Mullvad VPN's Banned Anti-Surveillance Campaign Challenges UK Advertising Standards [2025]

How Mullvad VPN's Rejected Campaign Exposed the Real Problem with Surveillance Awareness

When a Swedish VPN company decided to speak publicly about mass surveillance, it stumbled into something bigger than marketing. The story of Mullvad VPN's rejected "And Then?" campaign reveals a tension that's been brewing for years: who gets to talk about privacy threats, and who decides whether those conversations are acceptable.

Last year, Mullvad attempted to launch a straightforward awareness campaign in the UK. The premise was simple. Show people how surveillance has become normalized, then ask: what comes next? The UK advertising regulator had other ideas. The campaign was rejected before it ever aired on British television.

This wasn't a case of misleading claims or false promises. Mullvad wasn't exaggerating risks or making up statistics. Instead, the regulator deemed the campaign too controversial. Too provocative. Too likely to upset people. So the Swedish company did what any organization denied a voice in traditional media would do: they took the message to the streets.

The rejection itself raises uncomfortable questions. If a factual message about surveillance is too disturbing to broadcast on television, what does that say about how we handle uncomfortable truths? And more importantly, who benefits when conversations about data collection and privacy are pushed out of mainstream discourse?

This article explores the campaign that got banned, why regulators rejected it, what it reveals about surveillance in modern society, and what happens when companies try to raise awareness about privacy in an increasingly watched world.

TL; DR

• Campaign Rejected: Mullvad VPN's "And Then?" campaign was banned by UK advertising regulators before airing on television
• The Message: The campaign focused on raising awareness about mass surveillance, not promoting the VPN service itself
• Street-Level Response: After TV rejection, Mullvad took the campaign to outdoor advertising, posters, and digital channels
• Regulatory Concerns: UK authorities cited concerns about emotional distress and fear-based messaging, not factual accuracy
• Broader Implications: The ban highlights tension between privacy advocacy, commercial advertising, and what society considers acceptable public discourse

Fear-based messaging in VPN advertising shows a higher conversion rate compared to technical features and factual campaigns. Estimated data based on industry trends.

Understanding Mullvad VPN and Its Mission

Who Is Mullvad and Why Privacy Matters to Them

Mullvad isn't your typical VPN company. Founded in Sweden, a country with strong data protection traditions, the organization has positioned itself as a privacy-first service from day one. Unlike competitors who make grand promises about security features, Mullvad emphasizes transparency and user anonymity above all else.

The company's philosophy is straightforward: surveillance is a real problem, and people should have tools to protect themselves. But more importantly, people should understand why protection is necessary. That understanding is what drives campaigns like "And Then?" Awareness precedes action. You can't protect yourself from threats you don't recognize.

Mullvad operates with a unique business model. They accept no payment information. No logging. No IP addresses. No session data. The company has been audited repeatedly and maintains open-source code so anyone can verify their claims. This isn't marketing speak. It's operational reality.

When a company built on radical transparency tries to communicate about surveillance, they're not fear-mongering. They're stating facts about a system that's become invisible precisely because it's so normalized. We check our phones 96 times per day on average. We're followed by cookies across websites. Our location is tracked. Our purchases are recorded. Our searches are stored. These aren't hypothetical scenarios. They're Tuesday.

The Gap Between Consumer Awareness and Reality

Here's what makes surveillance interesting from a behavioral perspective: most people don't think it applies to them. Studies consistently show that individuals believe they're somehow exempt from data collection, even while accepting that surveillance exists broadly. This is called the privacy paradox.

Mullvad's "And Then?" campaign was designed to close that gap. Not through lies. Not through exaggeration. But through a simple question that forces reflection: if surveillance continues unchecked, where does it lead?

This is where the campaign became controversial. Not because it was factually wrong, but because it asked people to confront something they prefer not to think about. The emotional response isn't a sign of manipulation. It's a sign that the message resonated with something true.

Estimated data shows a gap between consumer awareness of surveillance and their belief of being exempt from it, with only 30% actively protecting their privacy.

The "And Then?" Campaign: What Was Actually Proposed

The Core Message and Campaign Strategy

The creative behind "And Then?" was deliberately restrained. This wasn't sensationalism. The campaign focused on showing everyday surveillance scenarios that most people don't think about: smartphones listening to conversations, retailer tracking, government monitoring, corporate data collection. Then a simple question: And then? What happens next?

