A growing dispute between Ottawa and some of the world’s biggest technology companies is raising questions about how much access governments should have to private digital communications. Apple, Google and Meta have challenged Canada’s proposed Bill C-22, warning that broader surveillance requirements could weaken encryption and expose users to cybersecurity threats.
The legislation, designed to help police and intelligence agencies investigate serious crimes, has also drawn opposition from privacy-focused businesses, American lawmakers and Canadian researchers. A coalition of 23 technology companies and organizations has demanded further changes, while some services have warned they may leave Canada rather than compromise their privacy protections.
The federal government maintains that the legislation contains safeguards against dangerous security weaknesses. With the bill now before the Senate, the debate has become a test of whether stronger investigative powers can coexist with Canadians’ expectations of digital privacy.
American Technology Giants Are Pressing Ottawa to Change the Bill
Opposition to Bill C-22 has moved beyond individual warnings from technology executives. On September 24, 2026, a coalition of 23 companies and industry organizations sent a joint letter to Public Safety Minister Gary Anandasangaree and Industry Minister Mélanie Joly. The signatories included Chamber of Progress, Coinbase Canada, Nord Security, Tailscale, Tucows and Windscribe. They argued that the proposed law could damage Canada’s competitiveness by requiring businesses to collect additional personal information, modify their security systems and comply with confidential government directives. The coalition acknowledged the importance of fighting cybercrime but rejected the assumption that broader technical-access requirements would necessarily make Canadians safer.
Major American technology companies had already raised similar objections. Apple and Google appeared before a House of Commons committee in May, calling for stronger encryption protections and judicial oversight. Meta separately warned that the legislation could create obligations to install surveillance technology or weaken existing security features. Google maintained its concerns after the House adopted amendments in June. The disagreement is therefore not simply about the original proposal. Businesses want stronger assurances about how the revised law would operate once regulations and government orders begin shaping their products.
Bill C-22 Has Cleared the House but Is Not Yet Law
Bill C-22, formally known as the Lawful Access Act, 2026, was introduced on March 12 and passed the House of Commons on June 18 after amendments. It remains before the Senate, where second-reading debate took place on October 8. The measure revives and revises lawful-access proposals previously included in Bill C-2. Its central purpose is to modernize the legal and technical arrangements used by Canadian police and intelligence agencies when seeking digital evidence. It is not the same legislation as Ottawa’s separate efforts to reform commercial privacy rules.
The proposal has two principal components. Part 1 would update investigative tools, including requests to confirm whether someone uses a telecommunications service and judicial orders for subscriber information. Part 2 would establish a framework requiring certain electronic service providers to maintain technical capabilities that support legally authorized access. That second component has generated much of the controversy. Companies worry that compliance could require changes to how information is collected, stored or protected. Because the bill has not received royal assent, these proposed obligations should not be confused with requirements already in force.
Ottawa Says Police Are Struggling to Investigate Digital Crime
Federal officials argue that criminal investigations increasingly depend on electronic records that can be difficult to obtain, even when police have legal authorization. Public Safety Canada has identified crimes ranging from online extortion and drug trafficking to child sexual exploitation, terrorism and foreign interference as reasons for improving lawful access. Investigators can encounter multiple telecommunications providers, overseas services and records that disappear before authorities identify where relevant evidence is stored. The government says a standardized system would reduce delays and prevent legitimate investigations from failing because a company lacks the equipment or procedures needed to respond.
One proposed measure would allow police, on reasonable grounds to suspect an offence, to require a telecommunications provider to confirm whether a specified person, account or identifier uses its services. That limited confirmation would not itself reveal message contents. More detailed subscriber information would generally require a judicial production order, while interception of private communications remains subject to separate legal authorization. Police organizations have defended these distinctions. The central question is whether building infrastructure to support legitimate investigations could create broader security risks than the immediate investigative benefits justify.
