Canada’s Bill C-22 cleared the House of Commons back in June and is now sitting at second reading in the Senate, and the privacy world is not waiting around to find out how it ends. Signal has told lawmakers directly it would rather quit the Canadian market than rewrite its encryption. Apple and Meta have criticized the draft. DuckDuckGo and NordVPN have signaled they would weigh an exit too, according to Wired’s October 17 report on the bill. Meanwhile, a separate but related rift just opened between the Tor Project and Mullvad VPN over a personal political donation, exposing how fragile the alliances inside the privacy industry can be under outside pressure.
None of this is happening in a vacuum. Canada’s lawful-access push is landing at the same time governments in the UK, the EU, Australia, France, India, Ireland, Spain, Sweden, and Switzerland are each running their own version of the encryption fight, per Wired’s reporting. For anyone who builds, sells, or relies on end-to-end encrypted tools, October 2026 is turning into the month the “exceptional access” debate stopped being theoretical again.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What Bill C-22 Actually Requires
Bill C-22, titled An Act Respecting Lawful Access, gives Canadian authorities expanded tools to compel telecommunications and technology providers to assist investigations, including provisions covering data retention and access to subscriber information. The version that passed the House on June 18, 2026, carries a committee amendment meant to blunt the most alarming reading of the bill: it states that no provider can be forced to decrypt information, or help an authorized person decrypt it, when the information was encrypted by the user and the provider does not hold the keys needed to unscramble it.
That carve-out sounds like a flat ban on backdoors. It is not. The exception only protects a provider when it genuinely cannot decrypt the data itself. Any provider that supplies the encryption and holds decryption material, which describes a meaningful share of consumer services, stays inside the bill’s reach. Signal’s entire pitch to users is that it holds no such keys by design. That is precisely the architecture the company says the bill would force it to dismantle if Ottawa interprets “lawful access” broadly enough during enforcement.
The Timeline: How Canada’s Lawful-Access Bill Got This Far
The bill has moved through Parliament faster than most privacy advocates expected, and it has done so with relatively little recorded opposition inside the House itself. Here is the sequence, drawn from Parliament of Canada’s own LEGISinfo record and the SECU committee’s published reports.
| Date | Milestone | Detail |
|---|---|---|
| April 20, 2026 | Second reading completed | House of Commons referred the bill to the Standing Committee on Public Safety and National Security (SECU) |
| May 7 – June 2, 2026 | Committee study | SECU held recorded meetings 37 through 40 examining the bill’s scope and hearing from affected parties |
| June 18, 2026 | Committee report and third reading | SECU reported the bill back with the decryption carve-out amendment; the House adopted the report and passed third reading the same day |
| June 18, 2026 | First reading in Senate | Bill C-22 received first reading in the Senate following House passage |
| October 8, 2026 | Senate second reading debate | Senators debated the bill at second reading, the most recent recorded floor activity |
| October 19, 2026 | Current status | At second reading in the Senate, not yet enacted, with no recorded final vote |
Notice how much changed in a single day, June 18. A committee that spent six weeks hearing testimony reported the bill, the House ratified that report, and the same chamber pushed the legislation to third reading before midnight. That pace is why privacy groups say the Senate stage is the last realistic point to force further changes before the bill becomes law.
Signal’s Red Line: “We Will Leave”
No company has staked out a harder public position than Signal. Udbhav Tiwari, the company’s vice-president for strategy and global affairs, told a House of Commons committee in testimony reported by CityNews Toronto that “if we are ever forced to choose between betraying the people who rely on us and leaving a market, we will leave.”
Tiwari went further in describing what compliance would actually mean for Signal’s codebase. “Signal collects almost no data about our users by design,” he said. “It is this property that leads us to enjoy the reputation we do, including among Canadians. Bill C-22 could force us to rewrite our code, dismantle our robust privacy architectures and design surveillance into our systems.” That is not a company objecting to paperwork. It is a company saying the bill, read a certain way, would require it to build the exact thing its product promises users it will never build.
Signal has made the same point to lawmakers in the United States before, and its Canadian testimony echoes that playbook almost exactly: comply fully everywhere or leave the market that demands the exception. For a messaging app that millions of Canadians use specifically because it promises not to log their metadata, that threat carries real political weight heading into the Senate’s deliberations.
