Psiphon is preparing to move its operations out of Canada if the federal government’s controversial Bill C-22 becomes law without major changes.
The Toronto-based privacy technology company told The Globe and Mail that it has begun developing plans to relocate, warning that the proposed legislation could force it to weaken security features that protect users in countries such as Iran, Russia, and China.
Psiphon joins Signal, NordVPN, and Windscribe, which have also raised concerns about the legislation and warned that they could reconsider operating in Canada.
Psiphon Warns Against Secret Backdoors
Psiphon originated as a Citizen Lab project at the University of Toronto in 2006 and now serves roughly 20 million users each month. Many depend on the platform to bypass internet censorship imposed by governments.
The company differs from many VPN providers because its software is open source, meaning its code is publicly available for inspection. Psiphon says this makes any attempt to secretly introduce surveillance capabilities particularly problematic.
Kenzie Elsworthy, Psiphon’s vice-president, said the company’s open-source approach is central to the trust users place in its technology.
He argued that a secret vulnerability could not realistically be introduced into a system whose code is publicly accessible.
“That is not lawful access. It is a published vulnerability,” Elsworthy said.
Psiphon does not want to leave Canada, he said, but relocating could become the company’s only option if Bill C-22 passes in its current form.
The potential departure would also come after the Canadian government provided Psiphon with approximately $600,000 in National Research Council funding this year.
What Bill C-22 Would Change
Introduced on March 12, 2026, Bill C-22 would give law enforcement and the Canadian Security Intelligence Service (CSIS) new powers requiring telecommunications companies, internet providers, and other electronic service providers to develop capabilities that would facilitate access to information.
Supporters of the bill argue that Canada has fallen behind other members of the Five Eyes intelligence alliance in providing authorities with lawful access powers.
However, the bill’s broad definition of an “electronic service provider” could potentially include messaging platforms and VPN services.
The government amended the legislation before it passed the House of Commons on June 18. The changes included protections for end-to-end encryption and reduced the proposed metadata retention period from 12 months to six.
The bill is now before the Senate.
VPN and Tech Companies Brace for Uncertainty
Technology companies are also concerned because the legislation does not clearly establish which providers will ultimately be subject to its requirements. As a result, companies classified as electronic service providers are preparing for potentially significant changes.
Last month, 23 technology companies, including Windscribe, Nord Security, and Kape Technologies, the parent company of ExpressVPN, called on the Canadian government to amend the bill.
Citizen Lab founder Ron Deibert has also warned that the legislation, in its current form, could make it difficult for some important privacy tools to continue operating in Canada.
Concerns have now extended beyond Canadian technology companies, with European digital rights organizations also urging authorities to reconsider aspects of the legislation.
With Bill C-22 now heading through the Senate, Psiphon’s relocation plans add to growing pressure on Ottawa to address concerns over privacy, encryption, and lawful access before the legislation becomes law.
