Inside the Fight Against Canada's Bill C-22: Tech Giants Warn of Encryption Backdoors

Mandatory Metadata Retention. "Core providers"—a category broad enough to encompass telecoms, ISPs, messaging apps, and VPN services—would be required to record and retain user metadata including IP logs, connection timestamps, and routing data for a full year .

Lowered Access Thresholds. Law enforcement would no longer need "reasonable grounds to believe" to obtain subscriber information. The bill drops the standard to "reasonable grounds to suspect," significantly expanding police access to identifying data without a warrant .

Anticipatory Surveillance Warrants. Judges could authorize warrants for "tracking data or transmission data" relating to things "unknown at the time the warrant is issued," enabling expansive surveillance of yet-unidentified targets .

CSIS Confirmation Powers. The Canadian Security Intelligence Service would gain authority to issue "confirmation of service demands" that require telecom providers to quickly confirm whether they hold information on a particular subscriber .

Tech Companies Draw a Hard Line

The response from major platforms has been unusually direct and public.

Apple issued a statement through Reuters calling the bill a direct threat to its security model. "At a time of rising and pervasive threats from malicious actors seeking access to user information, Bill C-22, as drafted, would undermine our ability to offer the powerful privacy and security features users expect from Apple," the company said. Apple explicitly warned the legislation "could allow the Canadian government to force companies to break encryption by inserting backdoors into their products, something we will never do" .

Meta joined Apple in public opposition and testified at parliamentary hearings on May 7, 2026. The company warned the bill's broad powers and limited oversight could transform its platforms into "government spy tools" . Meta urged Parliament to amend the bill to remove provisions that could force technology companies to build third-party surveillance capabilities into their systems .

Signal took the hardest stance, with Vice President of Strategy and Global Affairs Udbhav Tiwari stating the encrypted messaging service "would rather pull out of the Canadian market entirely" than comply with metadata retention requirements fundamentally incompatible with its no-logs architecture .

Google is part of the broader industry coalition opposing the bill, though it has been less publicly vocal than Apple and Meta in available public statements.

VPN Providers Prepare to Leave

The bill's metadata retention and capability-order provisions have triggered an unprecedented reaction from the VPN industry. Because no-logs architecture is central to how these services operate, providers say C-22 would force them to choose between their core promise to users and the Canadian market—and they are choosing to leave.

NordVPN warned it would pull out of Canada if the bill passes as drafted. "If we are subjected to mandatory obligations, there isn't a scenario in which we would compromise our no-logs architecture or encryption protections," the company stated. "To prevent this, we will consider all viable options, including limiting or, if necessary, removing our presence from Canadian jurisdiction" .

Windscribe, headquartered in Toronto, said it is actively looking at relocating out of Canada. CEO Yegor Sak told the Globe and Mail the company would move rather than comply .

ExpressVPN formally criticized the legislation, calling its "no-logs architecture and encryption non-negotiable" .

Proton joined the opposition, saying there is "no universe" in which it would scrap its no-logs policy .

U.S. Lawmakers Warn of Cross-Border Risks

On May 7, 2026, House Judiciary Committee Chair Jim Jordan (R-OH) and House Foreign Affairs Committee Chair Brian Mast (R-FL) sent an official warning letter to Public Safety Minister Gary Anandasangaree .

The letter expressed concern that Bill C-22 "could pose privacy and security risks to Americans" by pressuring U.S. technology companies to weaken encryption. The lawmakers specifically warned that end-to-end encryption providers "will inevitably face directives to create backdoors into their products" under the bill's framework .

"Canada's Bill C-22, currently under consideration in Parliament, would drastically expand Canada's surveillance and data access powers in ways that create significant cross-border risks to the security and data privacy of Americans," the lawmakers wrote .

The congressional letter also flagged that the bill's cross-border data sharing provisions and extraterritorial reach could expose U.S. citizens' information to Canadian retention and sharing rules without adequate safeguards .

Privacy Advocates Sound the Alarm

The Electronic Frontier Foundation called Bill C-22 "a repackaged version of last year's surveillance nightmare," warning that the secret capability orders amount to "widespread surveillance backdoors" while mandatory metadata retention erodes privacy for millions of Canadians .

Canadian privacy scholar Michael Geist has documented what he calls the bill's "systemic vulnerability gap." Writing on his blog, Geist explained that Part 2 obligates electronic service providers to design compliance architectures that could introduce weaknesses affecting all users, not just investigative targets . In a subsequent analysis, he warned the prospect of a tech exodus from Canada is driven by "clear-cut privacy and security risks that do not apply in the U.S. or Europe" .

The Government's Response

The Canadian government has pushed back against the criticism. Officials have accused tech companies of "making excuses" and insisted the bill targets only serious crimes including child sexual exploitation, human trafficking, and organized crime . Government backgrounders emphasize that Part 2 does not create new legal authorities to intercept communications—only to ensure providers can comply with existing legal orders .

But those assurances have done little to slow the opposition. Bill C-22 passed second reading in April 2026 with the Liberal majority, and committee hearings began in May. More than a dozen major companies have now raised concerns, with several threatening to withdraw services from Canada entirely .

The government has since signaled it may amend the bill, though the scope of any changes remains unclear .