Canada’s C-22 Bill Raises Encryption and Privacy Concerns

First proposed in 2025 and partially amended after intense criticism from technology companies and civil society, Canada’s C-22 Bill could broadly require technology companies, including companies based outside Canada, to implement “technical capabilities” that would allow them to access data for law enforcement purposes.

Like many similar bills, C-22 states that companies would not have to introduce “systemic vulnerabilities” into their systems. Opponents argue, however, that requiring access to end-to-end encrypted data would effectively create a backdoor that could be discovered and exploited by anyone. They also warn that the growing accessibility of AI tools for reverse engineering and system mapping could increase this risk.

Opponents Warn of Encryption Backdoors

“Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken encryption, or otherwise disable encryption,” said a member of the U.S. House Judiciary and Foreign Affairs Committee. In a May letter to Canadian officials, he raised concerns about the bill’s potential privacy and security risks.

Metadata Retention Could Change Privacy-Focused Services

Beyond its potential impact on encryption, C-22 includes provisions that could require companies to retain metadata about user activity. Many privacy-focused services, including Psiphon and DuckDuckGo’s VPN services, deliberately avoid collecting this information.

The companies say they could be forced to change their business models to collect data they do not need or want to gather about users. Researchers warn that these product changes could undermine user trust and increase the likelihood of widespread surveillance.

“If you’re asking for and requiring this infrastructure change to have metadata by default, you’re creating monitoring capabilities within tools that didn’t have it,” said Afsaneh Rigot, founder of De|Center, a research organization focused on reducing technological harm. “There are Iran and other situations around the world, all of which affect everyone a little bit. These kinds of laws are always copy-pasted all over the world, so they can’t stay in Canada.”

Privacy Tools Seek Safer Jurisdictions

As more countries consider similar laws, developers working on privacy and anti-censorship tools are seeking safe jurisdictions. However, reaching users in every country remains a challenge, and there is currently no surefire way to do so.

“When the law follows the user, as in C-22, changing headquarters is not Plan B,” said Joseph Lorenzo Hall, Security Portfolio Leader at the Internet Society. “The strongest protection is to keep as little user data as possible, but when governments can force the start of data collection, ‘we don’t have the data’ is no defense. A safe haven requires more than a tailwind from strong encryption. We need laws that help companies uphold their privacy promises and protect them from foreign threats to confidentiality and integrity.”

Did you find something to include next week? Let us know [email protected]. And stay safe outside.