  Influencer VPN ads (sponsored segments) on YouTube often disseminate
misleading information about both VPNs, and security & privacy more broadly.
However, it remains unclear how (or whether) these ads affect users'
perceptions and knowledge about VPNs. In this work, we explore the relationship
between YouTube VPN ad exposure and users' mental models of VPNs, security, and
privacy. We use a novel VPN ad detection model to calculate the ad exposure of
217 participants via their YouTube watch histories, and we develop scales to
characterize their mental models in relation to claims commonly made in VPN
ads. Through (pre-registered) regression-based analysis, we find that exposure
to VPN ads is significantly correlated with familiarity with VPN brands and
increased belief in (hyperbolic) threats. While not specific to VPNs, these
threats are often discussed in VPN ads. In contrast, although many participants
agree with both factual and misleading mental models of VPNs that often appear
in ads, we find no significant correlation between exposure to VPN ads and
these mental models. These findings suggest that, if VPN ads do impact mental
models, then it is predominantly emotional (i.e., threat perceptions) rather
than technical.
