- ExpressVPN has joined other VPN providers in criticizing Canada’s Bill C-22
- Bill seeks to impose increased data retention and encryption backdoor
- Proton, Windscribe, NordVPN and Signal have already criticized the proposal
The privacy industry’s backlash against Canada’s controversial Bill C-22 continues to grow. Virtual private network giant ExpressVPN has formally criticized the proposed legislation, stating that its logless architecture and encryption remain strictly “non-negotiable.”
The controversy is a big concern for anyone looking for the best VPN to protect their online identity. Bill C-22, officially known as the Lawful Access Act, would require online services to develop technical capabilities that facilitate government access to encrypted communications, while requiring metadata retention for up to one year.
In a statement shared with TechRadar, ExpressVPN said it was “carefully reviewing” Canada’s Bill C-22, particularly the provisions on access to user data and the requirement to create technical capabilities that support government access to users’ encrypted communications.
For millions of people who rely on VPN services, the proposal threatens the core mechanisms of online privacy. Under strict No logs policy, a VPN provider like ExpressVPN technically promises to never track or store what its users do online. This means that if a government demands user records, a secure provider simply has nothing to hand over – a critical privacy guarantee that Bill C-22 threatens to disrupt.
ExpressVPN’s stance follows similar warnings shared by other VPN providers, including NordVPN and Proton VPN. Windscribe and Signal also threatened to leave the market if Bill C-22 was passed.
The danger of mandatory rear doors
Why are VPN companies and secure messaging apps ganging up on Ottawa? The crux of the matter lies in the technical requirements of the bill. ExpressVPN warned that forcing companies to create tools to access secure user data creates a massive security vulnerability that could be easily abused by malicious parties.
“Our position on the underlying principles is clear: ExpressVPN’s logless architecture and encryption are non-negotiable,” ExpressVPN spokesperson told TechRadar.
That’s because, ExpressVPN explains, both encryption and a logless architecture protect users from a wide range of threats, including bad actors who would exploit any technical capabilities created for one purpose to use for another.
Public Safety Canada (@Safety_Canada) has received its second community note on X for misleading claims about its proposed surveillance legislation, Bill C-22, the Legal Access Act. The government claims that all G7 countries have legal access frameworks with “technical… https://t.co/elqHBw8rWgMay 20, 2026
“Legislation requiring data retention or technical access, no matter how well-intentioned, undermines the security that millions of users depend on,” the ExpressVPN spokesperson added.
By requiring providers to create a way to bypass encryption, the bill effectively mandates digital backdoors.
Security experts maintain that there is no backdoor that only the “good guys” can use. Once an entry point is created, it becomes a high-priority target for state-sponsored cybercriminals and hackers.
A growing exodus from privacy
ExpressVPN is not alone in its stance. The supplier joins an increasingly vocal resistance that includes some of the biggest names in the industry.
Earlier this week, Swiss-based Proton VPN stated that “there is no universe in which Proton VPN compromises its no-logs policy,” and vowed to fight the legislation by any means.
Meanwhile, Toronto-based Windscribe VPN went so far as to threaten to move its operations out of Canada entirely. Encrypted messaging giant Signal similarly warned that it would prefer to exit the Canadian market rather than compromise user trust.
The friction has even raised cross-border concerns. US lawmakers have warned that the bill could compromise the data privacy of US citizens.
“We are closely monitoring the legislation as it develops and participating in a broader conversation about how Canada balances law enforcement needs with the security and privacy of its citizens,” the ExpressVPN spokesperson concluded. “We will be transparent with our users as the situation develops.”
TechRadar has contacted ExpressVPN for further comment.
