Canada’s Liberal government has introduced Bill C-22, the Lawful Access Act, 2026, a surveillance bill that compels electronic service providers to store Canadians’ metadata for a year and hands police and intelligence agencies new tools to access it.
We obtained a copy of the bill for you here.
The bill follows a failed first attempt, Bill C-2, which collapsed under the weight of near-universal criticism from opposition parties, rights groups, and the tech industry.
This is a mandatory data retention regime that forces companies to hold location data, device information, and other sensitive metadata on every Canadian, not just those suspected of crimes, ready for law enforcement retrieval via warrant. The logic is familiar: build the haystack first, search it later.
Public Safety Minister Gary Anandasangaree framed the bill as a necessary modernization. “Canada is woefully behind our most important allies. Technology has moved forward; our laws are stuck in the previous century,” he said Thursday, flanked by police chiefs and Justice Minister Sean Fraser.
RCMP senior deputy commissioner Bryan Larkin added, “There’s an actual series of tools here that will eventually lead to greater success, greater efficiencies in police investigations, greater solvency in crime and, quite frankly, improving the safety of Canadians and, more importantly, addressing the concerns of victims.”
The government claims this isn’t surveillance of ordinary Canadians. Anandasangaree was explicit: “I want to be clear what C-22 is not. It is not about surveillance of Canadians going on about their daily lives. It is about keeping Canadians safe in the online space.”
The bill does exclude web browsing history and social media activity from its mandatory retention requirements. But the bill doesn’t need to include everything to be seriously invasive.
Location data alone tells a story. Where you sleep, where you worship, which doctor you visit, which protests you attend. All stored for a year, accessible to police and CSIS with a warrant, and built into every electronic service provider’s systems by law.