Influencer AdvisoryInfluencer Advisory
Get May 2026

vpn · privacy

VPN Creator Disclosure Checklist (2026)

FTC plus platform disclosure rules for VPN creator deals. NordVPN and Surfshark data, 8 line checklist.

By Dennis Ksendzov, Founder, Influencer Advisory[NEEDS INPUT] read

Mentour Pilot, a 2.38M subscriber aviation YouTube channel, has run 25 paid NordVPN posts since August 2023 in our deal log.

NordVPN is a virtual private network (VPN), a tool that routes your internet traffic through the provider's servers.

Every one of those 25 reads carried an affiliate code like nordvpn.com/mentour, and every one disclosed the paid tie in the opening line.

A brand operator messaged me last week asking why their VPN brief kept bouncing back from legal review.

The 90 second answer was the affiliate code.

It sat in the description with no disclosure word near it, and the FTC reads a hidden code as a hidden ad.

Glossary on first mention: FTC means the Federal Trade Commission, the US agency that polices ad disclosure. Affiliate code means a tracking link or promo code that pays the creator per sale. No-logs policy means the provider keeps no record of user activity. Jurisdiction means which country's laws govern the provider.

I sat on this post for two months because the VPN version of the disclosure question is the one operators get wrong on the first roster.

The cost is not a wasted ad spend.

It is a YouTube policy strike that can pull a creator's other sponsored videos mid campaign.

Across 1,802 paid NordVPN posts and 1,987 Surfshark posts in our database, nearly every read carries a promo code plus a percentage off link. VPN is the most affiliate driven sponsor category we track, which makes the disclosure line the whole game.

The rule brands misread first

Most brands open this work thinking the rule that matters is the platform ad policy.

It is the federal one instead.

The rule that catches the most briefs is the FTC Endorsement Guides at 16 CFR Part 255, the federal rule that requires a paid post to disclose the paid relationship.

What trips VPN deals is the affiliate code.

A code like surfshark.deals/creator pays the creator per sale, so it is a paid tie that must be disclosed even when no flat fee changed hands.

Rhett and Claire, a 305K subscriber channel, has run 44 paid NordVPN posts since August 2023, with the word ad in the opening line every time.

Each one cleared review on the first pass.

Evan Edinger, a 1.15M subscriber creator, has run 21 paid NordVPN posts with the same opening line pattern.

The pattern is small. The result is repeat bookings.

Want the disclosure line checked before the brief goes out? Talk to us →

What the rule actually says

The Endorsement Guides say two things in plain language.

The first is that the disclosure has to be clear and easy to see.

For a VPN read that means the disclosure word sits next to the affiliate code. Three lines down in the description does not pass.

The second is that the brand is on the hook for what the creator says, because the brief counts as the instruction.

Cybernews, an 855K subscriber tech channel, has run 26 paid posts for NordVPN and Surfshark with a single spoken disclosure in the first 30 seconds of the video.

That is the placement that keeps a paid slot from drawing a YouTube strike.

The pick your gut makes is probably wrong.

Most VPN brands open vetting wanting a 5M subscriber tech channel.

Our data says the repeat deal pattern concentrates inside the 50K to 1M subscriber band, where 468 of our VPN creators sit in the 250K to 1M range and 457 sit in the 50K to 250K range.

Follower count is a weak first cut. What decides the deal is a clean disclosure history.

The creator language that gets deals flagged

Three patterns break a VPN post.

A buried affiliate code with no disclosure word near it. A hard scare line like hackers can steal your bank details. A claim the VPN keeps you fully anonymous.

The eight line brief that clears review on the first pass swaps each of those for a softer pattern.

The first fix is to put the word ad in line one and tie it to the code.

The second is to drop the scare line and describe the real use, like watching a show that is blocked in your country.

The third is to say the provider hides your traffic from your network, never that it makes you fully anonymous, because a no-logs claim the brand cannot prove is its own FTC risk.

GBNews, a 2.10M subscriber news channel, has run 19 paid ExpressVPN posts since November 2025, and the spoken disclosure leads the read every time.

ExpressVPN is a virtual private network brand owned by Kape Technologies.

The buried affiliate code is the deal killer in VPN.

