Search for "ExpressVPN affiliate commission" and you'll find confident figures. A dollar amount per sale, a cookie window, a payout threshold. Cited nowhere, repeated everywhere.
ExpressVPN's own FAQ says something different: the commission structure is determined by the insertion order signed between ExpressVPN and each individual publisher, and refers you to your own signed IO for the applicable rates.
There is no public rate. Every specific number you've read for that program is somebody else's negotiated deal, presented as though it were a rate card.
This is more common than you'd think
Going through one category program by program, three of the best-known brands publish no commission figure whatsoever:
ExpressVPN negotiates per publisher via an insertion order. It does state two useful things clearly: it works on a CPA basis with all affiliates and pays no recurring commissions, and it permits PPC advertising provided you don't bid on brand terms — a real point of difference in a category where most brands ban paid search outright.
Norton publishes a partner page with no rate, no cookie window and no payout threshold. It confirms the program runs on Impact, and that's all you learn before enrolling.
Dashlane doesn't run a self-serve program at all. Its affiliates page is a partnership enquiry form asking for your company, website and marketing proposal, with "Affiliate" listed alongside "Strategic" and "Reseller". No terms are published anywhere on it.
A fourth, Bitdefender, publishes rates but no attribution window — and its published base rate turned out to be half what's commonly quoted for it.
Why brands do this
Three reasons, and only one of them is unreasonable.
Rates genuinely vary by publisher. A site sending 10,000 qualified visitors a month is worth different terms from one sending 50. Publishing a single figure would either undersell the large partners or overpromise to small ones.
Rates vary by geography. One trading platform we checked states plainly that commissions differ by country and invites you to contact the team for a tailor-made deal. A published number would be wrong nearly everywhere.
And sometimes the rate isn't competitive. If a brand's terms are mediocre, not publishing them keeps you in the funnel long enough for a salesperson to sell you on everything else.
What "up to" actually means
Related trap. "Up to 50%" is not a rate; it's a ceiling. One crypto platform we checked breaks its "up to 50%" into six different products, and only two of them reach 50% — the rest land at 10%, 4%, or "tailored". Another's 100% headline applies solely to the first payment on its cheapest monthly plan, which is also the plan customers churn out of fastest. Its annual tiers pay 40%, and earn more per referral.
Treat every "up to" as the best case for the best-performing publisher on the best-converting product.
How to work with programs that don't publish
Don't plan around a number you can't source. If you're deciding whether a program is worth a review post, and the rate is unpublished, the honest input to that decision is "unknown" — not the figure you found on a listicle.
Apply anyway, if the fit is right. Unpublished doesn't mean bad. It means you'll learn the terms at the point of approval, and some of these programs pay well. Applying costs you a form.
Ask before you write. Once approved, you'll have an account manager or an insertion order. Get the rate, the attribution window and the payout threshold in writing before you commit content to it.
Watch the qualification bar, not just the rate. One platform pays CPA on "qualified" first-time depositors — where qualifying means the customer generated minimum net revenue or opened and closed a position. A funded account that sits untouched pays nothing. A high CPA with a strict qualification bar can be worth less than a modest one without.
What we do with these listings
Where a program publishes no rate, we leave the commission and cookie fields empty rather than importing a figure from elsewhere. The entry says what the brand actually states, names the network where we've confirmed it, and says plainly that the rate is negotiated.
An empty field is more useful than a confident wrong one. It tells you exactly what you'll need to ask about, which is the thing you actually need to know.
For more on reading the terms themselves, see how affiliate cookies work and CPA vs revshare vs recurring.