In the NordVPN Meta ads I sampled, the word that keeps coming back is antivirus: it appears in 20 of 30 texts, often next to Shaquille O'Neal. The searches around the brand point elsewhere: 6 of the top 10 related queries are about codes, coupons and discounts, and none mentions antivirus.
Sample frame
| Source | Snapshot date | Filters | Ads collected | Texts analysed |
|---|---|---|---|---|
| Meta Ad Library | 2026-11-02 | page facebook.com/NordVPN, activeStatus: active, no country or date filter |
105, all active | first 30 bodies in library order, cut at 300 characters; 17 distinct |
| Google Ads Transparency Center | 2026-11-02 | domain nordvpn.com, no country or date filter |
150 | headline decoded for 5 ads; copy not analysed |
| Google Trends | 2026-11-02 | term "NordVPN", past 12 months | n/a | top 10 and rising 10 related queries |
Meta shows a launch campaign for the antivirus feature; Google shows search text ads for the brand domain. So this compares those two campaigns, not Meta and Google as channels. The Meta export stopped at 105, under its cap of 150, so it is likely close to the page's full active set that day.
What the 30 Meta texts mention
Plain keyword rules; one text can match several.
| Keyword rule | Texts (of 30) |
|---|---|
| "antivirus" | 20 |
| scam, phishing or malware | 12 |
| "Shaq" (incl. Shaquille) | 11 |
| "Black Friday" | 5 |
| IP, privacy or "servers in" | 5 |
| Saily or PriceMice | 3 |
| none of the above | 2 |
The two unmatched texts are one line, "Upgrade to better all-around online protection with NordVPN". Classic VPN vocabulary appears in 5 texts, and 4 of those are one repeated bullet list where the VPN comes second, after the antivirus.
The copy, verbatim
The launch ads put the celebrity up front:
"Some of you already knew. Now everybody does 💥 Shaq and Harry Mack shook up Times Square to deliver a big message: NordVPN now comes with a next-gen antivirus."
Some Shaq lines tie a daily annoyance to the feature:
"Annoying ads? Pffff, @shaq’s got your back! Go big with NordVPN’s next-gen antivirus."
The Black Friday texts frame the deal season as a risk:
"Black Friday is cybercriminals' favorite time of the year — rushed deal-hunting makes it easy to miss the signs of a fake site."
And one argues that the classic VPN promise isn't enough, from a brand with "VPN" in its name:
"If your protection stops at changing your IP, you’re still exposed to the threats that target other points of your data."
Across all 105 ads: 55 dynamic creative, 28 image, 18 video; "Learn more" on 77, "See details" on 8; Instagram as a placement on 94, Facebook on 93, Threads on 78.
A new Meta set, old Google ads
The eight longest-running Meta ads started between October 8 and October 21, 2026; the top one shows 16 days active. Four of them started on October 8 with the "Times Square" and "grand stage" teaser copy.
On Google, all 150 ads come from "nordvpn s.a." and 143 are text ads. The longest-shown was first shown on September 29, 2023 (1,069 days); the other seven of the top eight were first shown August 26–29, 2024, and all eight were still shown on November 2, 2026. The library left their headline and description empty, so I can't say whether they mention antivirus. Seven start dates within four days could be a batch upload or a quirk of the library's history.
What people search for
Trends gives "NordVPN" an average interest of 19.6 over the year, a peak of 100 on August 30, 2026, and 8 now. Top related queries include "nordvpn code", "nordvpn discount", "nordvpn coupon" and "nordvpn promo". Five of the ten rising queries name Surfshark, such as "surfshark promo code". Trends gives no volumes, so this shows what people type, not how many.
The Black Friday texts are where ads and searches meet most directly: "Up to 77% off + 3 extra months" sits in the same text as the antivirus.
What this data can't tell you
- Thirty texts, one day. Counts cover 30 bodies (17 distinct) cut at 300 characters; a later snapshot of such a new set could differ.
- Rough Meta dates. Start dates and "days active" don't line up exactly (an ad started October 8 shows 15 days), so I read them as "October", not precise ages.
- No spend, no results, no Google copy. Nothing here says how NordVPN splits its budget or whether the antivirus message works.
Three tests for your own launch
- Count your launch word in your live ads. After shipping a feature, run the same keyword count over your active copy and decide whether that share is what you want.
- Pair the feature with why people search for you. If your top queries are "code" and "discount", test feature plus offer in one line against a feature-only ad.
- Reread your oldest search ads after a repositioning. If they date from 2023 or 2024, check they still describe what you sell.
Repeating this for a competitor
I built these scrapers. The Facebook Ads Library Scraper takes a Facebook page URL and returns body text, CTA, format, placements and days active, and the Google Trends Scraper returns interest over time plus top and rising queries. Both are no-code forms with CSV or Excel export, free to try on the Apify free plan, and a run of a few hundred ads costs well under a dollar.
Not affiliated with NordVPN; all data is from public ad libraries.
If your product is named after its original feature, would you let a new feature take over most of your social copy, or keep the name's promise in every ad?
Top comments (0)