Canada’s Bill C-22 and the security cost of collecting more data

Summary

Tailscale was founded in Canada. We’re a Canadian company that serves users and customers all over the world.That’s why we’re paying close attention to Bill C-22, Canada’s proposed Lawful Access Act, 2026. The bill is Canadian, but the issue is a global trend. Governments around the world are trying to update lawful access rules for the Internet era. Some of those efforts are reasonable. Some go too far, especially when they push companies to retain more data, build surveillance capabilities, or make secure systems easier to access by design.Bill C-22 is part of that larger pattern. It would affect Canadian companies like Tailscale. It would affect any company serving people in Canada. More broadly, it affects the privacy and security expectations of everyone who relies on modern encrypted services.Police and intelligence agencies need tools to investigate serious crimes. Sometimes that means asking service providers for records. When a request is specific, lawful, and authorized by a court, providers should respond with data they actually have.Bill C-22 goes beyond that and the wording is worrying.The bill would create a lawful access framework for “electronic service providers.” That definition is broad. It covers services that create, store, process, transmit, receive, or make available digital information, including services provided to people in Canada or by companies doing business here. It might sound like that's just traditional phone companies or ISPs. But no: it's a large part of the modern Internet.Under the bill, “core providers” could be required to develop, assess, test, and maintain technical capabilities for government access. They could also be required to install, use, operate, or maintain equipment that enables government access to information. The bill also allows regulations requiring retention of categories of metadata, including transmission data, for up to one year.Governments worldwide have spent years pushing for lower data retention in the...