Canada’s proposed C-22 bill could force tech firms to weaken encryption and retain user data, sparking a global debate about privacy vs. law enforcement access.
A Canadian bill (C-22) is stirring debate over encryption. It could require tech firms to provide access to encrypted data for law enforcement and to retain certain metadata. Privacy advocates warn this would weaken security and could push services to pull out of Canada if the rules become binding.
Why this matters to everyday readers: if Canada adopts these rules, tech companies may change how they operate, which could affect privacy and security trends that spill over to other regions, including the US and UK.
What happens next: the bill faces a long legislative process with ongoing debate among lawmakers, privacy groups and tech companies. Stay tuned for follow-up on concrete provisions and any company reactions.
The encryption debate is heating up in Canada. A proposed bill, known as C-22, could push tech companies to build ways for law enforcement to access end-to-end encrypted data and to retain metadata about user activity. The changes would apply to tech firms operating in Canada and, as some critics warn, could set a dangerous global precedent.
Encryption protects private messages, financial details and sensitive data. The idea behind end-to-end encryption is that only the communicating users can read the messages, not the service providers or law enforcement. Critics of C-22 say any requirement to create backdoors or other systematic weaknesses would undermine that protection, making everyone more vulnerable to hackers and abused data alike. They also warn that once a vulnerability exists, it can be discovered and exploited by bad actors, not just legitimate investigators.
So why is this catching attention now? Canadian lawmakers, privacy advocates and several major tech players are weighing the balance between safety and privacy. Some officials argue access is necessary to fight crime and terrorism. Privacy groups and security researchers counter that the bill would force companies to weaken their security across the board and could chill whistleblowing, dissent, and everyday digital trust.
Hello, Johnny. We are actively reviewing draft Bill C-22 and will participate in any relevant consultation process available to us. However, should Bill C-22 pass in its current form and if we are subjected to mandatory obligations, there isn't a scenario in which we would…
— NordVPN (@NordVPN) May 15, 2026
If passed, C-22 could require tech companies to introduce capabilities that allow access to encrypted data for law enforcement purposes. It also contemplates retention of certain metadata. In practice, that means services that pride themselves on not storing or exposing such data would face new compliance requirements that could alter how they operate in Canada and possibly how they design products for other markets as well.
Supporters include some lawmakers who argue that stronger access to encrypted information helps catch criminals. Opponents include the privacy-focused side of the spectrum, with organizations and companies warning about backdoors and the risks they pose to users worldwide. Major industry players, including well-known platforms, have publicly criticized the approach for jeopardizing user privacy and overall security.
For most readers, the practical question is this: will your messages be readable by someone other than you and your chat partner? If C-22 leads to backdoors or mandated data retention, the answer could be yes in Canada, and the ripple effects could influence privacy expectations in other regions. It could also affect how VPNs, secure messaging apps and privacy tools operate if companies adjust their models to comply with any new rules.
Canada has a long process ahead before any bill becomes law. If the legislation advances, expect more debate from privacy groups, technology companies, and lawmakers over the coming months. In the meantime, consumers should stay aware of any changes to how their favorite apps handle encryption and metadata in Canada and consider how these shifts might affect their privacy choices across North America.
Only if companies decide to extend Canadian rules beyond borders or if similar laws pass elsewhere. For now, it’s a Canadian bill under discussion.
Backdoors create new weaknesses that attackers can exploit, potentially exposing everyone’s data, not just criminals.
You're reading the quick version.
Read next
Amazon ramps to 27 satellites a week as Leo nears launch
Amazon says its Leo constellation is weeks from offering commercial broadband after building its 1,000th satellite and accelerating production.
Senior Labour figures warn that AI’s rapid progress could outpace safety rules, pushing government to act now.
A former UK Foreign Office head says Britain must prepare for more aggressive cyber and hybrid attacks from Russia, highlighting what it could mean for everyday life and infrastructure.
Freedom of information responses show a growing number of English NHS trusts either rejecting Palantir’s data platform or reverting to older systems.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