Encryption Is the Most Contentious Part of the Proposal
End-to-end encryption protects communications so that only the intended participants hold the keys needed to read them. When properly implemented, the service provider cannot simply open a private conversation for police, hackers or its own employees. This is why encryption has become foundational to secure messaging and sensitive digital services. Apple, Google and Meta have warned that government demands for new interception capabilities could undermine that protection, even without legislation explicitly ordering companies to create an encryption backdoor. Researchers argue that a special access mechanism can become an attractive target for unauthorized users.
Ottawa disputes that Bill C-22 would require such backdoors. The House amended the proposal to clarify that providers cannot be compelled to decrypt information unless they supplied the encryption and possess the information necessary to decrypt it. The revised text also exempts providers from obligations that would create a defined systemic vulnerability. Critics remain concerned about how that definition would apply to technical changes affecting particular users rather than entire systems. The dispute is therefore more precise than a simple disagreement over whether encryption is protected: it concerns whether the protections are broad enough to prevent dangerous engineering demands.
Six Months of Metadata Could Change How Privacy Services Operate
Another major concern involves metadata, the information surrounding a digital communication rather than its contents. Depending on the service, metadata can identify when an interaction occurred, how long it lasted, which accounts were involved or where a connection originated. That information can be useful to investigators trying to establish connections between suspects. It can also reveal patterns about ordinary people without exposing a single message. Repeated contact with a medical clinic, legal adviser or political organization, for example, may disclose sensitive aspects of someone’s life through timing and frequency alone.
The amended bill permits regulations requiring designated core providers to retain specified categories of metadata for up to six months, down from the original one-year maximum. It prohibits retention requirements covering communications content, web-browsing history and social media activities under that provision. Ottawa says the retained categories must be essential for investigations. Industry critics counter that companies deliberately designed not to keep certain records could be forced to create new databases. Those databases would require security controls and could become valuable targets for criminals. The exact obligations would depend on future regulations, but the prospect is already unsettling businesses built around minimal data collection.
Confidential Government Orders Are Raising Accountability Concerns
Part 2 would also allow the Public Safety Minister to issue technical-capability orders to electronic service providers, including companies outside categories designated as core providers. An order could remain valid for up to two years and may include confidentiality restrictions. Industry critics argue that such powers introduce considerable uncertainty because companies could face demands to alter their systems without being able to explain the changes publicly. They also question whether businesses can make credible promises to customers about privacy when future obligations may depend on confidential government decisions.
The legislation does contain oversight. Ministerial orders require approval from the Intelligence Commissioner, affected companies have an opportunity to make representations, and judicial review is available. Amendments also strengthened reporting to the National Security and Intelligence Review Agency and created additional provisions for sharing information with regulators. These safeguards are important, but critics distinguish independent administrative review from the ordinary judicial authorization used to approve searches or interceptions. Ottawa maintains that the orders would establish capabilities rather than independently authorize access to someone’s personal information. Whether those separate processes provide sufficient accountability remains a central question for senators.
Privacy-Focused Companies Are Warning They Could Leave Canada
For some technology businesses, the consequences may extend beyond higher compliance costs. Encrypted messaging service Signal has warned that it would leave the Canadian market rather than make changes that compromise its security commitments. Canadian anti-censorship company Psiphon has also indicated it could leave the country if the legislation passes without sufficient protections. DuckDuckGo and NordVPN have raised the possibility of withdrawing services. These are conditional warnings, not evidence that the companies have already shut down Canadian operations.
Their objections reveal a deeper business problem. A privacy service can only promise not to retain activity records if its software and operations are structured to avoid collecting them. If legislation requires new logging or interception capabilities, changing the product might undermine the feature customers originally paid for. Psiphon’s open-source anti-censorship technology adds another dimension because it is used in places where authorities restrict internet access. Its developers argue that a surveillance mechanism introduced into publicly inspectable software might be studied and exploited by hostile governments. Leaving Canada could avoid some corporate obligations, but it would not automatically eliminate requirements tied to serving Canadian users.