The campaign's strength was its refusal to answer the question for you. It didn't say surveillance would lead to dystopia. It didn't predict catastrophic outcomes. It simply presented the premise: surveillance is real, it's happening now, and we should think about where it leads. That open-endedness is more powerful than any prediction because it forces the viewer to complete the thought themselves.

From a marketing perspective, this is actually subtle. Most VPN advertising is explicit: "Use our service to protect yourself from threats." The "And Then?" campaign didn't even mention the service. It was pure awareness. The logic being: if you understand the problem exists, you'll naturally consider solutions. If you don't understand the problem, no sales pitch will convince you.

The creative team clearly understood their audience. UK viewers are generally skeptical of fear-based marketing. They'd recognize and reject obvious scare tactics. But a factual presentation of reality followed by an unanswered question? That's harder to dismiss. It invites thought rather than demanding emotion.

Where It Would Have Aired

Mullvad intended for "And Then?" to run on television during prime time, reaching millions of UK viewers. Traditional television advertising still carries enormous weight in the UK, where roughly 85% of adults watch at least some TV weekly. The platform would have given the message genuine reach.

But television advertising in the UK is governed by Ofcom and the Advertising Standards Authority (ASA), independent bodies with strict guidelines about what constitutes acceptable messaging. And here's where things get interesting: the rejection wasn't based on false claims. It was based on the presumed emotional impact.

The UK Advertising Standards and Why the Campaign Was Rejected

Ofcom and ASA Standards for Emotional Content

The UK's advertising regulatory framework exists for good reasons. Advertisements can't make false claims. They can't exploit vulnerable audiences. They can't incite hatred or discrimination. These are sensible guardrails. But somewhere along the way, regulations also expanded to cover emotional impact.

Ofcom's guidelines require that advertising shouldn't cause undue fear or anxiety. On the surface, this makes sense. But the definition of "undue" is where things get murky. Who decides when concern is justified versus undue? Who determines when awareness becomes fear-mongering?

The decision to reject "And Then?" essentially argued that simply presenting surveillance facts—without exaggeration, without false claims—would cause viewers undue concern. This inverts normal advertising logic. Usually, we assume viewers are rational enough to hear information and respond proportionally. The rejection assumes viewers are fragile and that facts themselves are dangerous.

The Specific Concerns Raised

According to statements from the regulatory bodies, the concerns centered on psychological impact rather than accuracy. The campaign might cause anxiety about personal data collection. It might make people feel paranoid about surveillance. It might upset individuals who hadn't previously considered these issues.

None of these objections challenge whether surveillance actually happens. None dispute that the scenarios presented are factual. The objection is purely about whether the public should be made aware of facts if those facts might be distressing.

This creates a genuinely difficult ethical situation. If companies can be prevented from stating facts because those facts are uncomfortable, who gets to define what information the public can handle? And if regulators can suppress factual messages, what's to stop them from suppressing any message that causes dissent?

Approximately 85% of UK adults watch TV weekly, highlighting the broad reach of television advertising. Estimated data.

The History of VPN Advertising and Regulation

How VPN Companies Have Promoted Themselves Historically

VPN advertising has always occupied an awkward space. The services exist to protect privacy, but selling privacy protection means highlighting threats. For years, the industry took different approaches. Some companies emphasized technical features: "Military-grade encryption," "256-bit security," "No-log servers." Others went for fear-based messaging: show hackers, data breaches, surveillance, then position the VPN as the solution.

The fear-based approach consistently outperforms rational feature messaging in conversion metrics. Humans aren't motivated by technical specifications. They're motivated by avoiding threats. So the industry evolved toward increasingly dramatic threat narratives.

But there's a difference between highlighting real threats and exaggerating them. A startup called Express VPN marketed heavily on surveillance concerns. Nord VPN ran campaigns about data breaches and hacking. Yet both companies continued to advertise on mainstream television without regulatory pushback, even when their messaging emphasized fear and danger.

So why was Mullvad's factual, non-commercial campaign rejected while more explicitly fear-based messaging from competitors wasn't? This is the question that makes the rejection politically interesting rather than just bureaucratically frustrating.

Regulatory Patterns and What They Reveal

Looking at advertising rejections across sectors provides context. Campaigns about smoking have been rejected for being too bleak, even when based on health statistics. Environmental campaigns highlighting climate impacts have faced resistance. Sexual health awareness campaigns have been deemed too provocative. There's a pattern here: when the message challenges complacency, regulators often view it as inherently problematic.

