Canada’s C-22 bill aims to mandate backdoors and increased data retention in encrypted services, sparking backlash from major privacy-focused technology companies and raising broader concerns about the future of digital privacy worldwide.
- Canada’s C-22 law seeks mandated access to encrypted data and metadata retention.
- Major privacy tools like Signal and Psiphon may exit the Canadian market.
- Global trend shows growing government hostility toward encryption protections.
What happened
Canada has introduced the C-22 surveillance bill, which would compel technology companies to implement features enabling law enforcement access to encrypted communications. These mandates potentially include backdoors or intentional weaknesses in encryption protocols, despite expert warnings that such mechanisms cannot be securely built.
The bill also includes metadata retention requirements, which conflict with the principles of many privacy-focused services that avoid keeping such data. This legislation has triggered threats from prominent encrypted service providers, including Signal, Psiphon VPN, Apple, Meta, DuckDuckGo, and NordVPN, all of whom have voiced strong opposition and some have considered withdrawing from the Canadian market.
Why it matters
This bill exemplifies a concerning global shift where democratic countries increasingly propose legislative reforms to expand government surveillance powers at the expense of encryption and user privacy. The consequences extend beyond Canada, reflecting a broader government trend from the UK, Australia, the EU, and other nations to weaken encryption in the name of law enforcement access.
Experts emphasize that introducing any system capable of bypassing encryption weakens security for everyone and exposes users to risks including hacking and abuse. Moreover, it undermines trust in digital services, forcing companies dedicated to privacy to reconsider their operations in markets with such hostile legislation. This dynamic threatens to erode privacy protections that are foundational to secure communications and online safety.
What to watch next
Stakeholders will closely monitor whether C-22 passes into law and how its provisions are enforced, especially regarding technical mandates for encryption access and metadata retention. The reactions of major privacy service providers—whether they pull out or seek legal remedies—will shape the Canadian digital privacy landscape significantly.
Additionally, global observers should watch for similar legislative proposals in other countries, which could further isolate privacy-focused technology companies and fragment the internet into jurisdictions with varying data security standards. The ongoing debate highlights the tension between government surveillance demands and the need to maintain strong, trustworthy encryption worldwide.