The Carve-Out That Isn’t a Backdoor Ban
To understand why Signal is still worried despite the committee’s amendment, it helps to separate two architectures that get lumped together in public debate. One is end-to-end encryption where the provider never holds the keys. The other is encryption the provider manages on the user’s behalf, sometimes called provider-held or custodial encryption. C-22’s exception protects the first model and leaves the second exposed.
Model A - Signal-style E2EE
user_key = generated_on_device()
server_stores = ciphertext_only
provider_can_decrypt = false -> protected by C-22's carve-out
Model B - provider-held encryption
provider_key = generated_and_stored_by_service
server_stores = ciphertext + key_material
provider_can_decrypt = true -> still reachable under C-22The practical fear is less about today’s wording and more about tomorrow’s enforcement. Signal’s argument, echoed by Apple and Meta in their own criticism of the bill according to Wired, is that a government with the legal authority to compel assistance has every incentive to interpret “provider-controlled” as broadly as courts will allow. A narrow carve-out on paper can become a wide one in practice once regulators start issuing orders.
Tor Project Draws a Boundary With Mullvad
While the Senate debated C-22 on October 8, a separate story was unfolding inside the privacy community itself. The Tor Project published a statement on October 9 addressing its long-running partnership with Mullvad VPN, the Swedish provider that co-develops Mullvad Browser with Tor and has promoted Tor-friendly features for years. “We are not terminating the relationship but are setting clear boundaries on our relationship with Mullvad,” the nonprofit wrote on its official blog.
Technical collaboration continues, Tor said, including the work tied to Mullvad Browser. What stopped was joint promotion and co-branding. TechRadar’s coverage of the pause framed it as the Tor Project trying to protect its own reputation as a neutral, apolitical infrastructure project while still preserving a technical partnership it views as valuable to users of both tools.
Inside the $514,000 Donation That Triggered the Rift
The donation at the center of the dispute was made by Daniel Berntsson, a Mullvad co-founder, not by Mullvad as a company. Reports put the figure at 5 million Swedish kronor, roughly $514,000, sent to Örebropartiet, a Swedish political party associated with restrictive immigration positions. Berntsson and Mullvad have characterized the contribution as personal rather than corporate, a distinction the company is leaning on heavily as it tries to keep the Tor partnership intact.
That distinction matters less to critics than Mullvad might like. A privacy-tool maker’s credibility rests almost entirely on trust, since users cannot independently audit a VPN’s no-logs claims in real time. When a company’s co-founder personally bankrolls a party with views that sit far outside the brand’s stated values, the gap between “the founder did it” and “the company did it” tends to collapse fast in public perception, which is exactly the dynamic Tor’s statement was trying to manage.
Why VPNs and Metadata Are Suddenly Part of the Fight
Bill C-22 is not written as a messaging-app bill. Its data retention provisions reach VPN providers and other services that route or store user traffic, which is why privacy-focused services such as Psiphon and DuckDuckGo entered the conversation at all. Both companies build their reputations on deliberately not retaining the kind of metadata C-22 could require them to keep.
Psiphon’s stakes are especially concrete. Wired’s reporting notes the company says it keeps millions of Iranians connected to the open internet during government-imposed shutdowns, a mission that depends on Psiphon’s servers not becoming a logging point that could be subpoenaed or compromised. A retention mandate written for domestic lawful access does not stay domestic once a global circumvention tool has to comply with it everywhere it operates, or exit the one market demanding the exception.
The Global Pattern: Nine Countries, One Playbook
Canada is not inventing this fight, it is joining one already running in parallel across multiple governments. Wired’s October analysis places C-22 inside a wider trend spanning the United Kingdom, Australia, the European Union, France, India, Ireland, Spain, Sweden, and Switzerland, each pursuing its own encryption-adjacent measure. The specifics differ by jurisdiction, but the shape repeats: lawmakers frame the requirement as a narrow tool against serious crime, providers warn the technical reality of end-to-end encryption makes “narrow” compliance impossible, and the two sides argue past each other until a company threatens to leave or a court steps in.
What makes the Canadian case notable is less its content than its timing and company. Canada rarely leads on contentious tech regulation, it tends to follow once allies like the UK or EU have tested the political waters. C-22 reaching Senate second reading while the EU’s chat-control debate and the UK’s own surveillance powers remain unsettled means any precedent set in Ottawa over the next few months will get cited by lobbyists and regulators in every other capital running the same argument.
