Canada’s Bill C-22 Explained: Why Signal Says It Would Walk Away

Canada is considering a law that could change how encrypted services work inside its borders, and the companies that build those services are not taking it quietly. Bill C-22, known as the Lawful Access Act, is moving through Parliament, and privacy-focused companies say the changes it proposes would force them into an impossible choice: weaken the security of their own products, or leave Canada entirely.

The response has been blunt. Signal, the encrypted messaging app used by millions, has said it would exit the Canadian market rather than comply. Psiphon, a Canadian VPN that keeps millions of Iranians online during government internet shutdowns, has said it would leave the country too. Apple and Meta have criticized the bill publicly, while DuckDuckGo and NordVPN say they are considering pulling their services from Canada if it passes.

What Bill C-22 actually proposes

The bill was introduced on March 12, 2026, by the Minister of Public Safety, Gary Anandasangaree. It is framed as a modernization of lawful access powers for police and intelligence agencies as more communication moves to encrypted platforms.

It has two main parts. The first would require service providers, including telecom carriers, messaging apps, email services, and cloud platforms, to retain metadata about their users for a full year. Metadata is not message content. It is who you communicated with, when, from where, and for how long. University of Ottawa law professor Michael Geist has called the bill’s wording “a comprehensive surveillance map of virtually every Canadian.”

The second part is drawing the fiercest criticism. It would give the Minister the power to order providers to build “technical capabilities” that let law enforcement intercept communications. In plain language, that means backdoors: deliberate, built-in ways to bypass encryption. The bill’s supporters say it contains language against forcing companies to introduce “systemic vulnerabilities.” Opponents say that distinction collapses on contact with reality, because any way of reading end-to-end encrypted data that does not go through the intended recipient is, by definition, a backdoor. Companies subject to these orders would reportedly be barred from publicly revealing that they exist.

Why Signal and Psiphon say they would leave

Signal’s objection is partly technical and partly philosophical. Signal’s representative, Udbhav Tiwari, told the House public safety committee that complying would require unacceptable changes to the company’s open-source projects. Signal’s security promise rests on proving, through open code and third-party audits, that even Signal itself cannot read your messages. A government-ordered interception capability would destroy that property worldwide. Tiwari added that Signal has never voluntarily cut off a country itself, though Russia, China, and North Korea have throttled the app after it refused their demands.

Psiphon’s situation carries a particular irony. The company is Canadian, and its VPN tool is a lifeline for millions of Iranians during repressive internet shutdowns. If the bill passes in its current form, Psiphon has said it would relocate out of Canada.

Apple, Meta, and the American angle

Apple has warned that the bill could allow the government to force companies to break encryption, a claim officials have rejected. Meta’s representatives told lawmakers the bill could require firms to “build or maintain capabilities that break, weaken, or circumvent encryption.”

The pressure is not only coming from industry. The chairs of the U.S. House Judiciary and Foreign Affairs committees have warned Canadian officials that encryption providers would “inevitably face directives to create backdoors.” Windsribe, another Canadian VPN, has said it would relocate its headquarters, and NordVPN has said it is considering all viable options, including leaving.

The playbook question: will anyone follow through?

Critics of the bill’s opponents have one favorite rebuttal: companies always threaten to leave, and they rarely do. There is precedent on both sides. When Canada passed the Online News Act in 2023, supporters treated Meta’s exit warning as a bluff; Meta followed through and stripped news from Facebook and Instagram in Canada, a change that has never been reversed. In June, the government used a single motion to pass several bills with no further debate and no recorded vote on C-22, a move the Canadian Civil Liberties Association criticized as too rushed. It now sits in the Senate.

The global pattern Canada is joining

Canada is not acting in a vacuum. The United Kingdom and Australia have already enacted sweeping surveillance reforms that include technical capability powers. Similar proposals are circulating in the EU, France, India, Ireland, Spain, Sweden, and Switzerland.

That direction alarms the cryptography community, which has argued for decades that there is no such thing as a backdoor only the good guys can use. Any mandated access point becomes a target, for criminals, foreign intelligence services, and insiders. Kate Robertson of the University of Toronto’s Citizen Lab put it sharply, noting that some officials view technology narrowly as a “crime scene,” while ignoring its role in securing hospitals, banks, and critical infrastructure.

The open question, raised in Wired’s recent coverage, is which country will do the opposite: market itself as a safe haven for privacy services if global hostility to encryption keeps rising.

What this means for ordinary users

If the bill passes as written, the everyday impact would not be a dramatic announcement that your messages are readable. It would be quieter: messaging apps with weaker security guarantees in Canada, VPN providers relocating or restricting Canadian servers, and metadata about your communications sitting on company servers for a year instead of being deleted. For most people, the risk is that a comprehensive record of who talks to whom exists to be stolen, leaked, or abused years later. For users who depend on encrypted tools for safety, journalists, activists, and whistleblowers, the stakes are immediate.

Frequently Asked Questions

Has Bill C-22 already become law?

No. It passed the House of Commons and is currently before the Senate. It could still be amended, delayed, or defeated, though its progress so far has been faster than many observers expected.

Would a backdoor only affect Canadian users?

In practice, no. Companies like Signal ship the same architecture worldwide. Building a government access capability into the product would compromise the security model for everyone, which is why Signal says it would rather leave Canada than rebuild its app around a backdoor.

What is metadata, and why does one-year retention matter?

Metadata is information about your communications: who you contacted, when, for how long, and from where. Over a full year, it reveals your relationships, routines, and movements. Security researchers consider bulk metadata retention one of the most privacy-invasive powers a government can grant itself.