- Proton VPN has hit back at Canada’s proposed Bill C-22
- The proposed legislation could require VPNs to log user metadata
- NordVPN and Windscribe have also slammed the bill
The fight for digital privacy in North America just gained another heavy hitter. Proton VPN has come out swinging against Canada’s controversial Bill C-22, assuring users that it will not comply with the proposed surveillance legislation.
Taking to X on Tuesday, the Swiss-based provider warned that the bill “empowers the government to order VPN providers in Canada to retain metadata for up to a year.” In response to the looming threat, the company drew a definitive line in the sand regarding its core privacy commitments, stating that “There is no universe in which Proton VPN compromises its no-logs policy.”
Proton VPN’s General Manager, David Peterson, also weighed in to clarify the legal reality of the situation. Because Proton operates under Swiss and European jurisdictions, Peterson argues that complying with the Canadian bill would violate local privacy laws.
“Complying with foreign surveillance orders without Swiss legal process is a criminal offence. Not happening,” Peterson stated. “We’ll defend our Canadian users and never compromise them. We will fight C-22’s application by every means available.”
If you are looking for the best VPN to protect your online identity, a strict no-logs policy is what keeps your data out of the hands of hackers and overreaching governments alike.
What is Bill C-22?
Introduced in the spring of 2026, Bill C-22, also known as the Lawful Access Act, is designed to give law enforcement broader tools to investigate crimes.
However, privacy advocates warn that the legislation is a surveillance nightmare. If passed, it would force digital services to record and retain user metadata for a full year.
Bill C-22 empowers the government to order VPN providers in Canada to retain metadata for up to a year. The EU’s highest court has struck down this type of mass data retention legislation twice already, suggesting it won’t stand up to scrutiny:1. https://t.co/lcRCD0NWqU2.… https://t.co/ZYRwYlDW7cMay 19, 2026
Crucially, it provides a mechanism for the Minister of Public Safety to demand companies create a technical backdoor to their services, provided it doesn’t introduce a “systemic vulnerability.”
As cybersecurity experts often point out, a compromise between encryption backdoors and complete security is fundamentally impossible. Creating a way for law enforcement to access encrypted data inherently creates a vulnerability that malicious hackers can exploit.
The “clown show” response
Proton VPN is not the only provider pushing back against the legislation. The outcry follows similar threats from Signal and Windscribe last week, with the latter warning it would relocate its Toronto headquarters if the bill passes.
The situation took a bizarre turn on Tuesday when Public Safety Canada posted on X, encouraging citizens to use VPNs to secure their data on public Wi-Fi networks. Windscribe was quick to point out the hypocrisy of a government promoting VPN usage while simultaneously trying to outlaw the privacy protections that make them effective.
“Oh this is just rich… Bill C-22 is driving VPN businesses like ours out of Canada because of the required user logging. And in the same breath you tell people to secure their data with VPNs,” Windscribe wrote. “I hope you bought your circus tickets folks, because the clown show is starting.”
NordVPN has also formally joined the opposition. While the company stated it is still reviewing the draft and hopes to participate in the consultation process, it made clear that its core security infrastructure is not up for debate.
“Should Bill C-22 pass in its current form and if we are subjected to mandatory obligations, there isn’t a scenario in which we would compromise our no-logs architecture or encryption protections,” NordVPN stated.
With the world’s biggest privacy companies drawing a hard line against Bill C-22, it remains to be seen whether Canadian lawmakers will amend the legislation or risk driving the cybersecurity industry out of the country entirely.
https://cdn.mos.cms.futurecdn.net/RD5c2vTZGzuK6GC2Ld5BHk-1920-80.jpg
Source link