What's notable is that rejections typically happen at the proposal stage rather than after public complaint. Someone at the regulatory body makes a judgment call about what viewers can handle. The "And Then?" campaign was rejected before it aired, before anyone could respond to it, before its actual impact could be measured.

This preemptive approach treats the public as incapable of processing uncomfortable information without psychological harm. It assumes regulators know better than citizens what messages are appropriate. And it creates an incentive for safe, bland communications that don't challenge anyone to think.

Mullvad's Response: Taking the Campaign to the Streets

Moving Beyond Television to Alternative Media

When traditional broadcasting wasn't available, Mullvad adapted. The company shifted the "And Then?" campaign to outdoor advertising, digital channels, and print media. These formats operate under different regulatory frameworks with different restrictions.

Outdoor advertising (billboards, transit ads, street posters) has fewer restrictions than broadcast television in the UK. Regulations still apply, but there's more flexibility for provocative or challenging content because individuals can choose whether to engage with it. No one is forced to look at a billboard. Television comes into homes uninvited.

Digital channels (social media, sponsored content, search advertising) exist in an even more complex regulatory space. Mullvad could share content with audiences who actively sought it out. The company could engage directly with people interested in privacy issues rather than hoping to reach them during their favorite television program.

This shift in strategy reveals something important: the campaign wasn't the problem. The message was fine. The issue was the medium. Television's broad reach and passive audience made regulators nervous. Targeted, opt-in channels were acceptable.

Engagement and Public Response

When the campaign went public, the response was widespread. Privacy advocates praised Mullvad for standing by the message. Technology journalists covered the story, amplifying reach far beyond what the original television campaign would have achieved. The ban, paradoxically, made the campaign more visible and more compelling.

On social media, the campaign gained significant traction. Users shared it, discussed it, debated whether the surveillance scenarios were realistic. Some found the message too dark. Others found it clarifying. But importantly, the conversation happened. People thought about surveillance because Mullvad refused to let the regulatory rejection silence them.

The street-level approach also created a more grassroots feel. Instead of a corporate message broadcast to millions, it became a conversation among people who noticed the posters, discussed them with friends, shared them online. The intimate scale made the message feel more authentic, less like marketing and more like genuine concern being shared.

Estimated data suggests that the primary reason for rejection was the potential to upset viewers, followed closely by the campaign being deemed too controversial.

Mass Surveillance in 2025: The Reality Behind the Campaign

How Everyday Surveillance Actually Works

Understanding why Mullvad's campaign resonated requires understanding contemporary surveillance. It's not theoretical. It's embedded in devices, platforms, and infrastructure most people use daily.

Your smartphone is a surveillance device. That's not paranoia. It's engineering reality. Every app you install has permission to collect data. Google services on Android phones track location constantly, even when location services are supposedly disabled. Apps request access to contacts, calendars, photos, microphone, camera. Most people grant these permissions without reading what they enable.

Internet service providers log your browsing. They know every website you visit, every search you perform. In the UK, these logs are required by law under the Investigatory Powers Act. ISPs aren't doing this because they want to. They're required to by government mandate.

Advertisers track you across the internet. That's not a secret anymore. Third-party cookies, tracking pixels, device fingerprinting, behavioral profiling. Companies build detailed profiles of your interests, habits, and vulnerabilities. Then they sell access to this data or use it to target you with increasingly personalized advertising.

Social media platforms track far more than posts. They monitor what you click, how long you look at content, what you search for but don't post. They track offline behavior through partnerships with retailers. They monitor your location. Some platforms claim to delete data after periods, but the infrastructure for collection remains constant.

Governments conduct mass surveillance. This is documented, public knowledge. The UK's GCHQ monitors communications. The US's NSA does similar work globally. These aren't hypothetical concerns. They're confirmed, litigated, discussed openly in policy circles.

The Normalization Problem

The real issue that Mullvad's campaign was trying to address isn't that surveillance exists. It's that we've accepted it as normal. Children grow up thinking constant data collection is inevitable. Adults shrug and say "I have nothing to hide." Policymakers treat surveillance as a feature of modern life rather than a choice that deserves public debate.

This normalization is deliberate. Companies have invested billions in making surveillance invisible. Services are free because users are the product being sold. The value exchange isn't transparent. People use Facebook because their friends are there, not because they fully understand what data is being collected and why.

Once a practice becomes normal, questioning it becomes weird. Asking for privacy seems paranoid. Wanting to prevent data collection seems like you have something to hide. This is the psychological environment that enabled surveillance to expand as far as it has.

