Canada's Bill C-22 could drive out a tool 20 million people use to beat censorship

• Psiphon says it has started planning a move out of Canada over Bill C-22
• The provider warns the law would undermine its open-source trust
• The bill has cleared the House of Commons and now faces Senate scrutiny

Psiphon has become the latest tech provider to threaten to leave Canada over Bill C-22, the government's contentious lawful access bill.

The Toronto-based company told The Globe and Mail it has started drawing up plans to move its operations out of the country. It says the bill would force it to compromise the safety features protecting users in authoritarian countries like Iran, Russia, and China.

Psiphon joins Signal, NordVPN, and Windscribe, all of which have warned they could pull out of Canada. For Canadians relying on the best VPN to protect their privacy, that list is getting uncomfortably long.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Psiphon says open-source code can't hide a backdoor

Psiphon began as a Citizen Lab project at the University of Toronto in 2006 and now has around 20 million monthly users, many of whom rely on the tool to circumvent state censorship.

Unlike many VPN providers, Psiphon publishes all its code, but Bill C-22 could require it to change its systems to enable law enforcement's access, while keeping those changes secret.

Vice-president Kenzie Elsworthy said Psiphon is trusted thanks to the open-source model, and that it would be impossible to add a secret back door into a system that's completely public. "That is not lawful access. It is a published vulnerability," Elsworthy said.

Elsworthy stressed that the company doesn't want to leave, but if the law passes unchanged, relocating would be the only option. That would be awkward for Ottawa, which gave Psiphon about $600,000 in National Research Council funding this year.

What is Bill C-22?

Introduced on March 12, 2026, Bill C-22 would require telecoms, internet companies, and other electronic service providers to build surveillance capabilities for police and CSIS. Its backers argue Canada lags behind its Five Eyes allies without such powers.

The definition of "electronic service provider" is broad enough to cover messaging apps and VPNs. The government amended the bill before it passed the House on June 18, adding protections for end-to-end encryption and cutting metadata retention to six months instead of a year. It now heads to the Senate.

Tech companies are preparing for the worst

Because the bill won't define exactly who faces obligations until after it passes, all "ESP" companies are being forced to prepare for the worst.

Last month, 23 companies, including Windscribe, Nord Security, and ExpressVPN's parent company Kape Technologies, urged the government to fix the bill. Citizen Lab founder Ron Deibert warned that, as written, it would make it impossible for many vital privacy tools to operate in Canada.

With the Senate now in charge and European privacy groups also raising concerns, Psiphon's warning is hard to ignore.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!