Signal Warns Canada’s Bill C-22 Could Undermine Encryption and User Privacy

Abeerah Hashim  - Security Expert
Last updated: October 10, 2026
Share
Signal Warns Canadian Law Could Undermine Secure Messaging Protections
  • Signal's VP told Canadian lawmakers on October 5 that the app will not change its privacy protections to meet government demands.
  • Canada's proposed Bill C-22 could force messaging apps to hand over encryption keys, collect user metadata, and build surveillance tools.
  • Signal says if compliance means weakening its security, leaving Canada stays on the table.

A privacy fight is heating up between Signal and the Canadian government. The secure messaging app has renewed its threat to pull out of Canada. This comes after the country pushed forward with a controversial new surveillance law.

Udbhav Tiwari, Signal’s vice president of strategy and global affairs, reiterated the company’s position during a meeting with Canadian senators and lawmakers on October 5, 2026. He said Signal would not change its products in ways that put users at risk.

According to BetaKit, Tiwari described the situation as serious enough to fundamentally break Signal. That would happen if the company had to choose between keeping its current encryption and offering a weaker product.

This was not the first time Signal raised the alarm. Tiwari testified before the House of Commons Standing Committee on Public Safety and National Security on June 2, 2026. He told the committee that Signal would rather leave a market than betray the people who depend on it.

Signal runs as a nonprofit. It builds its messaging service to collect as little user data as possible. Its end-to-end encryption stops even Signal itself from reading messages. The company says any government-ordered changes would damage the trust users place in the service.

Signal renews its threat to leave Canada

Canada introduced Bill C-22 in March 2026. The bill creates a framework requiring online service providers to help law enforcement and the Canadian Security Intelligence Service (CSIS) access information during legal investigations.

Signal has identified three main concerns with the bill. According to BetaKit’s October 6 report, those concerns cover encryption, metadata collection, and technical access requirements.

The company worries authorities could use the law to demand encryption keys. They could also force Signal to collect more data on users. Or they could require Signal to build features that allow government surveillance. Signal argues these steps would weaken user protections, even if the encryption itself is not directly broken. Signal is also expanding its privacy protections beyond messaging, as it has in its privacy fight over encrypted iPhone backups.

Metadata is information about a conversation rather than its content. It can show when people talk, how long they talk, and which accounts are involved. Signal says forced metadata collection would require it to store information it deliberately avoids keeping. Amendments to the bill include a provision that could require companies to hold certain metadata for up to six months.

What Bill C-22 could actually demand

The Canadian government says Bill C-22 does not require companies to build backdoors or weaken encryption. Its position is that the law simply supports investigators working under existing legal powers. The disagreement centers on whether the bill’s technical demands could quietly damage security, even without explicitly ordering a backdoor.

It is worth noting that the government has not yet issued a confirmed order requiring Signal to hand over its encryption keys. Bill C-22 describes powers that could be used. It does not confirm those powers have already been exercised against Signal.

Signal is not the only company with concerns. OpenMedia, a digital rights group, has testified that limited changes to the bill will not fix its core problems. Technology companies and civil liberties groups have raised similar warnings about risks to user privacy and digital security.

BetaKit has reported that some companies, including VPN providers, have considered leaving Canada or restructuring their operations. This would happen if the bill passes without changes that address their concerns.

Privacy groups and tech firms join the fight

Signal has also clarified what leaving Canada would actually look like. Tiwari told BetaKit that Signal has not historically cut off users inside a country on purpose. Instead, governments have sometimes blocked access to Signal after the company refused to comply with local demands. Users in Canada may lose access not because Signal acts first, but because the government does.

As of October 9, 2026, Bill C-22 sits before the Canadian Senate. The government continues to defend its lawful-access goals. Signal and privacy advocates continue to push back hard.

The core question has not changed. Can Canada give investigators the tools they need without forcing secure apps to weaken protections for everyone? According to Signal, if the answer requires compromising its users’ privacy, walking away from Canada remains a real option.

Share this article

About the Author

Abeerah Hashim

Abeerah Hashim

Security Expert

Abeerah is a passionate technology blogger and cybersecurity enthusiast. She yearns to know everything about the latest technology developments. Specifically, she’s crazy about the three C’s; computing, cybersecurity, and communication. When she is not writing, she’s reading about the tech world.

More from Abeerah Hashim

Comments

No comments.