This can be instantly disproved by examining the cases where valid warrants were presented to them by LEAs and they were unable to provide any user data.
Even if a three-letter agency intercepted your package and swapped your gift card with a known code, I believe Mullvad is not recording the connection between specific gift code and the account number.
You can also exchange unscratched gift cards with friends and strangers.
1. We launched Mullvad 15 years ago. During those 15 years people's interest and awareness of online security and privacy has grown considerably, as has the consumer VPN market.
2. Our strategy is quite different from most of our competitors'. As a result we've grown slower than several of them, but we have nevertheless continued to grow year after year.
3. The costs of the campaign are perhaps lower than you assume.
tl;dr We've slowly grown over many years and are now making enough money to plaster privacy propaganda over your city. Hopefully it's an interesting change from the usual bus ads. Enjoy!