Signal Would Quit Canada Over Bill C-22. Here’s What the Bill Demands

On the evening of Monday, Oct. 5, Udbhav Tiwari sat down with a small group of senators and MPs and repeated a threat that Ottawa has spent five months treating as a bluff. Signal, the encrypted messaging app, would shut down its Canadian operations if Bill C-22 becomes law and is enforced, Tiwari, its vice-president of strategy and global affairs, told the session, according to BetaKit, which reported that the Canadian Internet Society organized it and recorded it for the Senate committees that will study the bill.

“For us, this is a serious enough issue that it would fundamentally break Signal,” he said. Faced with a choice between complying and leaving, “the choice for us, unfortunately, would be starkly clear.”

The threat is not new. What has changed is the audience. The bill cleared the House of Commons in June and now sits with the Senate, the last place it can be amended. Here is what it actually requires, what the government says it doesn’t, and what it would mean for anyone in Canada who uses Signal, WhatsApp or iMessage.

Bill C-22 explained: two parts, one fight

Bill C-22, the Lawful Access Act, 2026, was tabled on March 12 by Public Safety Minister Gary Anandasangaree. It is the successor to the lawful-access sections of last year’s Strong Borders Act, Bill C-2, which the government pulled back after a backlash.

The bill’s own summary splits it in two. Part 1 “amends various Acts to modernize certain provisions respecting the timely gathering and production of data.” In practice that means new Criminal Code tools for police, including a judge-reviewed production order for subscriber information at a “reasonable grounds to suspect” threshold, which University of Ottawa law professor Michael Geist argues lowers the standard.

Part 2 is the one tech companies are fighting. It “enacts the Supporting Authorized Access to Information Act,” a new law aimed at the companies that carry and store Canadians’ data. Its reach starts with a broad definition: an “electronic service provider” is any person that “provides the service to persons in Canada.” That covers a telecom, a VPN, a cloud host and a foreign messaging app alike.

From that pool, the government would designate “core providers” by regulation. Those companies would have to build, test and maintain the capability to extract and hand over information when police or intelligence agencies arrive with legal authorization. The minister could also issue secret orders imposing similar duties on companies that aren’t core providers. The Public Safety backgrounder says those ministerial orders would need approval from the Intelligence Commissioner first, which the department calls “an external oversight mechanism.”

Metadata retention: what the Lawful Access Act would make companies keep

The second demand is storage. When the bill was tabled, the government said regulations could require “retention of prescribed metadata for a reasonable period of no longer than one year,” while excluding message content, web-browsing history and social media activity.

The House committee cut that ceiling. The version that passed third reading allows retention “for reasonable periods of time not exceeding six months,” and Geist reports that a category of metadata can now be mandated only where the minister is satisfied it is essential to investigations.

Six months of who-messaged-whom is still a lot for an app built to keep almost nothing. Tiwari told MPs in June that metadata is not harmless: “Metadata is the 2 a.m. phone call, the clinic you contacted, the lawyer you retained,” iPhone in Canada reported.

The penalties in the third-reading text are real money. Administrative penalties top out at CA$250,000 (about US$180,000) per violation for a company, and criminal fines for offences under the new Act reach CA$500,000 (about US$360,000).

Is Bill C-22 “encryption-neutral”? Read the fine print

Ottawa’s answer to the encryption question has been consistent. Anandasangaree has called the bill “encryption-neutral,” and a department spokesperson said the government is “not legislating to require [providers] to install capabilities to enable surveillance,” CyberInsider reported in May.

The committee then wrote some of that into law. A new clause says no obligation under the Act is to be “construed as compelling an electronic service provider to decrypt” communications, “unless the encryption was provided by the electronic service provider.” Core providers are excused from any rule that would force them “to introduce a systemic vulnerability,” and the test for what counts as one was changed to a “credible risk, based on recognized international technical standards,” Geist wrote.

Look again at that decryption carve-out. It protects encryption a user brings. Signal, WhatsApp and iMessage supply their own. Our read: the clause offers the least comfort to exactly the apps at the centre of this fight, and it helps explain why Signal is still saying no months after those amendments passed.

Signal’s specific fears go beyond keys. At the House committee on June 2, Tiwari warned the bill could force the company to create hidden accounts or add participants to group chats that other members can’t see, and said Part 2 “the way that it is currently drafted, is incompatible with the fundamental human right to privacy,” according to iPhone in Canada. On Oct. 5 he was blunter: “We will not make changes to our products” to comply.

“Metadata is the 2 a.m. phone call, the clinic you contacted, the lawyer you retained.” Udbhav Tiwari, Signal, to the House public safety committee

Apple, Meta and the Online News Act playbook

Signal is the loudest objector, not the only one. Apple warned the bill “could allow the Canadian government to force companies to break encryption,” Geist noted, and officials said they “categorically rejected” the claim. Meta’s Rachel Curran told lawmakers the bill could require firms to “build or maintain capabilities that break, weaken, or circumvent encryption,” according to CyberInsider. The chairs of the U.S. House Judiciary and Foreign Affairs committees wrote that encryption providers “will inevitably face directives to create backdoors.”

VPN companies joined in. Windscribe and NordVPN threatened to pull their services from Canada, TechRadar reported, and BetaKit says Canadian and European tech companies sent ministers an open letter in September warning the bill would “erode trust” in Canada’s tech industry.

Geist’s comparison is to Bill C-18, the Online News Act. Then, as now, supporters treated a platform’s exit warning as a negotiating tactic. Meta followed through and stripped news from Facebook and Instagram in Canada in August 2023. He also points to Apple withdrawing its Advanced Data Protection feature from the U.K. Signal has a track record too: Tiwari told the Oct. 5 session that Signal has never cut off a country itself, though Russia, China and North Korea have ordered it throttled after it refused their demands.

The vote that moved the bill to the Senate was not much of a vote. On June 18, the government used a single motion to pass several bills with no further debate and no recorded vote on C-22, BetaKit and Geist reported. “Bill C-22 is too complex and its impacts too significant to be rushed through,” the Canadian Civil Liberties Association said.

What it means for you if you use Signal, WhatsApp or iMessage

• Nothing changes today. C-22 is not law. It still needs Senate approval and royal assent, and most of the capability duties only bite once the government writes regulations naming core providers.
• The Senate can still amend it. If senators change the text, it goes back to the House. Signal’s June asks were prior judicial authorization for orders that alter a security system, independent technical review, and an explicit ban on weakening encryption or forcing metadata collection.
• A Signal exit would be a choice, not a ban. Signal hasn’t said how it would wind down Canadian service. Until it does, treat the timing as unknown.
• WhatsApp and iMessage users have a stake too. Meta and Apple have made the same encryption objections, though neither has threatened to leave. For how Apple already routes some of your data, see our explainer on where Siri and Apple Intelligence requests go.

Senators have yet to hold a second-reading debate, LEGISinfo shows. On the Senate order paper for Sept. 28, C-22 was listed as item No. 1 under government business, and the only date beside it was June 18.