Canada’s surveillance bill threatens end-to-end encryption, prompting exit threats from privacy-focused tech firms

Canada’s proposed C-22 legislation would require tech companies—including those outside Canada—to introduce “technical capabilities” enabling law enforcement access to encrypted data, according to reporting by WIRED. Critics argue that any such capability functions as a backdoor, despite language in the bill prohibiting “systemic vulnerabilities.”

The bill has drawn opposition from encrypted messaging app Signal, which stated it would exit the Canadian market if the legislation passes. Apple, Meta, DuckDuckGo, NordVPN, and Psiphon have also criticized the bill, with Psiphon—a VPN provider used by millions in Iran during internet shutdowns—saying it would withdraw from Canada if the bill becomes law.

In addition to encryption-related provisions, C-22 would expand mandatory data retention requirements, compelling companies to collect and retain metadata about user activity. Privacy-focused services like Psiphon and DuckDuckGo currently avoid such data collection, and researchers warn that these changes would diminish user trust and increase surveillance risks.

The proposed law follows similar surveillance reforms in the UK and Australia that can compel companies to weaken encryption. Encryption-threatening proposals have also surfaced in the EU, France, India, Ireland, Spain, Sweden, and Switzerland, indicating a global trend toward expanded law enforcement access to encrypted communications.

Security researchers and cryptographers have long argued that backdoors or intentional flaws in encryption cannot be built safely, yet policymakers continue to pursue such measures. Kate Robertson, a senior research associate at the University of Toronto’s Citizen Lab, described this approach as “siloed thinking” that overlooks encryption’s role in protecting hospitals, banks, and national security agencies.

The bill was first proposed in 2025 and revised in response to criticism, but opponents maintain that even revised versions would force companies to introduce vulnerabilities or weaken encryption. A May letter from members of the US House Judiciary and Foreign Affairs committees to Canadian officials echoed these concerns, stating that companies could be asked to “introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption.”

Privacy advocates warn that the bill’s passage could have global ripple effects, particularly in repressive regimes like Iran, where tools like Psiphon are critical for circumventing censorship. Afsaneh Rigot, founder of the De|Center, noted that laws like C-22 often serve as templates for other countries, amplifying surveillance risks beyond Canada’s borders.

Experts suggest that even relocating headquarters may not shield companies from laws targeting their users. Joseph Lorenzo-Hall, security portfolio lead at the Internet Society, argued that a true “safe haven” for encryption requires laws that allow companies to keep their privacy promises without being forced to weaken their products.