On June 16, Bill C-8, the Cybersecurity Act, received royal assent and took effect immediately. It gives the Minister of Industry the power to issue binding orders to telecoms and internet providers — telling them to change how they operate, for cybersecurity reasons. Those orders can be issued in secret. The company that receives one can't tell you it exists, even if it affects you specifically.

This is not the only bill. Bill C-22, a separate law expanding police and intelligence access to phone and internet metadata, passed the House of Commons on June 18 and now heads to the Senate this fall.

Main justification: organized crime and child exploitation investigations increasingly hit dead ends because current law can't compel digital platforms to respond fast enough.

A third, Bill C-34, would require age verification for social media — meaning every adult, not just teenagers, would need to prove how old they are to use Instagram or TikTok. That one is still being debated.

Main justification: cyberbullying, online child sexual exploitation, and the mental health effects of social media on youth — backed by 75% of Canadians supporting a social media ban for children under 16.

Why these bills matter for Canada

Intelligence reputation.

Canada is the only Five Eyes country — the intelligence alliance with the US, UK, Australia, and New Zealand — without a modern lawful-access regime. That's the government's core argument for C-22 and C-8: we're behind, and behind means investigations stall and threats slip through.

It’s worth noting, that the US itself, despite leading Five Eyes, never built mandatory data retention — its law lets police preserve specific data once they have a reason, not stockpile everyone's by default. So Canada isn't catching up to its closest ally; it's choosing a model the US deliberately avoided (for now).

Economic impact - likely, not positive.

Canada's tech sector generates $165 billion in GDP annually, and it runs on trust as much as talent. Foreign companies choose to store data here partly because Canada has a reputation for predictable privacy standards. That reputation is now being tested — Signal has said it would rather leave the Canadian market than comply with C-22, and Windscribe, a Canadian VPN company, has said it would relocate its headquarters.

Canada is competing for the same AI and cloud investment as countries with stronger privacy frameworks, and "our government can issue secret orders to your infrastructure provider" is a hard pitch to a company deciding where to build its next data centre.

So, is Canada becoming a surveillance state?

Calling it a surveillance state is probably the wrong frame. Governments don't usually build surveillance infrastructure because they plan to abuse it — they build it because the justification in front of them is real: a child was exploited, an investigation stalled, a cyberattack succeeded.

The problem researchers consistently document isn't the original intent. It's what happens to the infrastructure after the threat that justified it fades, the government changes, or someone simply asks: why not use this for that too?

Germany built its data retention law to catch criminals. Twenty years later, a European court ruled it null and void — the criminals were never measurably caught, but an entire population's data had been stockpiled regardless. The UK built its interception powers to fight terrorism. Those same powers were used to secretly order Apple to unlock iCloud encryption for British users. Apple refused to build the backdoor — so instead, it simply removed the encryption feature from the UK entirely. Every British user lost a protection they didn't know they had, for a reason they were never told.

What we can do about this

The 2012 backlash killed Bill C-30 outright. It's why C-22 arrived with a six-month retention cap instead of a year. Pressure works here — and the next pressure point is the Senate, which takes up C-22 in the fall.

OpenMedia's tool identifies your Senator by postal code and routes your message directly to them. You can also directly email your Senator and MP to raise their attention to the matter.

Timbits 🍡 

If you use an iPhone, turn on Advanced Data Protection — now, while it's still available in Canada. Go to Settings → your name → iCloud → Advanced Data Protection. It extends end-to-end encryption to your photos, notes, and backups so even Apple can't access them. The UK lost this feature after their government issued a secret order. Enable it here.

A VPN won't stop these bills — but it limits what your internet provider can see about your browsing. Given that C-8 lets Ottawa issue secret orders to telecoms, reducing what those providers hold is a reasonable step. We use Surfshark — it's Canadian-friendly, audited, and one of the more affordable options available.

Signal is still the most private messaging app available in Canada in 2026: minimal metadata, open-source, nonprofit-run. If C-22's provisions survive the Senate unchanged, that may not be true by 2027.

Watch your apps' privacy policies this fall. Companies under a secret government order can't tell you directly — but they can update their terms. If your VPN or messaging app changes its privacy policy between now and the end of 2026, that's likely your only signal that something changed underneath.

Telegram is not a private messaging app. Its default chats are not end-to-end encrypted. If you use it assuming it's as secure as Signal, it isn't. Use it for channels and communities, not sensitive conversations.