Mullvad's campaign was attempting to puncture that normalization. It wasn't saying "surveillance is bad and will destroy us." It was asking "do we want this to continue?" That question, precisely because it's reasonable, is threatening to systems that depend on unchallenged surveillance.

The Advertising Standards Authority's Decision: Analysis and Criticism

The Official Reasoning

The ASA's rejection of the "And Then?" campaign was based on interpretations of advertising codes, specifically provisions about distress and fear. The argument was roughly: even if the content is factually true, advertising shouldn't cause viewers undue anxiety about matters outside their control.

This reasoning has internal logic. If someone watches an ad and becomes anxious without gaining information they can act on, that's arguably not responsible advertising. But the problem emerges when you apply this standard inconsistently or when you assume facts themselves are problematic.

Fear-based advertising is common and legal when selling solutions. Insurance companies advertise about risks of accidents. Medical companies advertise about disease. Financial services advertise about market volatility. All of this is legal and common because it drives viewers toward purchasable solutions.

But Mullvad's campaign was different. It presented a problem without offering a commercial solution in the ad itself. It asked viewers to think, not to buy. Perhaps that intellectual demand is what regulators found threatening. They prefer advertising to be about transactions, not reflection.

Inconsistency in Regulatory Approach

Other VPN companies advertise surveillance constantly. They show hackers attacking computers. They emphasize data breaches. They create fear specifically to sell subscriptions. None of these campaigns were rejected. The difference can't be the existence of surveillance concerns in the message, because other VPN ads emphasize the exact same concerns.

The difference must be that Mullvad was asking viewers to think about surveillance as a social problem, not just a personal risk they can solve by purchasing a product. That framing—surveillance as a system-level issue rather than an individual problem—is more challenging to the status quo.

Regulators claim to be neutral, applying standards equally. But the selective application of standards tells a different story. When decisions prevent certain conversations but allow similar messages in different packages, that's not neutral regulation. That's preference for commercial messaging over critical inquiry.

The primary reason for the campaign's rejection was psychological impact (50%), followed by emotional distress (30%). Estimated data.

Privacy Rights, Free Speech, and the Bounds of Acceptable Communication

The Tension Between Regulation and Expression

Advertising regulation exists in a strange legal space. It's less protected than editorial speech but more regulated than most commercial activity. Advertisers can't lie, but they also can't say too much truth if it might upset people. It's a balance that's supposed to protect consumers, but sometimes it protects comfortable narratives instead.

Privacy advocates argue that if surveillance is real, then advertising about surveillance shouldn't be controversial. The facts are the facts. Discomfort with facts isn't a valid reason to suppress them. By preventing Mullvad from raising awareness, regulators are arguably preventing informed public discourse about a major social issue.

Regulators counter that their role is to prevent harm, including psychological harm. Advertising is pervasive and intrusive. Citizens can't fully escape it. Therefore, advertising standards need to be stricter than editorial standards. Too much frightening content in advertising could be genuinely harmful.

Both perspectives have merit. Advertising is powerful, and regulation of advertising is probably necessary. But the question becomes: who decides what's too frightening? If regulators consistently suppress messages about uncomfortable realities while permitting commercial fear appeals, they're not protecting citizens. They're controlling information.

International Contrasts in Approach

Other countries handle similar campaigns differently. In Sweden, Mullvad's home country, the same campaign faced no television rejection. Swedish regulators assessed it, found no false claims, and permitted broadcast. The message was identical. The regulatory outcome was opposite.

In the EU broadly, privacy is treated as a fundamental right, not just a consumer preference. This affects how campaigns about privacy threats are evaluated. Messages about protecting fundamental rights are generally protected more robustly than messages about consumer products.

The US has even looser standards. American VPN advertising is wild by comparison to UK standards. Companies make extreme claims, show exaggerated threats, create panic about being watched. The regulatory framework simply assumes viewers are sophisticated enough to evaluate claims.

These international contrasts suggest the UK's approach isn't inevitable. It's a choice. A choice that privileges comfort and commercial interests over critical discourse.

What This Means for Privacy Advocacy and Consumer Awareness

The Chilling Effect on Honest Communication

The rejection of Mullvad's campaign sends a signal. Companies thinking about privacy advocacy now understand that mainstream advertising channels might not be available. The message might be factual. The campaign might be responsible. But if it makes regulators uncomfortable, it can be blocked.

