• A coalition of privacy organizations is urging the EU to intervene against Canada’s Bill C-22
• The proposed law could compel European tech companies to weaken encryption and retain user metadata
• This follows a massive backlash in Canada from major tech giants and leading VPN providers

In a last-ditch effort to protect end-to-end encryption, digital rights advocates are calling on the European Union to intervene against Canada’s controversial Bill C-22.

Also known as the Lawful Access Act, the proposed legislation threatens to force technology companies into building surveillance capabilities that can help law enforcement and intelligence services access digital information during high-stakes investigations.

Access Now, alongside a coalition of European civil society organizations, has published an open letter urging European Commission President Ursula von der Leyen and other top EU officials to step in.

The groups warn that Bill C-22 is not just a domestic issue, as its sweeping data retention mandates and surveillance requirements will inherently compromise the privacy of millions of people globally.

For privacy-conscious users relying on secure messaging apps or the best VPN to keep their digital lives private, the stakes couldn’t be higher. If passed, Bill C-22 could grant Canadian authorities the power to secretly compel European-based companies to comply with data demands, completely bypassing traditional oversight and transparency.

Namrata Maheshwari, Global Encryption Policy Lead and Asia Pacific Policy Manager at Access Now, warns that the bill threatens to normalize excessive surveillance powers, while converting “devices that work for people into devices that work against them.”

“Steps must be taken to prevent it from becoming law,” Maheshwari added.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

What’s at stake for Europe?

While Canada’s Lawful Access Act may sound like a local concern, the legislation has an aggressive extraterritorial reach. The open letter suggests that Bill C-22 would apply to any service provider whose platform is used by people in Canada.

Digital rights experts also warn the new rules would target providers with zero Canadian users, provided they belong to a corporate group carrying out business activity in the country.

The coalition argues that a Canadian minister would have the authority to secretly order a European company to weaken the security of products used across the EU.

Because a deliberate weakness built for one target ultimately compromises the entire system, experts warn that this effectively serves as a backdoor for mass surveillance.

This is why advocates stress that “Europe should not stay silent” and publicly declare that measures weakening encryption are entirely incompatible with the EU’s own fundamental rights, particularly as the EU and Canada are currently negotiating a Digital Trade Agreement.

With the Canadian Senate expected to conclude its study of the bill as early as October 2026, time for the EU to apply pressure is rapidly running out.

The growing privacy backlash

The open letter to the EU is just the latest development in a massive tech backlash against the Canadian government. Bill C-22 has faced fierce opposition from almost every corner of the cybersecurity industry, with top executives arguing that backdoors cannot safely exist.

Leading tech firms have already drawn a hard line in the sand. Google also joined the privacy backlash, warning that the law would fundamentally break end-to-end encryption.

Meanwhile, the top privacy tools on the market, including Signal, Apple, and leading VPNs, are fighting the surveillance law tooth and nail. From Canada-based Windscribe to ExpressVPN, NordVPN, and ProtonVPN, companies reassured users that they would rather leave the country than undermine their no-log infrastructure.

Ultimately, the cybersecurity community remains united: introducing systemic vulnerabilities for law enforcement creates the very same weaknesses that malicious actors and foreign adversaries will exploit.

If Canada moves forward with the legislation in its current state, it risks isolating its citizens from the world’s most secure digital services.