ExpressVPN has joined a growing coalition of privacy-focused technology companies in formally opposing Canada’s Bill C-22, which proposes mandatory data retention and the creation of government-accessible encryption backdoors.

Key Points

• Bill C-22, also known as the Lawful Access Act, mandates that online services retain user metadata for up to one year.
• The legislation requires companies to build technical capabilities that allow government authorities to bypass encryption on user communications.
• ExpressVPN stated that its no-logs architecture and encryption standards are non-negotiable, citing security risks from potential digital backdoors.
• Other major industry players, including Proton VPN, NordVPN, Windscribe, and Signal, have also publicly criticized or threatened to exit the Canadian market.
• Public Safety Canada has faced scrutiny over the bill, including receiving Community Notes on social media regarding claims about international lawful access frameworks.

Why it Matters

The proposed legislation creates a significant conflict between government surveillance requirements and the fundamental privacy guarantees offered by global VPN and messaging providers. If passed, the bill could force major technology firms to leave Canada or fundamentally alter their security architectures, potentially setting a precedent for how other nations regulate encrypted digital services.