Full Breakdown
Canadian Lawful Access Bill C-22 Triggers Threats of Exit by VPN and Encryption Services
5/20/2026, 12:01:41 AM
Bill C-22 Threatens VPN and Encryption Services
NordVPN said it would consider withdrawing from Canada if Bill C-22 forces it to compromise its no-logs architecture or encryption. VPN provider Windscribe made a similar statement, saying it would relocate its headquarters and taxes if obligations are imposed. Earlier, app Signal indicated it would shut down its Canadian servers. Apple and Meta warned the bill could compel them to build capabilities that weaken encryption or install spyware.
Legislative Background
Bill C-22, under parliamentary review, aims to give law-enforcement and CSIS data-access tools. It would compel telecoms to confirm service, require providers to develop technical capabilities for data access, and permit ministerial orders. The law designates large telecoms and satellite operators as “core providers” required to build these capabilities, mandates metadata retention for up to one year, and has drawn a U.S. congressional warning that it could “drastically expand Canada’s surveillance and data access powers” and create cross-border privacy risks.
Official Statements
Public Safety Minister Gary Anandasangaree said the government is not legislating to require providers to install surveillance capabilities and any contrary claims are false. He said Bill C-22 does not mandate backdoors and authorities would still need a court-issued warrant to obtain data.
Industry Opposition
NordVPN warned obligations would force it to abandon its no-logs model. Windscribe said the bill would “destroy the essence of our service” and vowed to relocate its headquarters. MP Jacob Mantle noted MPs rely on Signal for confidentiality. Apple said the legislation could compel backdoors—“something Apple will never do.” Meta cautioned the bill could require companies to build capabilities that break or weaken encryption and install spyware.
Conflicting Reports & Gaps
The government says the bill does not require backdoors, while tech firms argue it would effectively force such measures. U.S. congressional officials claim the legislation creates cross-border privacy risks, a point the minister described as a misunderstanding. No empirical data on the bill’s impact on investigations has been released.
Verbatim Quotes
- “and if we are subjected to mandatory obligations, there isn’t a scenario in which we would compromise our no-logs architecture or encryption protections.” — NordVPN spokesperson
- “something Apple will never do.” — Apple spokesperson
- “reassure Signal and all service providers that we are not legislating to require them to install capabilities to enable surveillance and any assertions otherwise are false.” — Gary Anandasangaree, Public Safety Minister
- “Every member of Parliament in the country uses Signal, precisely because they believe it is safe (confidential) to use. No one wants Gary reading their messages,” — Jacob Mantle, Conservative MP
What’s Next
Bill C-22 remains under parliamentary committee review. If enacted, the threatened exits could reduce the availability of privacy-focused services in Canada and trigger legal challenges. The government has signaled willingness to amend the bill in response to industry backlash, while providers continue to assess relocation options.
