Canada's Proposed Encryption Bill Triggers Global Tech Exodus
Canada's Bill C-22 would require tech companies to introduce "technical capabilities" permitting law enforcement data access and to retain user metadata, prompting Signal, Psiphon, and others to threaten withdrawal from the Canadian market.
What happened
Canada has proposed Bill C-22, legislation that would require tech companies—including those outside Canada—to introduce "technical capabilities" permitting law enforcement data access and to retain metadata about user activity. The bill states that companies will not have to introduce a "systemic vulnerability" into their systems, but critics argue any capability to access end-to-end encrypted data constitutes a backdoor. In response, Signal announced it would exit the Canadian market due to unacceptable changes required to its open-source projects. Psiphon VPN, which serves millions of Iranians during internet shutdowns, said it would leave Canada if the bill passes. Apple, Meta, DuckDuckGo, and NordVPN have also criticized the bill or indicated they would consider withdrawing services.
Context
The bill reflects a broader global trend: the UK, Australia, the EU, France, India, Ireland, Spain, Sweden, Switzerland, and others have introduced or proposed similar surveillance reforms that can compel companies to break encryption. Cryptographers and security engineers have maintained for decades that secure backdoors cannot be built without creating exploitable vulnerabilities—a risk amplified by AI tools now available for reverse engineering. Privacy-focused services object that metadata retention requirements would force them to collect data contrary to their business models and user trust. Researchers warn such laws have a cascading effect globally, often copied across jurisdictions. The convergence of encryption-weakening mandates across multiple countries is narrowing the safe jurisdictions where privacy and anti-censorship tools can operate without fundamental product compromises.