Signal weighs exit from Canada amid lawful access bill

Privacy-focused messaging app Signal has signaled it could exit Canada if forced to comply with the government’s proposed lawful access framework. The legislation, Bill C-22, would require electronic service providers to enable surveillance capabilities and retain user metadata for up to a year, part of a broader effort to aid law enforcement in investigating crimes such as terrorism and child exploitation.

In an interview with The Globe and Mail, Signal’s vice president of strategy and global affairs, Udbhav Tiwari, argued that the bill could threaten end-to-end encryption and leave private messaging services vulnerable to cyberattacks. He said Signal would rather pull out of Canada than compromise on the privacy commitments it has made to users.

Key takeaways

• Bill C-22 would compel tech and messaging providers to build surveillance mechanisms and retain certain user metadata for up to a year to assist law enforcement.
• Signal warns the legislation could undermine encryption and expose private communications to external threats, potentially prompting an exit from Canada.
• The bill is not law yet; parliamentary committee hearings began on May 7 and are ongoing.
• Industry players have mixed reactions: Meta welcomed selective provisions for evidence gathering but raised privacy and cybersecurity concerns, while Windscribe signaled it would consider following Signal if the bill passes.
• The debate echoes broader privacy-security tensions seen in Europe, notably around chat control and client-side scanning proposals.

Encryption under pressure as Bill C-22 advances

The bill, introduced in March as part of a wider regulatory package, would mandate electronic service providers to equip themselves with surveillance capabilities and retain metadata for a defined period. Proponents say the framework would bolster law enforcement’s ability to investigate serious crimes, from terrorism to child exploitation. Critics, however, warn that such measures could erode user privacy and undermine the security guarantees that underlie popular encrypted messaging apps.

Signal’s position highlights a broader industry risk: if end-to-end encryption becomes compromised or undermined by compelled access, the usability and trust in private messaging could be diminished. The Globe and Mail reported that Udbhav Tiwari described the bill as potentially creating vulnerabilities that could be exploited by hackers, undermining the privacy promises Signal offers to its users.

Public discussion around Bill C-22 has already touched on comparisons with the European Union’s controversial privacy proposals, which critics say could push for client-side scanning or other measures that would weaken encryption. The debate frames a larger, ongoing tension between privacy protections and increasing government capability to monitor communications in the name of safety and security.

Industry responses and political context

Tech giants have weighed in with nuanced takes. Meta, for its part, welcomed certain aspects of Bill C-22, arguing that it would provide law enforcement with a clearer legal framework to obtain evidence and protect public safety, while also signaling concerns about the potential impact on Canadians’ privacy and cybersecurity. The company’s stance reflects a common industry position: support for effective enforcement tools, tempered by a demand for clear privacy safeguards.

Canada’s political scene has also spotlighted the privacy-versus-security debate. A post by a Conservative Party Member of Parliament on X asserted that “every member of Parliament in the country uses Signal primarily for its safety and privacy features,” contending that the bill would undermine that privacy. In response, Signal’s leadership indicated it would resist any mandate that compromises user confidentiality.

The bill is not yet law; it must pass through parliamentary review and receive royal assent before taking effect. Committee hearings, which began on May 7, are still underway, signaling that the legislative process could stretch as lawmakers weigh the balance between enforcement capabilities and privacy protections.

Beyond Signal, Windscribe, a VPN provider, warned that the law’s requirements could force providers to log identifying data. In a post responding to The Globe and Mail coverage, Windscribe said it would likely follow Signal in reconsidering its Canadian operations if C-22 advances, arguing that the current draft threatens the core privacy premise of VPNs and similar services.

What comes next for privacy, security, and startups

The unfolding debate places Canada at a crossroads similar to regulatory moves in other regions. As lawmakers refine Bill C-22, observers will be watching not only whether the bill gains passage but how it will affect service design, data retention practices, and cross-border service provision for privacy-centric apps and networks. For developers and users who rely on strong encryption, the central questions are whether the proposed framework can preserve privacy guarantees while providing lawful access tools for investigators, and how firms will operationalize those demands without creating exploitable weak points.

Industry watchers should monitor the committee hearings for clues about potential amendments, as well as any clarifications from tech platforms on how they would implement or resist compliance. The regulatory trajectory in Canada could influence similar debates elsewhere, shaping how privacy-preserving services balance user trust with perceived public safety needs in the months ahead.

Readers should keep an eye on the next set of committee proceedings and any official statements from Signal, Windscribe, and other stakeholders as they gauge how far the government intends to push lawful access measures and what that means for encryption-centric communication tools going forward.