Windscribe, the Toronto-based VPN provider, is preparing to leave Canada if Bill C-22 becomes law. According to a report published on 27 October 2026, the company's CEO said the bill would make it impossible to keep the company's privacy policy, which promises users that Windscribe does not collect data about them.
Bill C-22, also called the Lawful Access Act, would require electronic service providers to collect and keep metadata for six months. Metadata covers who people contact and where they are located, but not the content of messages. The requirement would apply to all users, whether or not they are suspected of a crime. The bill has passed the House of Commons and is now before a Senate committee, the last point at which it can be amended.
Signal has also said it would rather stop operating in Canada than comply. Industry groups have warned that mandatory retention creates new security risks, because a store of user information would become a target for hackers. An open letter organised by the Chamber of Progress and signed by Windscribe, NordVPN and ExpressVPN argues that lawful access points weaken security for everyone.
For users of VPN services, the practical question is whether a provider keeps no connection data at all. A provider that is forced to store six months of metadata would have to change its logging design, or leave the market.
Sources: BeEncrypted, 27 October 2026; CHNREIA, 31 October 2026.