Bill C-22 Senate Hearing: Lawful Access Could Reach Gaming Platforms, Daycares and AI Services in Canada

Canada's lawful access bill is back in the spotlight, and the debate is about how far it reaches. In the first Senate hearing into Bill C-22, officials confirmed the definition of an electronic service provider is deliberately broad, and senators heard its powers could touch gaming platforms, AI services, and even daycares.

What Bill C-22 would do

Bill C-22 reintroduces lawful access rules first proposed in Bill C-2. It passed the House of Commons on June 18, 2026, and was referred to the Senate national security committee on October 22. It is not yet law; the committee held its first hearing in the week of November 2.

The bill would let police and intelligence agencies ask companies for subscriber information, require some to keep metadata for up to a year, and order companies to install surveillance capabilities for interception. A new production order for subscriber information would need only "reasonable grounds to suspect," the lowest standard in Canadian criminal law. The government has called it a modest tool for tying a name to an IP address or a phone number, but the hearing showed its reach goes much further.

Gaming platforms and AI services are in scope

The widest part sits in Part 2, in the definition of "electronic service provider": anyone who provides an electronic service to people in Canada or carries on part of their business activities here.

Public Safety Minister Gary Anandasangaree told senators that "the term electronic service provider is deliberately broad," with telecom companies, CRTC-licensed companies, satellite companies, and social media companies as the core providers in mind. Asked by Senator Hassan Yussuff whether VPN providers were covered, he said "the expansion to other platforms is not what is immediately envisioned, although, as technology develops, we want the ability to do that."

On AI services, he said that "a world in which AI will be able to generate its own electronic service and sell it to Canadians" is "something the regulation and definition could capture." Assistant Deputy Minister Richard Bilodeau said whether AI services end up as core providers or subject to orders is a question on which "time will tell." Shannon Hiegel, a director general in the department's cyber security branch, said Canada's definition is "probably where we're leaning the most forward" compared with the other countries officials examined, and that "our definition at least would include things like gaming platforms where communication isn't the primary purpose of that service, but yet there is a predominant chat room and chat function that goes on."

Even daycares came up in the discussion

The subscriber information production order drew some of the sharpest questions. Directed at "a person who provides services to the public," it could reach far beyond telecom companies. Privacy Commissioner Philippe Dufresne said recipients could include "health care providers, lawyers, financial institutions and dating apps." Senator Pierre Dalphond cited a BC Civil Liberties Association analysis noting that "booksellers, daycares, and counselors" could be caught. Justice counsel Anne-Marie Lebel agreed an order "could be made to any service provider, a person who provides services to the public. It could be a daycare in some cases."

The Privacy Commissioner wants the bill narrowed

Dufresne, who appeared on November 2, said the bill still needs work despite the government's June 2026 amendments. He named five areas for further amendments, chiefly narrowing subscriber information to a finite list of identifiers and limiting the new production order to telecom providers. He had sent written recommendations on the predecessor bill, Bill C-2, last November, and told a House committee on May 26 that Bill C-22 "improves on its predecessor" while still falling short.

Cryptographers warn about encryption

As the review began, cryptographers Ian Goldberg and Peter Swire filed a briefing warning the bill could weaken encryption and leave attack vectors open to foreign states. The Globe and Mail reported on November 3 that capabilities built to break secure systems would make everyone who uses those services less safe, because the same holes would be open to any adversary. Apple's privacy director, Erik Neuenschwander, told MPs the bill's secrecy provisions would forbid companies like Apple from even discussing the orders they receive. Signal and Psiphon had already threatened to leave Canada over an earlier version of the bill.

Oversight gaps drew questions too

The government points to safeguards such as court orders and Intelligence Commissioner reviews. But Commissioner Simon Noel said the bill does not clearly require the minister to explain why the balance of factors favours an order, to consider reasonable alternatives, or to justify proceeding by confidential order at all. A CSIS official dismissed "maximalist interpretations" as hyperbole. Even so, the committee has now heard from the government's own officials that the bill reaches far beyond telecom companies and internet providers.

What happens next

Hearings continue over the coming weeks, with amendments on the table. The most readily available fixes, according to Geist, are narrowing the provider definition to services that carry communications and limiting the production order to telecom providers, as the Privacy Commissioner recommended. If the bill passes as written, the companies that could be ordered to hand over subscriber information or build in surveillance capabilities would reach far beyond phone and internet providers: the gaming platform your kids use, the AI service you use at work, the daycare holding your family's contact details. Whether senators narrow that list will decide how much of everyday digital life falls under lawful access.

Frequently Asked Questions

What is Bill C-22 in Canada?

Bill C-22, the Lawful Access Act, 2026, would let police and intelligence agencies obtain subscriber information, require some companies to retain metadata, and order companies to install surveillance tools. It passed the House of Commons on June 18, 2026, and is now before a Senate committee, but is not yet law.

Could Bill C-22 really apply to gaming platforms and daycares?

According to the November 2026 testimony, yes. Officials said the broad definition would include gaming platforms with chat functions, and Justice counsel agreed an order could be made to any service provider, including a daycare in some cases. The bill has not passed yet, so the scope could still change.

Does Bill C-22 weaken encryption?

Cryptographers who briefed the committee warned it could weaken encryption and open attack vectors to foreign states. The government says it does not require companies to break encryption, but privacy experts and the Privacy Commissioner argue its broad orders and secrecy provisions still raise serious risks. Signal and Psiphon had already threatened to leave Canada over the earlier version.