Canada's Bill C-22 would require encryption services to build technical capabilities enabling law enforcement data access and retain user metadata, prompting major privacy platforms to threaten exit from the country.
The proposed legislation, first introduced in 2025 and partially revised following industry pushback, applies to companies inside and outside Canada. It mandates "technical capabilities" for law enforcement access to data while stating companies need not introduce "systemic vulnerabilities." Critics dispute this distinction. The bill also requires metadata retention by services that currently collect minimal user information.
Signal, the encrypted messaging app, said it would leave Canada because the law would force unacceptable changes to its open source projects. Psiphon, a VPN service used by millions of Iranians during internet shutdowns, stated it would exit if the bill passes. DuckDuckGo and NordVPN said they would consider withdrawing services. Apple and Meta criticized the measure.
Kate Robertson, senior research associate at University of Toronto's Citizen Lab, stated that "officials within certain agencies tend to view technology as a crime scene in and of itself" but this "siloed thinking forgets that technology needs to be the secure operating platform for hospitals, for banks, for national security agencies, for police services themselves."
A May letter from US House Judiciary and Foreign Affairs committee members warned Canadian officials that "companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption."
Security researchers say mandating metadata retention creates surveillance infrastructure within privacy tools. Afsaneh Rigot, founder of research organization De|Center, noted that such laws "get copy pasted around the world" and create spillover effects. The UK and Australia have enacted similar surveillance reforms. Other nations including France, India, Spain, Sweden, and Switzerland have proposed encryption-threatening measures.
The broader problem confronting privacy tool developers is jurisdictional. As Joseph Lorenzo-Hall, security portfolio lead at the Internet Society, explained, "Changing your headquarters isn't much of a plan B when the law follows your users." Privacy platforms increasingly seek safer jurisdictions, but few exist where companies can legally maintain their privacy commitments.