Canada's Bill C-22 advances amid warnings privacy services could leave

Canada's lawful-access Bill C-22 has reached second reading in the Senate amid a dispute that goes beyond the familiar framing of privacy versus security. The official record shows debate on October 8, 2026. At the same time, Canadian anti-censorship provider Psiphon has begun planning a potential move out of the country if the bill passes without further changes, while Signal and other services are maintaining similar warnings.

None of those companies has announced a completed withdrawal. Their statements are conditional: Psiphon says it would leave Canada if the obligations prove incompatible with its open model, and Signal says it would leave a market before building surveillance into its service. That distinction matters because the Senate can still amend the bill.

What Bill C-22 is designed to do

Introduced on March 12, Bill C-22 would establish a framework requiring electronic service providers to support lawful-access authorities. The Canadian government says police and the Canadian Security Intelligence Service face technical gaps even when they hold a warrant or production order. It also says Canada trails its Five Eyes partners and other democracies in having such tools. That comparison is the government's stated rationale, not an independently established conclusion of this article.

After criticism from companies and specialists, the House added an explicit safeguard: no obligation should be read as compelling a provider to decrypt information when it did not supply the encryption or does not possess the necessary means. The government describes that wording as protection for end-to-end encryption. The proposed retention period for certain metadata was also reduced from one year to six months before House passage, according to coverage of the bill's progress.

The amendment has not ended the controversy. Apple and Meta previously warned that broad powers, secret orders and technical requirements could create ways to weaken secure systems. The government rejects that interpretation and says the bill does not require systemic vulnerabilities.

Why Psiphon sees a different problem

Psiphon began as a Citizen Lab project in 2006 and now reports roughly 20 million monthly users. Its technology helps people in countries with state-imposed blocks reach the open internet. Psiphon's own privacy policy identifies it as a Canadian corporation headquartered in Ontario.

The core of its objection is not simply whether a provider holds an encryption key. The company publishes its platform's source code. If it were required to create an access capability while keeping that capability secret, researchers and hostile governments could discover the change. Psiphon's position is that a secret door in public code would cease to be secret and become a published vulnerability.

That conflict also surfaced during Senate debate, where lawmakers cited Psiphon, Signal and Mozilla Firefox as examples of open-source projects that may struggle to comply. Senators acknowledged that broad provider definitions, company scale and the effect on encryption still require detailed examination.

What changes for users

In the short term, nothing changes in how Signal, Psiphon or VPNs operate in Canada because Bill C-22 is not yet law. The immediate consequence is regulatory. The Senate must decide whether the decryption safeguard addresses only possession of keys or also blocks orders that would alter the architecture of a service.

The editorial inference is that the Canadian case tests a broader question: whether a country can mandate access capability without turning technical transparency into a security risk. With proprietary services, part of an implementation can remain hidden. In open-source software used to resist censorship, the same secrecy may be technically impractical and could harm users outside Canada. The outcome will depend on the final text, its regulations and oversight of orders, not only on the stated intentions of either the government or the companies.