Lawful access in Canada has long been tied to telecom and Internet companies: the rules for handing over subscriber information, retaining metadata and installing government-mandated surveillance capabilities. But as the Senate hearing on Bill C-22 got under way, government officials suggested the reach could be much wider. According to analysis by law professor Michael Geist, officials indicated that Bill C-22 lawful access Canada powers could extend to gaming platforms, daycares and AI services.

That is a notable shift in the public conversation, and it deserves a careful look. This post is based on the summary and angle of Geist's reporting, so it focuses on what officials reportedly said rather than on details of the bill we cannot confirm.

What Bill C-22 would require of companies

Bill C-22, known as the Lawful Access Act, is before the Senate. Public descriptions of the bill say its purpose is to ensure that electronic service providers can facilitate the exercise of authorities to access information. In practical terms, lawful access frameworks have traditionally covered three kinds of obligations:

  • Disclosing subscriber information when legally required.
  • Retaining metadata, meaning data about communications rather than their content.
  • Installing or building capabilities that let authorities carry out surveillance.

The government's own description of the bill notes that it explicitly prohibits regulations requiring service providers to retain a person's web-browsing history. That is a meaningful limit, but metadata retention and technical capability requirements can still be significant, depending on who is covered and how the rules are written.

Which services could fall under lawful access

The key point from the hearing is about scope. Officials reportedly said the powers could apply beyond telecoms and ISPs to gaming platforms, daycares and AI services. Each is a very different kind of business:

  • Gaming platforms often combine chat, voice, friend lists and account data, much of it from young users.
  • Daycares are not typically thought of as electronic service providers, yet many use apps and systems to communicate with parents.
  • AI services may hold records of prompts, account activity and usage patterns.

The concern is less about any single category and more about the principle. If the definition of a covered provider is broad enough to include such services, many organizations that have never thought of themselves as part of the communications infrastructure may face retention and capability obligations. Smaller organizations may struggle to understand what is expected of them.

What broader metadata retention means for user privacy

Metadata can sound harmless, but it can reveal who you talk to, when, how often and from where. Collected across more services, it can build a detailed picture of daily life. Retaining it for longer, or across a wider range of platforms, increases the amount of sensitive information that exists and could be requested, leaked or misused.

There is also a security dimension. Any system built to enable government access is another system that must be defended. Critics of lawful access proposals, including privacy groups and researchers who have submitted analysis on Bill C-22, have raised concerns about encryption and expanded surveillance. Supporters argue that investigators need modern tools to deal with crime in a digital world. Both positions are part of the debate now moving through the Senate.

This tension is not unique to Canada. Debates over digital identity and data collection are playing out elsewhere, including the question of whether the EU Digital ID Wallet is truly voluntary or mandatory, and public opinion data showing that 60% of Britons fear surveillance in the UK's digital ID plan. The common thread is trust: how much data is collected, who holds it and who can reach it.

What This Means For You

If you live in Canada, the practical effect depends on the final text of the bill, the regulations that follow and which services are ultimately covered. For now, nothing has changed in how you use games, AI tools or children's apps. But the officials' comments suggest that services you use every day could become part of a lawful access framework.

It is also worth being realistic about limits. A VPN can shield your traffic from your local network or internet provider, but it cannot stop a service from retaining the data it holds about your account and activity. If a platform is required to keep metadata itself, that obligation applies regardless of how you connect.

What users can realistically do about it

  • Read privacy policies for gaming, AI and childcare apps, paying attention to what data is retained and for how long.
  • Share less by default. Use minimal profile information and avoid putting sensitive details into AI tools.
  • Use strong account security, including unique passwords and two-factor authentication, since retained data is only as safe as the account protecting it.
  • Ask questions. If your daycare or club uses an app, ask what data it collects and where it is stored.
  • Follow the process. Senate hearings, submissions and amendments can change a bill's scope. Public comment and contact with your representatives are the most direct way to influence it.

Follow the debate

The discussion over Bill C-22 lawful access in Canada is still developing, and the scope officials described may be narrowed, clarified or confirmed as the Senate proceeds. Keep an eye on amendments and on how "electronic service provider" is defined, and compare it with similar surveillance and digital identity debates abroad, such as those in the EU and UK covered in the articles above. Staying informed is the first step to taking part in the conversation.