Tech Critics and Privacy Experts Warn Canada Over Bill C22 Encryption Risks
Canada C-22 Encryption Bill Stirs Cross-Border Privacy Concerns
First proposed in 2025 and partially revised following intense pushback from civil society and tech firms, Canada’s C-22 bill advances requirements that could compel domestic and international technology companies to build technical capabilities enabling law enforcement data access.
-
The Tech TL;DR:
- Canada’s C-22 bill requires technical capabilities for law enforcement access to data, affecting companies outside Canada.
- The legislation mandates metadata retention by default, clashing with privacy-focused services like Psiphon and DuckDuckGo.
Legislative Push for Law Enforcement Access and Technical Backdoors
Like many similar legislative efforts, C-22 states that companies will not have to introduce a systemic vulnerability into their systems. However, critics argue that any mechanism designed to access end-to-end encrypted data effectively functions as a backdoor that could be discovered and abused by malicious actors. This risk compounds as automated tooling simplifies reverse engineering and system mapping.
U.S. lawmakers have echoed these concerns directly. Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption, members of the US House Judiciary and Foreign Affairs committee said in a May letter to Canadian officials.
Mandatory Metadata Retention Threatens Privacy-First Business Models
Beyond its direct impact on encryption protocols, C-22 contains provisions that could force companies to retain user activity metadata—a practice intentionally avoided by privacy-focused services such as the DuckDuckGo and Psiphon VPN tools. Under the bill, these providers face pressure to alter their core business models to collect user data they neither need nor want.
Researchers warn these mandated architectural shifts degrade trust while expanding state surveillance infrastructure. If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it,
said Afsaneh Rigot, founder of the research organization De|Center. There are contexts like Iran and other contexts globally, who all of this has a trickle effect on. It’s not going to stay in Canada because these types of laws always get copy pasted around the world.
Hello, Johnny. We are actively reviewing draft Bill C-22 and will participate in any relevant consultation process available to us. However, should Bill C-22 pass in its current form and if we are subjected to mandatory obligations, there isn't a scenario in which we would…
Jurisdictional Limitations for Anti-Censorship Tools and Privacy Providers
As governments weigh similar compliance mandates, anti-censorship and privacy developers are evaluating safe operating jurisdictions. Yet relocation offers limited security if legal obligations follow the user base.
Changing your headquarters isn’t much of a plan B when the law follows your users, as C-22 would,
said Joseph Lorenzo-Hall, security portfolio lead at the Internet Society. The strongest protection is holding as little user data as possible, but ‘we don’t have it’ is no defense if governments can force you to start collecting it. A safe haven needs more than favorable winds in strong encryption. It needs laws that let companies keep their privacy promises and defend them against foreign threats to confidentiality and integrity.