Psiphon Plans to Leave Canada if Bill C-22 Passes Unchanged

The warning adds Psiphon to a list of technology providers that have said they could leave Canada if the bill becomes law. Signal, NordVPN and Windscribe have made similar threats. Psiphon began in 2006 as a Citizen Lab project at the University of Toronto. Many of its users rely on it to evade state censorship.

Bill C-22 was introduced on March 12, 2026. It would require telecom companies, internet companies and other electronic service providers to build surveillance capabilities for police and CSIS. Its supporters argue that Canada lags behind its Five Eyes allies without such powers. The definition of “electronic service provider” is broad enough to cover messaging apps and VPNs.

The government amended the bill before it passed the House of Commons on June 18. The changes added protections for end-to-end encryption and reduced metadata retention to six months from one year. The bill now heads to the Senate.

Psiphon’s concern centers on how lawful access obligations would apply to a service whose code is public. Unlike many VPN providers, Psiphon publishes all its code. The company says Bill C-22 could require it to change its systems to give law enforcement access while keeping those changes secret.

Kenzie Elsworthy, a vice-president at Psiphon, said the company is trusted because of its open-source model. Adding a secret back door to a system that is completely public would be impossible, Elsworthy said. “That is not lawful access. It is a published vulnerability,” Elsworthy said.

Elsworthy said Psiphon does not want to leave Canada. If the law passes unchanged, relocation would be the only option, according to the company. The potential departure would be awkward for Ottawa, which gave Psiphon about $600,000 in National Research Council funding this year.

Because the bill will not define exactly who faces obligations until after it passes, all companies that could be classified as electronic service providers are being forced to prepare for the worst, according to the report. Last month, 23 companies, including Windscribe, Nord Security and ExpressVPN parent company Kape Technologies, urged the government to fix the bill. Citizen Lab founder Ron Deibert warned that, as written, the legislation would make it impossible for many vital privacy tools to operate in Canada.

The Senate is now reviewing the bill, and European privacy groups have also raised concerns. Psiphon’s warning is the latest sign that technology providers are weighing whether they can continue operating in Canada under the proposed lawful access rules.