By any measure, the federal government’s new white paper on digital sovereignty lands with a mix of urgency and irony. It rightly warns that Ottawa cannot maintain full control over its own data if that data is stored or managed by companies subject to foreign laws yet, in the same breath, it acknowledges that Canada’s most sensitive information already sits on the servers of American tech giants like Amazon, Microsoft, and Google.
That contradiction speaks volumes about where Canada currently stands in the digital age: deeply dependent on foreign infrastructure while talking about “sovereignty” as if it were still a choice waiting to be made.
The white paper, prepared for the Treasury Board, bluntly states that full legal control over data can only exist if the government delivers services itself or works with providers completely under Canadian jurisdiction. The logic is simple you can’t claim digital independence if your data is governed by someone else’s laws.
Yet, even data stored on Canadian soil isn’t fully protected. The document points out that most countries, including both Canada and the United States, have laws allowing their authorities to demand access to information held by organizations within their borders. The U.S. Cloud Act is the most striking example, allowing Washington to compel American companies to hand over data stored abroad for law enforcement purposes.
That’s the crux of the issue: no matter how many Canadian flags you put on a data centre, if the parent company is American, U.S. law still applies.
Artificial Intelligence Minister Evan Solomon has called digital sovereignty “the most pressing policy and democratic issue of our time.” He’s not wrong. But his office’s silence in response to this white paper combined with Ottawa’s $1.3 billion in contracts with U.S. cloud providers since 2021 suggests that the government is still struggling to reconcile its rhetoric with reality.
Prime Minister Mark Carney has floated the idea of building a “sovereign cloud” in Canada a system designed to operate within the confines of Canadian law and values. It’s an ambitious vision, and one worth pursuing. But it also raises hard questions: who will build it, and can we truly call it sovereign if American-made chips and software are still powering it?
Even Canadian telecoms like Bell and Telus, which are positioning themselves as potential partners in this new strategy, are not immune from foreign dependencies. As York University professor Jennifer Pybus points out, Bell’s use of U.S.-made hardware means that “if the U.S. wants access to data that a U.S. company has, they can get it.”
In short, sovereignty isn’t something you can rent. It has to be built painstakingly, domestically, and with a clear understanding that control over data is now as vital as control over borders or energy resources.
The public seems to understand this better than Ottawa does. Solomon’s task force on AI policy has already faced criticism for being too industry-heavy, and a coalition of experts and civil society groups has warned that the consultation process risks sidelining public concerns. That’s not the way to build trust or independence in a digital future dominated by Big Tech.
If Canada truly wants to assert digital sovereignty, it must do more than talk about it. It must invest in homegrown infrastructure, enforce stricter procurement rules, and stop treating data like an administrative afterthought. The stakes are clear: whoever controls the data, controls the democracy.
And right now, that control doesn’t fully belong to Canada.