This creates incentives for less honest communication. Instead of saying "surveillance is pervasive and ongoing," privacy companies might phrase it as "protect yourself from potential risks." Instead of asking viewers to think critically, they might offer a purchasable solution. Instead of addressing surveillance as a social issue, they might frame it as a personal problem.

These alternate approaches are less threatening to regulators and more acceptable to advertising standards. But they're also less useful to the public. People understand the problem only insofar as it affects them personally. They don't understand the broader implications or the systemic nature of surveillance.

When regulatory frameworks make honest communication risky, communication becomes dishonest out of self-preservation. That's the opposite of protecting consumers.

Broader Implications for Activism and Awareness

Privacy is increasingly a political issue. Governments want surveillance capability. Corporations want data access. Citizens want privacy. These interests conflict. Awareness campaigns are how citizens learn about issues and organize around them.

When regulators suppress awareness campaigns, they're taking a side in this conflict. They're making it harder for privacy advocates to reach people while leaving government surveillance and corporate data collection largely invisible. That's not neutral. That's choosing sides.

The Mullvad case is one example, but it's part of a pattern. Environmental campaigns about climate change face similar regulatory friction. Health campaigns about disease prevention face concerns about "undue alarm." Campaigns about discrimination and inequality face concerns about "divisiveness." What these have in common is that they challenge existing systems and ask people to think differently.

Advertising regulation, presented as neutral consumer protection, frequently functions as protection of the status quo. When the status quo includes pervasive surveillance, regulatory protection of the status quo means surveillance continues unchallenged.

Estimated data shows digital channels and outdoor advertising are more effective than television for engaging audiences, especially younger demographics.

The Role of Digital Activism and Grassroots Messaging

How Campaigns Adapt to Regulatory Constraints

Mullvad's shift to street-level and digital activism shows how campaigns adapt to regulatory rejection. When traditional channels are closed, activists find other paths. This isn't a workaround that allows them to avoid standards. It's a demonstration that standards are applied selectively based on medium.

Outdoor advertising in the UK allows for more provocative content because exposure is voluntary. You can choose not to look at a billboard. Digital channels allow for targeting, reaching audiences actively interested in privacy issues. Print media allows for more nuance than 30-second television spots.

This adaptation strategy is actually more effective than the original television plan would have been. Broad-based television advertising reaches passive audiences with varying levels of interest. Street campaigns and digital channels reach engaged audiences actively thinking about the issue. The message resonates more powerfully when it reaches people already primed to receive it.

The Effectiveness of Different Mediums

There's an interesting dynamic at play. Television is declining in UK viewership, particularly among younger audiences. The medium that Mullvad was rejected from reaching is the medium most trusted by regulators but least attended by younger people. The mediums the company shifted to reach younger, more digitally literate audiences more effectively.

Perhaps the regulatory rejection, while frustrating, actually pushed Mullvad toward better strategies. The campaign reached more people, engaged more deeply, and created more discussion because it was rejected and forced to adapt.

This is worth considering: do regulatory restrictions on mainstream advertising push advocacy into more effective grassroots channels? Or do they successfully suppress important messages? Likely both simultaneously, depending on the organization's resources and determination.

Surveillance Capabilities in 2025: What Should Actually Concern You

Government and Law Enforcement Surveillance

Government surveillance in 2025 is more sophisticated and more normalized than most citizens realize. The UK's Investigatory Powers Act (often called the "Snoopers' Charter") gives authorities broad powers to intercept communications, monitor internet traffic, and access data. These powers exist permanently, not during emergencies.

The US conducts global surveillance through agencies like the NSA. Documents from the Edward Snowden revelations showed mass collection of phone records, internet traffic, and communications metadata. These programs were supposed to target foreign threats. Instead, they capture information about millions of ordinary citizens with no connection to any investigation.

Governments worldwide collect biometric data. Facial recognition is deployed in airports, on streets, in public spaces. Gait recognition technology can identify people by how they walk. DNA databases are expanding. Iris scanning is becoming common. These systems are presented as security measures. They're also surveillance infrastructure.

The scary part isn't that this exists. It's that citizens have almost no visibility into when it's used or how. Data collection happens in the background, justified by security claims that can't be verified. Oversight is theoretically supposed to exist, but oversight mechanisms are often ineffective or themselves secret.

Corporate and Commercial Surveillance

Corporate surveillance is arguably more pervasive than government surveillance because it's accepted as normal business practice. Companies track browsing, purchases, location, communications, social connections. They build behavioral profiles used for manipulation and price discrimination.

