Canada's Bill C-22: VPN and tech firms urge the government to 'fix' the bill before it becomes law

• Windscribe, NordVPN, ExpressVPN are among the tech leaders demanding urgent changes to Canada's Bill C-22
• The proposed legislation could force digital service providers to weaken encryption and store sensitive user metadata
• Major privacy providers warn they will abandon Canada if the surveillance law passes

Canada's controversial new surveillance legislation is facing a massive revolt from the privacy industry, with top digital security providers threatening a complete exodus if the law passes in its current form.

In a newly published open letter organized by the Chamber of Progress, heavyweights like Windscribe, NordVPN, and ExpressVPN, along with a chorus of civil liberties groups and major tech firms, urge the Canadian government to significantly amend Bill C-22.

Also known as the Lawful Access Act, the proposed legislation aims to give law enforcement and intelligence agencies broader access to digital information during investigations.

However, cybersecurity experts warn that the bill will effectively kill end-to-end encryption. To comply with the proposed rules, companies running the best VPN services, secure email platforms, and messaging apps would be forced to create backdoors into their encrypted systems.

Providers could be required to retain sensitive user metadata, the digital breadcrumbs that track your online habits, for up to six months.

For everyday consumers, this means the very tools designed to keep personal data safe from hackers and snoops could be legally mandated to feature systemic vulnerabilities. Now, the companies that build these tools are drawing a line in the sand.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A backdoor for everyone

The core issue with Bill C-22 is its demand for lawful access to encrypted data. The legislation leaves the definition of a "core provider" dangerously unresolved, meaning any service could potentially face secret ministerial orders to alter its security architecture.

As the joint letter explains, weakening encryption to catch bad actors ruins the defense for innocent users.

"A backdoor for law enforcement is a backdoor for everyone," the coalition stated. "Once built, it would permanently expand the attack surface for criminal actors and foreign adversaries."

This massive tech backlash has triggered a global response. Recently, digital rights advocates urged the EU to step in and save encryption from Canada's Bill C-22, warning that the law’s extraterritorial reach could force European companies to quietly betray their users.

Even Google joined the privacy backlash, warning lawmakers that the bill establishes a dangerous surveillance infrastructure.

VPNs threaten to walk

The pushback has been unusually fierce from VPN providers with physical operations in the country. Because premium VPNs do not log user activity, there is simply no metadata to hand over to authorities.

The open letter doesn't mince words and argues that "Bill C-22 puts our companies at risk," as it could force businesses to create new compliance and data-retention systems while weakening consumer protection.

The signees are willing to pack their bags if Canada refuses to budge. The letter confirms that "some firms have already said they will leave Canada if this bill passes as-is."

Windscribe, a major VPN provider based in Ontario, recently reassured its users about the Bill C-22 fallout, boldly stating there will be "no changes to our logging or privacy policies."

Windscribe CEO Yegor Sak has publicly discussed exploring options to move the company's headquarters out of the country rather than compromise their security framework.

Sak told TechRadar: "Bill C-22 makes Canada an untenable place for most tech companies to operate in, foreign and domestic."

While Canada has vowed to amend Bill C-22's encryption and metadata rules, Public Safety Minister Gary Anandasangaree has insisted that the core of the legislation "needs to happen."

If the government refuses to overhaul the bill, Signal, Apple, and top VPNs will continue fighting the surveillance law, leaving everyday Canadians caught in the crossfire, potentially isolated from the world's most secure digital services.