Bill C-22: the House rushes through Canada’s lawful access bill

For more than 20 years, Canadian governments have tried to expand “lawful access,” meaning police and Canadian Security Intelligence Service (CSIS) access to data held by companies. Bill C-22, the Lawful Access Act, 2026, is the most ambitious attempt yet. On June 18, 2026, the House of Commons passed it after limiting debate. Canada is not alone: many governments are pushing for the same kind of access, often at the expense of encryption.

Where C-22 comes from

In June 2025, Bill C-2 on border security already included lawful access measures, among them a warrantless “information demand” that police could send to almost any service provider. Facing a public outcry, the government moved the border measures into a separate bill, and the lawful access measures stalled.

They came back on March 12, 2026, in C-22, with some changes. On June 18, committee study, report stage, and third reading all took place on the same day. The committee sat until about 1 a.m., and Liberal MPs blocked a motion to hear from the Privacy Commissioner again.

What the bill contains

Part 1 gives new powers to police and CSIS:

A warrantless demand: police could ask a telecommunications provider whether it serves a given person, account, or identifier, on mere “reasonable grounds to suspect.”
A new order to obtain subscriber information from any “person who provides services to the public.” The threshold is low, and the definition of the information covered, which includes email addresses, usernames, and device identifiers, goes beyond what the Supreme Court recognized in Spencer (2014) and Bykovets (2024).

Part 2 imposes obligations on “electronic service providers,” a definition so broad that it covers platforms, messaging apps, VPNs, and device manufacturers. It provides no exemption for small organizations or non-profits. The government could:

designate “core providers” and require them to make their systems ready for interception;
require them to retain everyone’s metadata for up to six months, a period cut in half in committee. The content of communications, browsing history, and social media activity are excluded;
issue secret ministerial orders: a company would not even be allowed to disclose that it had received one;
fine a company up to $250,000 per day.

The bill improved along the way. Ministerial orders will have to be approved by the Intelligence Commissioner. A committee amendment specifies that a provider cannot be forced to decrypt end-to-end encrypted communications for which it does not hold the keys. Privacy Commissioner Philippe Dufresne acknowledges that C-22 improves on C-2 in several respects, but he made eight recommendations, including narrowing the list of subscriber information.

Why this is a step backward

Metadata retention means watching everyone, without suspicion. Knowing who talks to whom, when, and from where is enough to build a detailed picture of a person’s life. Before the period was cut to six months, law professor Michael Geist described it as a “comprehensive surveillance map of virtually every Canadian.” The principle has not changed.

Access built for police ends up being used by others. In fall 2024, it emerged that Chinese state-linked hackers, the group known as Salt Typhoon, had broken into the systems U.S. carriers use for lawful wiretaps. In February 2025, according to the Canadian Centre for Cyber Security, the group likely compromised equipment belonging to a Canadian telecommunications company. As a letter signed in September 2026 by some twenty companies, including VPN and DNS providers, puts it: “A backdoor for police is a backdoor for everyone.”

Services could leave Canada. Signal has said it would rather leave the country than abandon the privacy promises it has made to its users. Apple says the law could force the insertion of backdoors, something Apple will never do. Canadian VPN provider Windscribe says it will move its headquarters if the bill passes. The government, for its part, says it does not intend to force these companies to build in surveillance capabilities.

As an organization that runs servers for the public, we are following this bill closely.

A worldwide trend

C-22 is one example among many.

United Kingdom: the Investigatory Powers Act 2016 allows secret “technical capability notices.” After a reported order of this kind, Apple withdrew Advanced Data Protection, its end-to-end encryption option for iCloud, for new UK users in February 2025. It is still contesting the demand in court.
European Union: the draft “Chat Control” regulation would have allowed orders to scan private messages, including encrypted ones. Member states dropped mandatory scanning in November 2025, but in September 2026 the question was still blocking a deal with the European Parliament.
Australia: since 2018, the Assistance and Access Act has allowed authorities to compel companies to modify their software and services to give them access.

The more countries demand such access, the harder it becomes for any service to protect its users, wherever they live.

There is still time

As of October 20, 2026, the Senate is debating C-22 at second reading. Senators can study it in committee, hear from experts, and amend it.

What you can do

Tell your elected representatives that you oppose mandatory metadata retention, secret orders, and backdoors. In Canada, the senators are the ones studying C-22.
Use services that respect your privacy, ideally with end-to-end encryption. What a company cannot read, it cannot hand over.
To work out which of your data a government could reach, and how to protect it, follow our guide Build your own threat model.
Follow Michael Geist and the Citizen Lab on C-22, and the EFF, EDRi, and the Global Encryption Coalition worldwide.