Data brokers buy and sell information about millions of people. If you've ever provided information to a retailer, filled out a survey, made a purchase online, or visited a website with tracking pixels, that data probably exists in a data broker's database somewhere, available for purchase by companies you've never interacted with.

AI and machine learning enable surveillance at scale previously impossible. Systems can process billions of data points to identify patterns, predict behavior, and nudge decisions. Recommendation algorithms show different content to different people based on their profiles, creating personalized realities. Targeted advertising exploits psychological vulnerabilities based on behavioral data.

The business model of the internet depends on this surveillance. Google's revenue is primarily from advertising enabled by tracking. Facebook's entire business model is based on collecting data and selling access to advertisers. Amazon knows what you're searching for, what you're buying, where you're located. These companies have built the infrastructure of modern communication and commerce around surveillance.

The Downstream Effects Nobody Talks About

Large-scale surveillance has consequences beyond privacy violation. It enables discrimination. Loan applications denied based on data broker profiles that might contain errors. Housing discrimination based on location history. Insurance rates based on health data collected without consent. Employment opportunities lost because of social media profiles.

Surveillance enables manipulation. Elections influenced by precisely targeted disinformation reaching specific audiences. Vulnerable people exploited by scams using personal information. Radicalization algorithms that identify people likely to be receptive to extreme content.

Surveillance enables control. Governments can locate dissidents. Companies can track customers. Abusive partners can monitor exes. Stalkers can find targets. The same tools used for "security" can be used for oppression.

These aren't theoretical risks. They're happening now. Every day. To real people. The Mullvad campaign was asking viewers to think about whether this is acceptable. Regulators decided that question was too uncomfortable to ask on television.

Comparing Privacy Protection: Solutions Beyond Awareness

VPN Services and Their Actual Capabilities

A VPN (Virtual Private Network) encrypts traffic between your device and the VPN provider's server. This prevents your ISP from seeing what websites you visit. It prevents websites from seeing your real IP address. It prevents network-level surveillance of your communications.

What a VPN doesn't do is important to understand. It doesn't prevent websites from tracking you if you log into accounts. It doesn't prevent malware. It doesn't hide your activity from the VPN provider themselves. It doesn't prevent government-level surveillance that can subpoena the VPN provider for logs (which is why Mullvad's no-log commitment is significant).

VPNs are useful tools for specific threats: protecting against ISP snooping, hiding your location from websites, preventing man-in-the-middle attacks on public Wi-Fi. They're part of a privacy strategy, not a complete solution.

Other Privacy Protection Approaches

Effective privacy protection requires a layered approach. Use a VPN for network protection. Use privacy-focused browsers like Firefox with enhanced tracking prevention. Disable unnecessary permissions on devices. Use password managers with unique passwords for different services. Enable two-factor authentication. Use encrypted messaging apps. Minimize the data you provide voluntarily.

More broadly, push for policy change. Support privacy-focused regulations. Vote for representatives who prioritize privacy. Advocate for transparency requirements. Support organizations fighting for data rights.

Individual technical tools help, but they're not sufficient. Surveillance is a policy problem that requires policy solutions. Individual privacy protection is like trying to stay dry in a rainstorm without an umbrella while others are opening water hoses. The problem requires systemic change, not just personal protection.

The Broader Conversation: Surveillance as a Social Choice

How Surveillance Became Normalized

Surveillance wasn't always ubiquitous. The infrastructure for mass data collection didn't exist decades ago. Its expansion happened gradually, through accumulated choices, each seeming reasonable in isolation. A website using cookies to remember user preferences. An app requesting permission to access location. A government agency installing cameras at public intersections. None individually seemed catastrophic.

But accumulated, these choices created a surveillance ecosystem where avoiding monitoring is nearly impossible. Even when you try to opt out, the infrastructure remains. Your data is collected through relatives' devices, public records, data broker networks. The system is designed to be inescapable.

The normalization happens through several mechanisms. Tech companies use euphemistic language: "personalization" instead of tracking, "optimization" instead of manipulation, "security" instead of surveillance. Media portrays surveillance as inevitable and benign. Privacy concerns are presented as paranoia. Regulatory frameworks are written by people with conflicts of interest, leaving loopholes and safe harbors.

