Canada's C-22 Bill Forces Encryption Services to Weigh Whether to Stay
Canada's proposed bill C-22 could require tech companies to provide data access for law enforcement and retain metadata. Signal and Psiphon VPN say they would leave the country if it passes.
Canada is weighing a bill, C-22, that could effectively require providers of encrypted services to build in access capabilities for user data and to retain more information. Psiphon VPN, a Canadian anti-censorship company whose tools keep millions of Iranians online during government internet shutdowns, has said it will leave the country if the bill becomes law. The case reflects a wider global trend of governments seeking broader access to encrypted data.
What the bill provides
C-22 was first proposed in 2025 and partly revised after sharp criticism from tech companies and civil society. It can place requirements on companies, including those outside Canada, to introduce “technical capabilities” that make data accessible for law enforcement purposes. The bill states that companies need not introduce a “systemic vulnerability,” but opponents argue that any capability to access end-to-end encrypted data amounts to a backdoor that anyone could discover and abuse. AI tools, which make reverse engineering and system mapping easier, raise that risk further.
The bill also contains provisions that could require companies to retain metadata about user activity. Many privacy-focused services, including VPN products from Psiphon and DuckDuckGo, deliberately avoid collecting such data. The companies say they would have to change their business models, while researchers warn that doing so would reduce user trust and increase the potential for widespread surveillance.
Reactions
Signal, the encrypted messaging app, has said it would exit the Canadian market because the law would demand unacceptable changes to its open source projects. Apple and Meta have criticized the bill, and DuckDuckGo and NordVPN say they would consider withdrawing their services. In May, members of the US House Judiciary and Foreign Affairs committees sent a letter to Canadian officials warning that companies could be asked to weaken or defeat encryption.
In recent years the UK and Australia have introduced surveillance reforms that can compel companies to break encryption, and similar proposals have appeared in the EU, France, India, Ireland, Spain, Sweden, Switzerland and elsewhere. Not all have become law.
Joseph Lorenzo-Hall of the Internet Society says moving headquarters is not much of a fallback when the law follows users, and that a true safe haven needs laws allowing companies to keep their privacy promises.
