Everyone is selling VPNs, and that's a problem for security

Whatever YouTube rabbit hole you’ve spiraled down lately — gaming playthroughs, political commentary, niche eight-hour video essays — you’ve encountered an ad for virtual private network, or VPN, services. The influencers promise military grade encryption and streaming content from anywhere as long as you use code FOLLOWME10 at checkout so that they get their cut.

It’s not just anecdotal that VPN ads are everywhere on YouTube. Since the beginning of 2016, VPN companies have collectively sponsored about 247,000 YouTube videos, according to Daniel Conn, co-founder of influencer marketing consulting firm ThoughtLeaders. Almost none came up before then, signaling rapid growth as both influencer marketing and VPN companies took off.

For the YouTubers, it’s a lucrative and consistent way to fund their aspirations; for VPN providers, it’s helping to bring the obscure security product into the mainstream. But for the casual viewer, the sharp spike in VPN ads adds to the confusion and jargon around cybersecurity — and it could be misleading us on how secure we really are.

“If you do think of it like education, it might be the most pervasive form of security education out there,” said Dave Levin, assistant professor in computer science at the University of Maryland.

Researchers at the University of Maryland took a random sample of those hundreds of thousands of ads to better understand what these influencers are saying about security. While not explicitly inaccurate, most of the ads featured vague or exaggerated claims on what VPNs could do, according to Michelle Mazurek, also an associate professor in computer science at the university.

All a VPN can really do is mask your IP address and the identity of your computer on the network by creating an encrypted "tunnel" that prevents your internet service provider from accessing data about your browsing history. They can’t keep your identity secret, protect from financial exploitation, offer “military-grade encryption” or other marketing terms these companies use. Military-grade encryption refers to AES-256, but that’s become an industry standard, and won’t protect you from security threats like phishing attacks.

Still, it’s sold as a one-step security solution, when it’s really just the start of what you can do to protect yourself online. The companies and the ads are “overselling what a functional one could do,” Omer Akgul, the PhD student at University of Maryland who led the research paper on VPN advertising, said. “It's problematic that users think they're getting protections where they really aren't.”

Most advertising comes with these caveats, but in a field as high risk and difficult to understand as security, the exaggerated claims can be damaging. If a YouTuber sells you on a new electric toothbrush, you can get first-hand experience deciding whether it’s worth your money. You can feel whether it leaves your teeth feeling clean, see real results when you go in for your next dentist appointment and easily compare it to other options on the market. But security isn’t tangible. One VPN service might be more user friendly than the next, but we rely on recommendations from others to tell us whether or not one is “more secure.”

The power behind influencer marketing lies in those recommendations. We trust the people we follow as we build parasocial relationships and see them advertise the same services over and over again. According to the UMD research, influencers use this to tailor their approaches to VPN ads. A far-right conspiracy channel will tout a VPN’s privacy protections from government snooping, while a movie reviewer will say the VPN can help you access streaming platforms in different countries, Akgul said, “because YouTubers know who their audiences are, they can frame it in such a way that their audience would be interested or understand.”

Influencers tend to be tight-lipped about these advertising relationships because it can put future earnings in jeopardy. But according to Conn, the influencers he’s encountered generally like working with VPN providers because they can be so lucrative. And for VPNs, the competition is fierce to secure top converters, and includes exclusivity periods to prevent top YouTubers from working with competitors. They’re also actively recruiting with companies like Surfshark, NordVPN and ExpressVPN all touting open calls for influencers to sell their services.

“It's a battleground,” Conn said. “Because of these exclusivity causes, it's a race between them to scoop up in inventory because effectively you're blocking your competitor from the advertising space as well with those clauses. It’s a very aggressive market for VPNs.”

If you’re looking to hide your internet data from your ISP, want to stream Netflix abroad or are connecting to an untrusted public network, a VPN would be a worthwhile investment. But just because you’ve seen more ads online, doesn’t mean the use cases for VPNs have changed. Plus, as it becomes a more lucrative way for influencers to make money online, it probably means you should be even more skeptical of both the advertisements and the provider themselves.