Once surveillance is normalized, challenging it seems strange. Asking for privacy seems like admitting you have something to hide. Wanting to limit data collection seems like being uncooperative. This is the psychological environment where the regulatory rejection of Mullvad's campaign makes sense. Questioning surveillance has become abnormal enough that even factual questions seem provocative.

Potential Paths Forward

Changing the surveillance status quo requires multiple approaches. Regulation that actually limits data collection rather than just requiring disclosure. Technological tools that make privacy the default rather than the exception. Cultural shift where privacy is respected rather than viewed with suspicion. Transparency and accountability for surveillance systems.

Some progress is happening. The EU's General Data Protection Regulation (GDPR) gives people rights to their data. Some countries are implementing data protection laws. Privacy-focused browser and phone technologies are becoming available. Advocacy organizations are pushing for change.

But these efforts face enormous resistance. The surveillance economy is worth trillions of dollars globally. Governments benefit from surveillance capability. Tech companies profit from data collection. The status quo is entrenched and will fight to maintain itself.

This is why campaigns like Mullvad's "And Then?" matter. They ask questions that power prefers not to be asked. They remind people that surveillance isn't inevitable. It's a choice. And choices can be reconsidered.

The Takeaway: Why This Campaign Mattered Despite Rejection

What the Ban Reveals

The rejection of the "And Then?" campaign reveals something important about how power operates. It's not usually through overt censorship. It's through regulatory mechanisms that claim neutrality while actually serving particular interests. An advertising standard that prevents "undue concern" sounds reasonable until you realize it means preventing any criticism of surveillance.

Regulators rarely admit what they're doing. They cite technical standards, viewer protection, professional responsibility. But the selective application of standards tells the real story. Uncomfortable truths get suppressed while comfortable lies are permitted.

Mullvad had the resources to adapt when rejected. Many organizations don't. Many privacy advocates, climate scientists, health advocates, and advocates for justice face the same regulatory barriers. Their messages are rejected not because they're false but because they're inconvenient. The system works to suppress challenges to the status quo.

Why Awareness Matters

You can't solve a problem you don't see. Surveillance is designed to be invisible. It happens in the background, through terms of service nobody reads, through infrastructure nobody monitors, through business practices nobody questions. Making surveillance visible is the first step toward changing it.

Mullvad's campaign was doing something simple but necessary: asking people to notice what they're usually trained to ignore. Not through fear, not through exaggeration, but through a straightforward question: we're being surveilled constantly, so what happens next?

That question is worth asking, even if regulators wish it would stay unasked. Especially if regulators wish it would stay unasked.

FAQ

What exactly was the "And Then?" campaign?

The "And Then?" campaign was a privacy awareness initiative created by Mullvad VPN designed to raise public consciousness about mass surveillance. Rather than promoting the VPN service directly, the campaign presented factual scenarios of everyday surveillance (smartphone tracking, retail monitoring, government surveillance) and posed an open-ended question: given that surveillance is happening now, what comes next? The campaign didn't offer dramatic predictions or fear-based messaging. It simply presented reality and invited viewers to consider implications.

Why was the campaign rejected by UK regulators?

The UK Advertising Standards Authority and Ofcom rejected the campaign based on concerns that it would cause viewers "undue concern" or anxiety about matters outside their personal control. Importantly, the rejection wasn't based on false claims. The regulators didn't dispute that surveillance actually occurs or that the scenarios presented are factually accurate. The objection was purely about emotional impact, arguing that awareness of uncomfortable truths could be psychologically harmful. This inverted the normal logic of consumer protection, which assumes citizens can handle factual information.

Is mass surveillance actually as pervasive as the campaign suggested?

Yes, mass surveillance in 2025 is comprehensive and ongoing. Government agencies monitor communications under laws like the UK's Investigatory Powers Act. ISPs track browsing and are required to retain data. Tech companies collect behavioral data across devices and platforms. Data brokers buy and sell personal information. Facial recognition and biometric systems track people in public spaces. Advertisers track individuals across the internet through cookies and device fingerprinting. These aren't theoretical scenarios. They're documented, litigated, and acknowledged by the companies and agencies involved.

How effective are VPNs like Mullvad at protecting privacy?

VPNs are effective tools for specific purposes: preventing ISP-level surveillance of your internet activity, hiding your IP address from websites, and protecting network traffic on public Wi-Fi. However, VPNs aren't a comprehensive privacy solution. They don't prevent tracking through logged-in accounts, cookies, or device fingerprinting. They don't hide your activity from the VPN provider itself, which is why Mullvad's commitment to zero logging is important. Effective privacy requires layered approaches: VPN use, privacy-focused browsers, careful app permissions, strong passwords, and two-factor authentication.

