Toronto-based Psiphon, an anti-censorship tool used by roughly 20 million people in censored and high-risk regions, says Canada's Bill C-22 could force it to weaken its privacy protections or leave the country. The Psiphon Bill C-22 Canada VPN warning is notable because it comes from a human rights tool, not a commercial service competing for subscribers. It also shows how lawful-access mandates can reach well beyond the companies they are aimed at.

What Bill C-22 would require of VPN and circumvention services

Bill C-22 is Canada's Lawful Access Act. In broad terms, lawful-access laws aim to make it easier for authorities to obtain data from communications and online services. The concern raised by Psiphon is that, as written, the bill could weaken the privacy protections that circumvention tools depend on.

The details of how the law would apply to specific services matter, and readers should treat the final text as the authority once it is settled. Researchers at Citizen Lab, based at the University of Toronto, have already examined the bill. Their submission, titled "(Un)forced Errors," is covered in our report on how Citizen Lab flagged encryption risks in Canada's Bill C-22. The core message is that requirements built to enable access can create weaknesses in the systems meant to protect people.

Why Psiphon says it may have to leave Canada

Psiphon helps people living under oppressive regimes bypass online censorship. Its users are often in places where being identified could carry serious consequences. According to the company, if Bill C-22 passes in its current form, it could be pushed to either weaken those protections or leave Canada.

That is a hard choice for a Toronto-built tool. A service designed to shield users from monitoring cannot easily add mechanisms that make monitoring possible without undermining its purpose. Moving operations outside Canada would be a way to keep its protections intact, but it would also mean a Canadian-built human rights tool leaving its home country.

Psiphon is not alone in raising concerns. Coverage of the story notes that other privacy-focused services have also voiced opposition to the bill.

What a provider exit signals for VPN users everywhere

It is tempting to read this as a purely Canadian issue. It is not. Several points stand out for VPN and encrypted-service users worldwide:

  • Jurisdiction matters. Where a provider is legally based determines which demands it can face. A change in law can force a provider to relocate or alter its design.
  • Weakened protection affects everyone. A tool built for activists in censored countries serves the same technical function as one used for everyday privacy. If the design is compromised for one group, it is compromised for all.
  • Exits are a signal, not a guarantee. A company saying it may leave is a warning about the law as drafted. Bills can change before they pass, and the outcome is not settled.

For people who rely on circumvention tools to reach information or communicate safely, a provider leaving a country is less important than a provider being unable to keep its protections strong anywhere.

What This Means For You

If you live in Canada and use a VPN or encrypted messaging, nothing changes today. Bill C-22 is a proposal, and the debate over its text is ongoing. But the warning is a useful prompt to think about how your tools are built and where their operators are based.

If you do not live in Canada, the story still matters. Lawful-access proposals tend to be debated in many countries at once, and arguments made in one place often get reused in another. The technical point that access mechanisms can become weak points applies broadly.

No single tool is a complete answer. Choose services that are transparent about their legal jurisdiction and how they handle user data, and keep your apps updated.

How Canadians can follow and respond to the lawful-access debate

  • Follow the bill's progress. Watch for amendments, since the final wording will determine how services are affected.
  • Read primary analysis. Technical submissions are more informative than headlines.
  • Contact your representative. Canadians can share views with their Member of Parliament on lawful-access and encryption policy.
  • Review your own setup. Know which privacy tools you depend on and where they are based.

The takeaway

The Psiphon Bill C-22 Canada VPN story is a reminder that privacy policy and privacy tools are closely linked. A law written for one purpose can change what developers are able to build. To understand what is at stake, keep following the Bill C-22 debate and read Citizen Lab's technical analysis of the encryption risks in the Lawful Access Act in our summary of the Citizen Lab submission.