VPN firms threaten to quit Canada as Bill C-22 encryption fight escalates

Known as the Lawful Access Act, Bill C-22 would give law enforcement and intelligence agencies broader access to digital information during investigations. According to TechRadar, cybersecurity experts say the bill would effectively kill end-to-end encryption, because companies running VPN services, secure email platforms and messaging apps would have to build backdoors into their encrypted systems to comply. Providers could also be required to retain sensitive user metadata, the records that trace online habits, for up to six months.

The signatories argue that weakening encryption to catch criminal actors damages the defenses protecting ordinary users. "A backdoor for law enforcement is a backdoor for everyone," the coalition stated. "Once built, it would permanently expand the attack surface for criminal actors and foreign adversaries."

A central objection is that the legislation leaves the definition of a "core provider" unresolved, which the letter says means any service could face secret ministerial orders to alter its security architecture. For consumers, the coalition contends, tools designed to keep personal data away from hackers and snoops could be legally required to carry systemic vulnerabilities.

Opposition has extended beyond Canada. Digital rights advocates have urged the European Union to step in and protect encryption, warning that the bill's extraterritorial reach could force European companies to quietly act against their users' interests. Google has also joined the pushback, telling lawmakers the bill establishes a dangerous surveillance infrastructure, according to TechRadar.

VPN providers with physical operations in Canada have been among the sharpest critics. Because premium VPNs do not log user activity, they say there is no metadata to hand over to authorities. The letter says "Bill C-22 puts our companies at risk," arguing it would force businesses to build new compliance and data-retention systems while weakening consumer protection, and it confirms that "some firms have already said they will leave Canada if this bill passes as-is."

Windscribe, a major VPN provider based in Ontario, has told users there will be "no changes to our logging or privacy policies." Its chief executive, Yegor Sak, has publicly discussed exploring a move of the company's headquarters out of the country rather than compromise its security framework. Sak told TechRadar: "Bill C-22 makes Canada an untenable place for most tech companies to operate in, foreign and domestic."

Canada has vowed to amend the bill's encryption and metadata rules, but Public Safety Minister Gary Anandasangaree has insisted that the core of the legislation "needs to happen." If the government declines to overhaul the bill, Signal, Apple and major VPN providers are expected to keep fighting the surveillance law.