We run the disclosure check so your roster ships

Most VPN brand teams hand a creator a code and hope the disclosure lands in the right place. We read every paid post first.

  • Affiliate codes dropped in the description with no disclosure word
  • Scare lines and fully anonymous claims that draw an FTC letter
  • A YouTube strike that pulls the creator's other sponsored videos A real human reads the last 60 paid posts on every shortlist name and hands back the disclosure history. Book a 20-minute roster review →

How to write a brief that clears review

The brief is eight lines, no more.

Line one names the disclosure word in plain English.

Line two names the affiliate code and ties it to the disclosure.

Line three bans the fully anonymous claim.

Line four bans the hacker scare line.

Line five names the brand handle to tag.

Line six requires a spoken disclosure in the first 30 seconds.

Line seven requires on screen disclosure text for the same window.

Line eight names a final caption review before the creator posts.

The brief reads short on purpose.

A legal team that opens a five page brief stops at page two. A legal team that opens an eight line brief signs it on the first read.

Sanity check: would I lose a great creator by ruling out anyone with a buried code in their back catalog? No, because most of them fix it once the brief spells it out. We hand this brief to every VPN brand we manage, and it has held across NordVPN, Surfshark, and ExpressVPN deals in our deal log.

The cost of getting this wrong

The dollar cost of a wrong brief is not the wasted post.

It is the YouTube strike that pulls the creator's other sponsored videos while your campaign is live.

Picture a brand that booked a creator at the rates our team collected, like the $3,000 Doug DeMuro quoted for one 75 second integration or the $45,000 Magnus Midtbø quoted for a standard read.

A strike mid flight does not just lose that one post. It freezes the slot and the affiliate code stops paying, so the brand eats the fee and loses the sales the code was meant to drive.

The eight line brief costs zero to write and clears that risk on the first creator deal.

FAQ

See the frontmatter FAQ block.

Where We Come In

We run the disclosure check for every VPN creator deal you ship.

The past deal history, repeat deal patterns, and platform flag risk for every NordVPN, Surfshark, and ExpressVPN creator worth looking at already live in our database across 1,768 distinct VPN creators and deals spanning 2018 to 2026.

The bounded downside is one careful pilot.

The unbounded upside is a 12 month roster that ships month over month without a YouTube policy strike.

Speak with us when you want the list built right.

Vetting is the moat.

Reading loop

Frequently asked

  • What is the single biggest compliance rule VPN brands miss on creator deals?

    The FTC Endorsement Guides at 16 CFR Part 255, the federal rule that requires a paid post to disclose the paid tie. The most common miss is the affiliate code. VPN is the most affiliate driven sponsor category we track, and a code like nordvpn.com/creator counts as a paid relationship that must be disclosed. Mentour Pilot has run 25 paid NordVPN posts in our deal log with the disclosure in the opening line, and every one cleared review.

  • What language gets a VPN creator post flagged?

    Three patterns break a post. A buried affiliate code with no disclosure word near it. A hard scare line like hackers can steal your bank details. A claim the VPN keeps you fully anonymous. Replace them with the word ad in line one, the brand handle, and a plain offer arrow to the code link. Rhett and Claire used this softer pattern across 44 paid NordVPN posts.

  • Does the brand or the creator carry the liability?

    Both, and the brand carries the bigger share because the brief is the originating instruction. The FTC names the brand on the order and the creator on the disclosure. Across the 749 NordVPN creators and 912 Surfshark creators in our database, the brands that hand out a fixed disclosure line see far fewer buried codes.

  • What is the worst case penalty for getting this wrong?

    An FTC warning letter to the brand, a forced edit or takedown of the video, and a YouTube policy strike that can pull the creator's other sponsored videos mid campaign. A strike on a channel like Cybernews, with 26 VPN deals in our log, would freeze a paid slot the brand already booked.

  • How do I write a brief that clears legal and platform review on the first pass?

    Eight lines. Disclosure word in line one. Affiliate code named and tied to the disclosure. No fully anonymous claim. No hacker scare line. Brand handle tagged. Spoken disclosure in the first 30 seconds. On screen disclosure text. Final caption review before the creator posts.

Next issue, every Monday

We found the best performing creators for May 25 → May 31.Hand-picked, not the same five names.

Plus the Influencer Advisory Consultant GPT.