First introduced in 2025 and subsequently amended following intense backlash from technology firms and civil society groups, Canada’s Bill C-22 empowers authorities to compel technology companies—including those headquartered abroad—to implement “technical capabilities” facilitating law enforcement access to data. While the legislation stipulates that firms must not introduce a “systemic vulnerability,” critics argue that any mechanism designed to bypass end-to-end encryption inherently functions as a backdoor, susceptible to discovery and exploitation. This danger is amplified by the increasing accessibility of AI tools for reverse engineering and system mapping.
“Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption,” members of the U.S. House Judiciary and Foreign Affairs Committees warned in a May letter to Canadian officials.
Beyond encryption mandates, Bill C-22 contains provisions that could require the retention of user activity metadata—a practice privacy-focused services, such as VPN providers Psiphon and DuckDuckGo, deliberately avoid. These companies contend they would be forced to alter their business models to collect unwanted user data. Researchers caution that such changes would erode user trust and expand the potential for mass surveillance.
“If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it,” said Afsaneh Rigot, founder of the De|Center, a research organization dedicated to mitigating technological harms. “There are contexts like Iran and others globally where this has a trickle-down effect. It’s not going to stay in Canada because these types of laws always get copied and pasted around the world.”
As more nations consider similar legislation, developers of privacy and anti-censorship tools are increasingly searching for safe jurisdictions in which to operate. However, relocation fails to address the challenge of serving users in restrictive regimes, and currently, no foolproof havens exist.
“Changing your headquarters isn’t much of a Plan B when the law follows your users, as C-22 would,” said Joseph Lorenzo Hall, security portfolio lead at the Internet Society. “The strongest protection is holding as little user data as possible, but ‘we don’t have it’ is no defense if governments can compel you to start collecting it. A true safe haven requires more than favorable encryption policies; it needs laws that allow companies to uphold their privacy commitments and defend them against foreign threats to confidentiality and integrity.”