Canada’s proposed Lawful Access Act is drawing fierce resistance from some of the world’s most prominent privacy-focused technology companies, with Signal’s leadership delivering one of the bluntest warnings yet: comply with the law or leave the country entirely.
Udbhav Tiwari, Signal’s Vice-President of Strategy and Global Affairs, made clear in an interview with The Globe and Mail that his company views Bill C-22 as a direct threat to the foundational privacy commitments it has made to its users. “We would rather pull out of the country,” Tiwari said, than be forced into a position where Signal’s encryption protections are undermined by legal mandate.
Formally titled the Lawful Access Act, Bill C-22 cleared its second reading in the House of Commons last month and is currently under review by the public safety and national security committee. The legislation would substantially widen law enforcement’s reach into digital communications requiring electronic service providers to retain user metadata for up to one year, and obligating telecom and online platforms to hand over user data to authorities on demand.
Under the bill, security agencies could without a judge’s sign-off ask a service provider whether a particular person uses its platform, provided they have “reasonable suspicion” a crime has occurred or is imminent. That information could then be used to pursue a court-authorized production order for broader subscriber data.
Public Safety Minister Gary Anandasangaree has pushed back on suggestions the bill creates surveillance backdoors, telling a parliamentary committee earlier this month that it does not require decryption of end-to-end encrypted systems and includes protections against systemic vulnerabilities being exploited.
Signal occupies a unique position in the messaging world. The U.S.-based, non-profit company stores almost nothing about its users only phone numbers, the date an account was created, and the timestamp of a user’s last login. Conversations, contacts, and call records never touch Signal’s servers; they live exclusively on users’ devices.
That minimalist data philosophy is precisely what makes Signal attractive to the millions of Canadians including, reportedly, members of Parliament who rely on it for confidential communication.
Tiwari argued that beyond the data retention requirements, the bill’s demands on electronic service providers could introduce dangerous new security vulnerabilities, potentially making encrypted messaging platforms a soft target for cyberattacks by foreign state actors. His concerns have been echoed by U.S. legislators, who wrote to Minister Anandasangaree last week cautioning that the legislation could compromise the security and privacy of American citizens as well.
The irony was not lost on Conservative MP Jacob Mantle, who noted in a May 15 post on X that virtually every MP in Canada uses Signal “precisely because they believe it is safe to use.” His pointed quip: “No one wants Gary reading their messages.”
Signal is far from alone. A mounting coalition of technology companies, from scrappy Canadian startups to global giants, is pushing back hard.
Windscribe, a Canadian VPN provider, said the bill would almost certainly force it to start logging user data something it considers an existential compromise. Because Windscribe, unlike Signal, is headquartered on Canadian soil, it cannot simply switch off a regional server. Instead, it is weighing a full relocation of its headquarters. “We pay an ungodly amount of taxes to this corrupt government,” the company wrote on X, “and in return they want to destroy the entire essence of our service.” The company stated flatly: “Not happening. We’ll move HQ and take our taxes elsewhere.”
NordVPN, operating out of Panama, was equally blunt. The company said that if the bill passes in its current form and applies to its operations, there is no scenario in which it would weaken its no-logs architecture or encryption standards to comply.
Even Shopify CEO Tobi Lutke weighed in, calling on Parliament to scrap the legislation outright a striking intervention from the head of one of Canada’s most celebrated homegrown tech success stories.
Perhaps the most expansive critique came from Meta, the parent company of Facebook, Instagram, and WhatsApp. In testimony before the public safety committee last week, Meta’s head of public policy Rachel Curran warned that as currently written, the bill would conscript private companies into acting as extensions of a government surveillance apparatus. In its worst-case interpretation, she argued, it could require companies to build capabilities that break encryption or install government-mandated spyware on their own systems.
Facing the backlash, Public Safety Canada moved this week to clarify one of the bill’s most contested provisions. In a social media post, the department stated that Bill C-22 would not require service providers to retain all user data for a year only “specific metadata of greatest value to investigators.”
Whether that clarification satisfies critics remains to be seen. The gap between what the government says the bill intends and what the industry fears it enables appears, for now, to remain wide.
For companies like Signal, the bottom line is simple: if Canada wants to mandate access to data that Signal doesn’t collect and cannot decrypt, Signal’s answer is to stop serving Canada entirely and take the privacy of its Canadian users with it when it goes.
