Digital rights organisations have formally asked the European Union to intervene against a Canadian surveillance bill that VPN providers and encrypted messaging services warn could force backdoors into secure communications.
On 14th September 2026, the global digital rights group Access Now, together with European civil society partners, sent a call to European Commission President Ursula von der Leyen and other EU officials urging them to challenge Canada’s Bill C-22, known as the Lawful Access Act, as first reported by TechRadar.
Bill C-22 would compel technology and communications companies to build law enforcement access into their products, weaken end-to-end encryption, and impose blanket metadata retention requirements. According to Access Now, the bill’s reach extends beyond Canada’s borders. It could apply to companies with no Canadian users at all if their parent company operates in Canada, and would allow Canadian ministers to secretly order European firms to reduce the security of their products.
Marcel Kolaja, Access Now’s Policy and Advocacy Director for Europe, said the European Commission “cannot speak about Europe’s tech sovereignty and at the same moment ignore Canada’s overreaching Bill C-22.” Namrata Maheshwari, the organisation’s Global Encryption Policy Lead, warned that the bill “could undermine years of work in the EU, and around the world, to protect privacy,” adding that it risks turning “devices that work for people into devices that work against them.”
The intervention is timed to coincide with ongoing EU-Canada Digital Trade Agreement negotiations. Access Now is asking the EU to push for the removal of the bill’s surveillance and metadata retention mandates, secure explicit encryption protections, raise the issue directly in trade talks, review Canada’s data protection “adequacy” status under the GDPR, and have officials state publicly that weakening encryption would breach EU commitments.
According to TechRadar’s reporting, the coalition opposing Bill C-22 already includes some of the biggest names in consumer privacy technology, among them Google, Signal, Apple, Windscribe, ExpressVPN, NordVPN and Proton VPN. For VPN users, the concern is straightforward. Any legal requirement to weaken encryption or retain connection metadata strikes directly at the no-logs promises that most reputable providers build their service around.
Canada’s Senate is expected to conclude its study of the bill by October 2026, meaning it could become law within weeks unless the pressure from Access Now and its partners, or a shift in the trade negotiations, changes its course.
UK readers who rely on a VPN for everyday privacy are not directly affected by Canadian law, but the case shows how one country’s surveillance legislation can ripple outward through providers that operate internationally. Readers wanting a refresher on how providers protect user data in the first place can see how VPN encryption works.
For anyone reassessing which provider to trust with their traffic, ExpressVPN, one of the companies publicly opposing Bill C-22, remains one of the more transparent operators when it comes to independently audited no-logs claims.
No ruling or vote has yet been confirmed. VPNCompare will follow the progress of Bill C-22 and the EU’s response as the story develops.
