at the University of Maryland randomly sampled hundreds of thousands of ads to better understand what these influencers had to say about safety. While not entirely inaccurate, most ads made vague or exaggerated claims about what VPNs can do, according to Michelle Mazurek, also an assistant professor of computer science at the university.

A VPN can only hide your IP address and your computer’s identity online by creating an encrypted “tunnel” that prevents your ISP from accessing information about your browsing history. They cannot keep your identity confidential, protect you from financial exploitation, or provide “military grade encryption” or other marketing terms used by these companies. Military-grade encryption refers to AES-256, but it has become the industry standard and does not protect you from security threats such as phishing attacks.

However, it’s sold as a one-step security solution, when in fact it’s just the beginning of what you can do to protect yourself online. Companies and ads are “selling what a functional human can do,” said Omer Akgül, a University of Maryland doctoral student who led a paper on VPN advertising. “It’s problematic for users to think they’re getting protection where they really aren’t.”

Most advertisements carry these warnings, but in an area of high risk and difficult to understand for safety reasons, exaggerated claims can be harmful. If a YouTuber sells you a new electric toothbrush, you can get first-hand experience to decide if it’s worth your money. You can feel if it leaves your teeth clean, see real results at your next dental visit, and easily compare it to other options on the market. But security is not tangible. One VPN service may be more user-friendly than the next, but we rely on the recommendations of others to tell us if one of their services is “safer.”

The power of influencer marketing lies in these recommendations. We trust the people we follow when we build social relationships and see them promote the same services over and over again. According to UMD research, influencers are using this to adapt their tactics to VPN advertising. The far-right channel is promoting a conspiracy to protect VPN privacy from government snooping because while a film reviewer says a VPN can help you access streaming platforms in different countries, Akgül said, “Because YouTubers know who their audience is, they can frame in a way that gets their audience to be interested in or understand.”

Influencers tend to keep quiet about these advertising relationships because they can jeopardize their future profits. But according to Kuhn, the influencers he interviews generally love working with VPN providers because they can be very profitable. And when it comes to VPNs, competition to secure the best adapters is fierce, with exclusivity periods that prevent big YouTubers from working with competitors. They also actively recruit with companies like Surfshark, NordVPN, and ExpressVPN all advertising open calls for influencers to sell their services.

“It’s a battlefield,” Kun said. “Due to these exclusivity reasons, the competition between them is cutting inventory because you’re also effectively blocking your competitors from ad space on these terms. It’s a very aggressive market for VPNs.”

If you want to hide your internet data from your ISP, stream Netflix abroad, or connect to an untrusted public network, a VPN is a worthwhile investment. But just because you see more ads online doesn’t mean VPN use cases have changed. Also, as it becomes a more lucrative way for influencers to make money online, you should probably be more suspicious of both the ads and the service provider itself.