Two Toronto-based technology companies, Tailscale and Windscribe, joined more than 20 other Canadian and European firms this week in a joint open letter urging Ottawa to further amend Bill C-22, warning the lawful-access legislation could push tech companies out of Canada, according to a report published by BetaKit on Sept. 25, 2026.
The letter, addressed to Canada’s ministers of industry and public safety, was also signed by Fredericton-based Beauceron Security, logistics firm Gobolt and Coinbase Canada, along with several European companies, BetaKit reported.
Bill C-22, formally titled An Act respecting lawful access, was introduced in the House of Commons on March 12, 2026, and passed a House vote on June 18, according to Windscribe’s own account of the legislation, published on the company’s blog. The bill would let cabinet ministers order “electronic service providers” to build law enforcement access capabilities into their systems and retain user metadata, such as who contacted whom and when, for up to six months. Ottawa trimmed that retention window down from an original 12 months and added language ruling out forced decryption, but the changes have not eased industry concerns, BetaKit reported.
“Canada should be able to support legitimate investigations without making secure systems easier to attack,” Tailscale chief executive Avery Pennarun said in the letter, according to BetaKit, or sacrificing the country’s competitive standing in tech. Windscribe chief executive Yegor Sak was more blunt in a company blog post, writing that Bill C-22 “makes Canada an untenable place for most tech companies to operate in, foreign and domestic.” Unlike Signal or foreign VPN providers, which could simply cut off Canadian users if the law takes effect, Windscribe said it cannot easily walk away, since Canada is both its legal home and its base of operations.
The Toronto letter adds a Canadian voice to a fight that has already drawn in some of the biggest names in consumer privacy technology. Encrypted messaging app Signal and search engine DuckDuckGo have both warned they could pull services from Canada entirely if Bill C-22 becomes law as written, Global News reported. DuckDuckGo has said it would remove its VPN offering from the Canadian market, while a Signal vice-president said the bill risked turning “everyday tools into a sprawling, insecure surveillance apparatus.”
Windscribe’s blog post pointed to overseas precedents it says show how lawful-access rules can backfire, including an Australian metadata law that the company said drew more than 80 unauthorized requests for access, and Apple’s decision to pull an encrypted cloud backup feature from the United Kingdom rather than build in the access British regulators demanded.
The bill has cleared the House of Commons and is now before the Senate, where the letter’s signatories are asking senators to tighten privacy safeguards further, including preserving encryption, limiting data collection to what investigations actually need, and eliminating what they describe as secret, open-ended order-making powers for individual ministers. No date has been set for a Senate vote.
For Canada’s tech sector, the stakes go beyond any single company’s product roadmap. Tailscale and Windscribe are both Toronto-headquartered firms built around privacy-focused networking and VPN products sold to customers well beyond Canada’s borders. If companies like them conclude the legal exposure under Bill C-22 outweighs the benefit of staying domiciled in Canada, industry groups have argued the fallout could extend to hiring, investment and the country’s standing as a place to build software companies, at a moment when Ottawa is separately trying to position Canada as an attractive home for AI and technology firms.