Canada’s Privacy Commissioner Has Also Called for Stronger Safeguards
The objections are not limited to technology companies protecting their commercial interests. Privacy Commissioner Philippe Dufresne told Parliament in May that Bill C-22 represented an improvement over earlier proposals, particularly through its narrower confirmation-of-service demands and the addition of independent oversight. However, he recommended further changes to safeguard Canadians’ personal information. Among his concerns was the definition of subscriber information, which he argued could extend beyond basic identifiers and potentially capture sensitive details about an individual’s relationship with a service provider.
Dufresne also recommended applying clear tests of necessity and proportionality to technical obligations, strengthening protections against weakened encryption and clarifying how confidential orders could be reported to appropriate regulators. He raised a separate concern about information considered publicly available. A person’s details appearing online after a data breach should not automatically mean they have surrendered their expectation of privacy. Several safeguards were strengthened after his May submission, so not every recommendation can be treated as an unresolved omission. Nevertheless, his intervention illustrates the need to assess how investigative powers interact with established privacy rights, not simply whether police find them useful.
The Dispute Has Reached Lawmakers in Washington
American lawmakers have questioned whether Canada’s proposal could have consequences beyond its borders. In May, Republican Representatives Jim Jordan and Brian Mast, the chairs of the House Judiciary and Foreign Affairs committees, warned Ottawa that the legislation could expose American users to surveillance-related vulnerabilities. Senator Ron Wyden, a Democrat from Oregon, followed in July with a request for the Trump administration to examine the implications for U.S. technology companies. His concerns included scenarios in which foreign governments could seek technical assistance that affects American users or communications.
Those objections do not establish that Canada has obtained or exercised such powers against Americans. They identify potential legal and technical risks requiring examination. Online platforms frequently operate shared infrastructure across countries, creating complications when one jurisdiction demands changes that affect users elsewhere. The debate also intersects with Canada–U.S. negotiations concerning cross-border access to electronic evidence under the CLOUD Act. For the two countries, the issue reaches beyond trade or technology investment. It involves maintaining trust in systems used by businesses, public officials and national-security agencies on both sides of the border.
Previous Telecom Hacking Shows Why Security Experts Are Alarmed
Cybersecurity researchers point to the Salt Typhoon espionage campaign as a warning about the consequences of compromised communications infrastructure. In April 2025, the FBI reported that attackers linked to China had infiltrated multiple telecommunications companies, stolen call-data records and accessed a limited number of private communications. Investigators also identified the copying of certain information associated with court-authorized U.S. law-enforcement requests. The incident demonstrated that sophisticated attackers can obtain sensitive information from major networks, including material connected to legitimate government investigations.
It would be inaccurate to present Salt Typhoon as proof that Bill C-22’s proposed capabilities have already been compromised, or to claim that a particular backdoor definitively caused every aspect of the attack. The Canadian legislation remains unimplemented, and the American intrusion had its own technical circumstances. Still, researchers at the University of Toronto’s Citizen Lab and the Canadian Civil Liberties Association argue that infrastructure designed for authorized surveillance can itself become a valuable target. Their concern is that increasing the volume of stored information and the number of access mechanisms could also increase the opportunities available to malicious actors.
The Senate Now Faces a Decision About Security and Privacy
The October 8 Senate debate demonstrated how far apart the competing views remain. Senator Baltej Dhillon, the legislation’s Senate sponsor and a former police officer, defended the need for investigators to act on legally authorized requests without unnecessary technical delays. He emphasized safeguards added by the House, including encryption protections and independent oversight. Senator Paula Simons raised concerns about confidential orders, metadata retention and the possibility that government-mandated capabilities could create vulnerabilities exploitable by criminals or foreign intelligence services. Both perspectives recognize the seriousness of digital threats but disagree over the proposed solution.
The bill remains at second reading in the Senate as of October 17, meaning further examination and possible amendments are still ahead. Any Senate changes would need to be reconciled with the House before the legislation could receive royal assent. Even afterward, important technical details would have to be established through regulations. For Canadians, the outcome could influence the security of private messages, account information, business records and everyday online services. The challenge for Ottawa is to demonstrate that more effective investigations do not require Canadians to accept weaker digital protection as the price of public safety.