Market Impact: What a Signal Exit Would Actually Cost
A Signal withdrawal from Canada would not break the company financially, Canada is one market among dozens. The cost is reputational and precedential. Tiwari put the stakes plainly in testimony reported by BetaKit: “If we would have to [choose between] serving the users of Canada with the end-to-end encryption that we provide around the world, or creating a much weaker version of our product that connects all of this metadata, the choice for us, unfortunately, would be starkly clear.”
If Signal actually follows through, Canada becomes the first G7 country to lose access to a top-tier encrypted messenger over a domestic lawful-access law, not a sanctions regime or wartime measure. That is a headline every other legislature weighing similar rules will have to reckon with, and it cuts both ways. Opponents of weakening encryption get a cautionary tale about what compliance actually costs a jurisdiction. Supporters of the bill get to argue Signal is bluffing, since the company has made similar threats elsewhere and continued operating once exemptions or delays followed.
| Organization | Stated Position | Reported | Source |
|---|---|---|---|
| Signal | Would exit Canada rather than weaken end-to-end encryption or add metadata collection | 2026 committee testimony | CityNews / BetaKit |
| Tor Project | Paused joint promotion with Mullvad, kept technical collaboration intact | October 9, 2026 | Tor Project blog |
| Mullvad (Daniel Berntsson) | Characterizes the $514,000 donation as personal, not corporate | October 2026 | TechRadar |
| Apple and Meta | Publicly criticized the C-22 proposal | October 2026 | Wired |
| DuckDuckGo and NordVPN | Signaled they would consider withdrawing from Canada | October 2026 | Wired |
| Psiphon | Warns retention mandates threaten its anti-censorship role, citing its use keeping Iranians online | October 2026 | Wired |
Historical Context: From the Crypto Wars to Chat Control
This argument is decades old. The United States fought its first “crypto wars” in the 1990s over the Clipper chip, a government-backed encryption standard with a built-in law enforcement key that collapsed once researchers showed the escrow system could be broken. The FBI and Apple fought a public battle in 2016 over unlocking an iPhone tied to the San Bernardino attack, a standoff that ended without a court ruling once the FBI found another way in. Australia passed its Assistance and Access Act in 2018, giving authorities power to compel technical assistance from providers, a law Signal and other encrypted services criticized using language nearly identical to what Tiwari told Canadian lawmakers this year.
What is different in 2026 is the number of fronts open at once. Thirty years ago this was mostly a US fight. Today Canada, the UK, the EU, and Australia are running overlapping versions of the same debate simultaneously, which means a company like Signal cannot simply route around one hostile jurisdiction the way it might have in an earlier decade. The addressable market of friendly jurisdictions keeps shrinking.
Competitive Comparison: How Privacy Companies Are Positioning Themselves
Not every company facing C-22’s pressure is choosing the same posture. Signal has gone furthest, making an explicit, public exit threat backed by named executive testimony. That is a high-risk, high-trust strategy, it works only if users believe the company means it and if the brand’s value depends entirely on the no-compromise promise.
Apple and Meta sit at the other end. Both criticized the bill according to Wired’s reporting, but neither has threatened to leave Canada, likely because neither company’s Canadian revenue is tied as tightly to an encryption-first brand promise the way Signal’s is. DuckDuckGo and NordVPN occupy a middle position, Wired reports both have signaled willingness to withdraw rather than commit outright, preserving leverage while the Senate debate continues. Psiphon’s positioning is different again: it frames the fight in humanitarian terms tied to its anti-censorship mission abroad rather than a commercial privacy pitch, which gives it a distinct argument for exemption that purely commercial VPNs cannot make as credibly.
What Lawmakers and Privacy Advocates Are Saying
Canadian law professor Michael Geist has been one of the most vocal critics tracking the bill’s path through Parliament, arguing the government’s dismissal of concerns from Signal, Apple, and members of the US Congress follows a pattern he has seen before in Canadian tech policy fights. Tiwari’s own language to lawmakers reinforced that criticism directly, stating in testimony reported by BetaKit that Signal “will not make changes to our products … to comply with such demands that place the privacy of not just Canadians but everyone else in the world at risk.”
