Windscribe on Canada's Bill C-22: What the Surveillance Bill Means for VPN Users

Windscribe told a worried subscriber on Reddit this month that Bill C-22 “won’t change our logging or privacy policies,” a calmer message than the one it was sending in May, when it said it would sooner relocate its headquarters than start logging users. The exchange, first reported by TechRadar on July 24, is worth unpacking, because Windscribe’s actual answer is more jurisdictional than reassuring.

What Bill C-22 actually does

Bill C-22, formally the Lawful Access Act, would let the Canadian government compel electronic service providers, including VPN companies, to retain user metadata and build technical capabilities for law enforcement access. Introduced by Public Safety Minister Gary Anandasangaree, it cleared the House of Commons at third reading on June 18 after the government moved to limit debate, and it’s now with the Senate, which won’t begin its study until Parliament returns in September, according to the Electronic Frontier Foundation’s tracking of the bill.

Late amendments cut the maximum metadata retention period from twelve months to six and added language stating the act can’t be read as compelling decryption unless a provider already holds the keys. Law professor Robert Diab has argued that doesn’t go far enough, since ministerial orders could still sweep up metadata belonging to people under no suspicion at all. The government maintains the bill builds no backdoors and that authorities still need judicial authorization to obtain data.

Windscribe’s answer, and why it’s jurisdictional rather than reassuring

Pressed on Reddit about whether paying for a Canada-based VPN is now a privacy risk, Windscribe’s support account said the incoming law creates real internal complications, but framed it as something the company has to sort out rather than something subscribers should expect to feel directly. Its stated fallback: a VPN operating outside Canada isn’t bound by Canadian law, so if compliance ever became unworkable, the company has said it’s actively exploring relocating its headquarters rather than complying, a position CEO Yegor Sak first laid out publicly in May.

That’s a meaningfully different promise than “we won’t log you.” It’s closer to “we’ll leave before we log you,” which depends entirely on Windscribe following through if the bill passes largely intact. Windscribe also pointed out, accurately, that no current law stops Canadians from using a VPN at all; the exposure described only applies to a provider that stays registered in Canada and is then compelled to start logging.

Why this matters more for Windscribe specifically

Our data already flags Windscribe’s jurisdiction as a soft spot independent of Bill C-22: it’s based in Canada, a founding Five Eyes member, and scores 2/5 on jurisdiction in our comparison table. Windscribe also hasn’t commissioned an independent no-logs audit, unlike NordVPN, Surfshark, Mullvad and ProtonVPN, and its own terms of service already acknowledge it retains some data today, a gap that puts its no-logs score at just 2/5 in our data even before Bill C-22 enters the picture. None of that means Windscribe is dishonest; it has published transparency reports for years and open-sources its apps. But it does mean the company was already working from a weaker jurisdictional starting point than the competitors making the loudest noise about this bill, including Signal, Apple, Google, and Proton VPN, all of whom have publicly opposed C-22’s metadata and encryption provisions.

Windscribe isn’t the only company pushing back

The backlash to Bill C-22 extends well beyond one VPN provider. Signal has said the bill’s provisions could force it to withdraw features or leave the Canadian market entirely rather than comply with technical capability mandates it views as backdoor requirements. Proton has published its own objections on jurisdictional grounds similar to Windscribe’s, and Google has separately warned that the bill’s language risks creating what it called a broader surveillance infrastructure rather than a narrowly scoped law enforcement tool. ExpressVPN has also gone on record opposing the bill’s metadata retention requirements specifically.

That breadth of opposition, from a Swiss-based privacy company to major US tech firms, is part of why the government’s amendments so far, cutting retention from twelve to six months and adding the decryption carve-out, read to critics as concessions on the margins rather than a change of direction. Michael Geist, the Canadian law professor who has tracked the bill closely since introduction, has described it as a repackaged version of a surveillance framework Canada already tried and largely abandoned in earlier years, now returning with narrower amendments rather than a fundamentally different approach.

What Windscribe suggested for anyone still uneasy

For subscribers who want to minimize their financial paper trail regardless of how the bill plays out, Windscribe’s own suggestion was to pay in crypto, so neither the government nor a card issuer has a record of the purchase. That’s a reasonable mitigation for the payment layer specifically; it doesn’t change what a court order could eventually compel the company to log about your connections if C-22 passes and Windscribe stays put.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

What happens next

The Senate won’t begin studying Bill C-22 until Parliament returns in September, according to the government’s own LEGISinfo tracker, which leaves a real window before anything changes in practice. The government holds a majority, and the bill could become law before the end of 2026 if it clears the Senate without further amendment. Whether Windscribe, or any Canadian VPN, actually follows through on relocating rather than complying is untestable until a court order forces the question, which is exactly why “we’d leave first” is a promise worth watching rather than one to take fully on faith today.

If jurisdiction is a dealbreaker for you right now

Nothing about Bill C-22 has passed yet, and no current law requires any Canadian VPN to log anything today. If you’d rather not wait to find out how this resolves, providers based outside Canada with audited no-logs policies, ProtonVPN in Switzerland or NordVPN in Panama among them, sidestep this specific jurisdictional question entirely. Our guide to VPNs for Canada covers how jurisdiction factors into a broader buying decision beyond just this one bill.

Why this keeps happening to Canadian VPNs specifically

This isn’t the first time a Canada-based provider has had to publicly explain its jurisdiction to worried subscribers. Canada’s status as a founding Five Eyes member means any Canadian company handling user data operates under a legal system built around intelligence-sharing obligations that predate this specific bill by decades. Bill C-22 raises the stakes considerably, since it would add compulsion powers rather than just the general intelligence-sharing framework already in place, but the underlying jurisdictional question, whether a provider registered in Canada can ever fully insulate its users from Canadian law, isn’t new. It’s the same reasoning that keeps Mullvad’s Swedish base and ProtonVPN’s Swiss base in the conversation whenever readers ask which jurisdiction actually matters for a VPN purchase.

What’s different this time is the explicitness of the industry response. Windscribe, Signal, Proton, Google and ExpressVPN all going on record against a single piece of legislation, rather than issuing quiet policy tweaks, suggests the companies themselves see C-22 as a meaningfully bigger threshold than routine data-sharing requests. That’s worth taking seriously as a signal in its own right, independent of how the Senate vote eventually goes.

Keep reading: Windscribe Review 2026: Best Free Tier, but Worth Paying? and Best VPN for Canada in 2026: Five Eyes at Home.