Canada's proposed C-22 bill is pushing some privacy-focused companies to threaten to leave the country. The legislation would require tech firms to build technical capabilities for law enforcement access and to retain metadata, even though it says it would not require a 'systemic vulnerability.' Opponents argue that any such access capability amounts to a backdoor that could be abused.
Signal has said it would exit the Canadian market, and Psiphon VPN—which helps users in Iran circumvent censorship—has said it would leave if the bill passes. DuckDuckGo and NordVPN have said they would consider pulling their services. Apple and Meta have criticized the bill but have not threatened to exit.
The dispute is part of a wider global squeeze on encryption. The UK and Australia have already passed surveillance reforms that can compel companies to break encryption, and similar proposals have emerged in the EU, France, India, and elsewhere. Researchers warn that laws like C-22 often get copied by other countries, affecting privacy tools used in repressive regimes.
For businesses, the threat is not just about relocation. As Joseph Lorenzo-Hall of the Internet Society notes, changing headquarters doesn't help when the law follows users. Companies may be forced to collect data they don't want, and a true safe haven would require legal protections that let them keep their privacy promises.