That framing, privacy of everyone else in the world, is the crux of why this fight extends well past Canada’s borders. Signal, like most major encrypted platforms, does not maintain separate codebases per country. A backdoor built to satisfy one government’s lawful-access order typically has to exist in the software everywhere, unless the company builds and maintains a weaker regional fork, which is precisely the much weaker version of its product Tiwari told lawmakers Signal refuses to build.
Five Predictions for What Happens Next
- The Senate will likely add further amendments narrowing the decryption carve-out language before any final vote, given how much the House version already shifted between April and June.
- If C-22 passes substantially unchanged, expect Signal to follow through on its exit threat within months rather than years, turning Canada into the first G7 test case other legislatures will cite in both directions.
- More VPN and messaging providers will start publishing explicit, dated public statements on lawful-access compliance, following the pattern Signal set, as a way to build user trust ahead of their own potential regulatory fights.
- The Tor Project’s technical-collaboration-continues, promotion-pauses model will likely become the template other privacy nonprofits reach for the next time a corporate partner’s leadership makes a politically toxic personal donation.
- Expect the C-22 carve-out’s exact wording, that a provider cannot be compelled to decrypt data it does not possess the means to decrypt, to get cited directly in UK, EU, and Australian legislative drafting over the next year as the preferred middle-ground language.
What Canadian Users Should Watch For Right Now
The bill is not law yet, and the Senate has no recorded final vote scheduled as of October 19. That gives Canadian users of Signal, Proton, and similar services time, but not unlimited time, given how quickly the House stage moved in June. Anyone relying on these tools for sensitive communication should watch three things: whether the Senate amends or weakens the decryption carve-out further, whether Signal issues any updated public statement once the Senate concludes its second-reading debate, and whether other providers named in Wired’s reporting, DuckDuckGo, NordVPN, Psiphon, make their own position public rather than relying on secondhand reporting.
None of the major providers have announced an exit date. Nothing requires action today. But the gap between a committee amendment and royal assent has closed fast on this bill before, and the companies most exposed have already told Parliament, on the record, exactly where their line sits.
Frequently Asked Questions
What is Canada’s Bill C-22?
It is lawful-access legislation, formally An Act Respecting Lawful Access, that expands authorities’ ability to compel technology and telecom providers to assist investigations, including data retention requirements. It passed the House of Commons on June 18, 2026, and is at second reading in the Senate as of October 19, 2026.
Does Bill C-22 ban end-to-end encryption?
No. A committee amendment bars forcing a provider to decrypt data when the provider itself cannot decrypt it, protecting true end-to-end encrypted services like Signal in theory. Services that hold their own encryption keys remain within the bill’s reach.
Will Signal actually leave Canada?
Signal’s vice-president for strategy and global affairs, Udbhav Tiwari, has told Canadian lawmakers directly it would exit rather than weaken its encryption or add metadata collection. The company has made similar threats in other jurisdictions before, so the statement should be read as a serious negotiating position rather than a confirmed exit date.
What happened between the Tor Project and Mullvad?
A Mullvad co-founder, Daniel Berntsson, personally donated roughly $514,000 to a Swedish political party associated with restrictive immigration positions. The Tor Project responded on October 9, 2026, by pausing joint promotion and co-branding with Mullvad while keeping their technical collaboration, including Mullvad Browser development, intact.
Is Bill C-22 law yet?
No. As of October 19, 2026, it is at second reading in the Senate with no recorded final vote.
Which other countries have similar encryption proposals in 2026?
Wired’s reporting places Canada’s effort inside a broader trend spanning the UK, Australia, the EU, France, India, Ireland, Spain, Sweden, and Switzerland, each pursuing its own version of expanded lawful-access or encryption-related rules.
Should Canadian users switch messaging apps or VPNs right now?
Nothing requires immediate action since the bill has not received royal assent. Users who depend on strong encryption should track the Senate’s amendments and watch for any updated public statement from their provider once the bill clears second reading.
How does this compare to past encryption fights like the FBI-Apple case?
The dynamic is familiar, a government demands assistance, a provider says its architecture makes compliance impossible without weakening the product for everyone. What is new in 2026 is the number of overlapping proposals running in parallel across multiple countries at once, narrowing the number of jurisdictions where an encrypted service can operate without facing a similar fight.