Canada is about to end private digital conversation — Bill C-22 · dontsurveil.me

Skip to content

dontsurveil.me

01

— D | — H | — M | — S

← All Announcements<br>Threat vectors<br>Media kit<br>Act now

01

Bill C-22 • Canada • May 2026

This is an important public service announcement related to your right to privacy.

We the people have — days— hours— minutes— seconds to take action and influence this outcome.

Act now<br>Get briefed (15 mins) ↓

For now, your encrypted messages have a lock on them.

Only you, and the person you're talking to, hold the key. Not the app. Not the company. Not the government. You probably don't think about it. That's the whole point — it just works.

Until, possibly, the end of this summer.

What Bill C-22 would do

Every messaging app in Canada would be required to build a second key.

With Bill C-22, the government would hold the copy. The lock you trust would no longer be a lock only you can open. It would be a lock the locksmith was ordered to duplicate.

The paradigm shift

Today

Only you have the key.

Even the app's own engineers can't read your messages.

If a court demands the content, Signal has nothing to hand over.

A hacker who breaks in finds noise, not your conversations.

If Bill C-22 passes

A copy of the key must exist.

The provider must build a way in, even when they don't want to.

A court can demand the content. The provider must comply or be fined.

A hacker who finds the way in walks through it. It has happened.

And the other shift

The bill also changes who keeps records on you — and for how long.

The fight over encryption is the most visible piece of Bill C-22. The metadata-retention piece is quieter and just as consequential — Michael Geist calls blanket metadata retention "one of the most privacy-invasive tools a government can deploy."

"Metadata" doesn't just mean who you talked to. It means everything about a call or message except the words themselves: who you contacted, when, how long it lasted, where you were when you sent it, what device you used, what network it traveled across. Stacked together over months, that's a near-complete picture of your life — who you trust, where you sleep, where you work, who you visited and when.

What changes

Today

Metadata is scattered, and brief.

Providers keep records only as long as their own business needs require.

Most don't collect detailed transmission data on every user.

Information about your contacts, location, device, and network paths doesn't sit in one place.

If Bill C-22 passes

A year of metadata on everyone.

Providers must retain transmission data for up to one year.

On everyone, regardless of suspicion. Including data they wouldn't otherwise collect.

Patterns across contact, location, and device often reveal more than the content of any single message.

The retention authority is new in C-22 — it was not in the predecessor Bill C-2. The European Court of Justice struck down equivalent EU rules in 2014 as disproportionate.

Why this is about you

It touches almost everything you do online.

It's tempting to read a bill called "Lawful Access" as something that affects other people. In practice, the architecture it would build sits inside the apps and services you use every day.

If you text family or friends

Every message you send through Signal, iMessage, WhatsApp, or Messenger becomes legally reachable. Today, the company can't read them. Under this bill, it would be required to be able to.

If you message a doctor or therapist

The confidentiality you assume when texting your clinic, scheduling a sensitive appointment, or messaging through a patient portal relies on the same encryption this bill weakens. Health-care apps are in scope.

If you talk to a lawyer

Solicitor-client privilege depends on confidential communication. End-to-end encryption is how that promise gets enforced in practice today. A backdoor doesn't recognize privilege.

If you're a journalist or source

Source protection becomes structurally harder. A backdoor doesn't distinguish between a whistleblower exposing corruption and a leak of state secrets. Both flow through the same compromised channel.

If you organize, protest, or dissent

Activist coordination, advocacy work, and political organizing all rely on private communication. Surveillance burdens historically fall hardest on already-policed communities. This bill continues that pattern.

If you run a small business

"Electronic service provider" is defined broadly — your SaaS, your booking system, even a small clinic's patient portal can fall in scope. Some orders come with gag clauses. None come with funding.

If you cross borders

Once Canada builds this framework, foreign governments can request data through mutual legal assistance treaties. Your data — including data created entirely within Canada — becomes reachable by states whose privacy norms differ from yours.

If you're escaping harm

Survivors of intimate-partner violence and stalking often rely on...