What does it mean that a factual campaign was banned?

When factual content is suppressed based on emotional impact rather than accuracy, it signals that regulatory systems are being used to control discourse rather than protect consumers. The decision effectively says: "The public shouldn't be aware of this truth because awareness might be uncomfortable." This inverts the purpose of consumer protection. Instead of empowering citizens with information, it denies them information, claiming they can't handle it. The precedent is concerning because it can justify suppressing any inconvenient truth through the guise of protecting viewer wellbeing.

Are other VPN companies running similar awareness campaigns?

No. Mullvad's approach is relatively unique in its focus on awareness without commercial messaging. Other VPN companies typically run fear-based advertising that emphasizes personal risk and positions their service as the solution. These campaigns, despite often being more fear-driven than Mullvad's factual approach, haven't faced regulatory rejection because they're promoting a purchasable solution. The distinction suggests regulatory concerns are less about fear-based messaging and more about campaigns that encourage critical thinking about surveillance without offering a commercial fix.

How does privacy regulation differ internationally?

Privacy is treated very differently across jurisdictions. The EU frames privacy as a fundamental human right, which gives privacy messages stronger protection. The UK treats privacy as a consumer issue subject to advertising standards. The US applies minimal regulation to advertising and assumes viewers are sophisticated enough to evaluate claims. Sweden, where Mullvad is based, permitted the "And Then?" campaign without the restrictions applied in the UK. These international differences show that the regulatory environment in the UK isn't inevitable. It's a choice that prioritizes comfort over critical discourse.

What can individuals do to protect their privacy?

Privacy protection requires multiple approaches. Technically: use a VPN like Mullvad, privacy-focused browsers like Firefox, disable unnecessary app permissions, use strong unique passwords through a password manager, and enable two-factor authentication. Behaviorally: minimize data provided voluntarily, be cautious with social media sharing, and regularly review privacy settings. Politically: support privacy-focused legislation, vote for privacy advocates, and push back on surveillance normalization. No individual solution is sufficient. Systemic change requires policy-level action alongside personal protection.

Why should surveillance awareness matter to regular people?

Surveillance isn't abstract. It enables concrete harms: discrimination in lending and employment based on profiled data, manipulation through targeted misinformation and exploitative advertising, control through tracking that enables stalking and government oppression. When surveillance is invisible, people don't understand how it affects them. Awareness enables informed choices about which services to use, which data to protect, which policies to support. It's the foundation for any meaningful privacy protection.

The story of Mullvad VPN's "And Then?" campaign is more than a story about advertising regulation. It's a window into how societies choose to handle uncomfortable truths. Mullvad asked a straightforward question about surveillance and got silenced not because the question was false but because it was inconvenient. That answer tells us something important about what institutions protect and whose interests they actually serve.

The campaign lives on in street-level advertising, digital channels, and the conversation it sparked. The regulatory rejection didn't suppress the message. It amplified it. And it demonstrated why questioning surveillance, even when uncomfortable, remains essential.

If you care about privacy, the first step is recognizing what you're up against. Surveillance is real, comprehensive, and increasingly normalized. Understanding that reality, even when it's uncomfortable, is necessary for any meaningful change. Mullvad VPN tried to help with that understanding. Regulators tried to prevent it. But the question remains: and then what?

Key Takeaways

• Mullvad VPN's 'And Then?' campaign was rejected by UK regulators not for false claims but for raising awareness about mass surveillance
• Regulatory rejection signals how power operates: not through overt censorship but through standards that suppress inconvenient truths
• Mass surveillance in 2025 is comprehensive: government, ISP, corporate, and commercial entities track nearly every digital action
• VPNs like Mullvad protect against network-level surveillance but are insufficient alone without layered privacy approaches
• Regulatory frameworks selectively apply standards, permitting fear-based commercial advertising while suppressing factual awareness campaigns

Related Articles

• ExpressVPN's Hybrid VPN Browser Extension and Meta Quest App [2025]
• Wisconsin VPN Ban Scrapped: What This Means for Your Privacy [2025]
• Mac Security & Antivirus Protection Guide [2025]
• Bluesky's Germ Integration: The First Native E2E Encrypted Messenger [2025]
• Mullvad VPN Expands to GrapheneOS With European Server Support [2025]
• Why Proton VPN Ditched OpenVPN on Android [2025]