SeaPRwire – Bill C-22, the Lawful Access Act, 2026, was introduced on 12 March, passed the House of Commons on 18 June and has been before a Senate committee since; as of 22 October it was still there. Planet VPN, a Romanian VPN operator, added a section on the bill to its guide to Canadian VPN law this week, and it opens with the answer its readers keep asking for. Using a VPN in Canada is legal, and the bill does not change that.
What the bill changes is narrower. It sets out what electronic service providers must be able to do when presented with a lawful order, and what information police can request with a warrant and without one. Its definition of an electronic service provider covers services offered to people in Canada, which is wide enough that VPN companies could fall inside it.
The bill speaks to what providers must be able to do. It says far less about what users may do, which is why the legality question has a one-sentence answer and the compliance question does not. Most of the guide’s length goes to the second.
The heaviest duties would attach to a category the bill leaves undefined: core providers. That class is to be set by regulation. Until the definition exists, no VPN company can say whether it will be inside it, and for an operator running an encrypted service that is the most consequential open question in the legislation.
Core providers could be required to retain certain metadata for up to six months. The limit was one year when the bill went into committee study and was cut to six months there. Content of communications and browsing history sit outside the requirement. A number moved during committee; the category that decides who the number applies to did not. For a service that keeps no logs, a six-month retention duty is an architectural requirement rather than an incremental one.
Which categories of metadata would apply is the other half of that question, and the guide has no answer because the regulations do not. Planet VPN’s audit trail runs through the MASA assessment of its Android app, which tests the app’s data handling against a mobile security standard covering storage, encryption and network communication. That is an assessment of a client. It does not describe what the operator retains on the server side.
The bill works through orders and warrants, and the guide’s uncertainty concentrates on the order route, where confidentiality is built in. A warrant puts a judge between the provider and the request. A confidential ministerial order does not, and a mechanism that cannot be described in advance is also one that cannot be audited afterwards.
Planet VPN’s guide lists the rest as undecided: how confidential ministerial orders would operate, and how the bill’s safeguard against creating systemic security vulnerabilities would be applied in practice. Confidential orders are hard to contest in public and hard to audit from outside, and the guide flags the mechanism without describing how it would run. Federal officials have told senators the first regulations would likely take 18 months to two years after royal assent.
That timetable produces a gap worth naming. If the estimate holds, there is a stretch during which the Act is in force and the definition that gives it teeth is not. Providers would be working under an obligation whose scope is still being written. The guide’s update schedule tracks the same sequence: Senate committee report, third reading, royal assent, coming into force of Part 1, publication of draft regulations.
Three companies have answered the uncertainty with geography. Psiphon, the censorship-circumvention service that began as a University of Toronto Citizen Lab project and reports about 20 million monthly users, said on 6 October that it was preparing to move its operations out of Canada if the bill passes in its current form. Windscribe has said it is exploring a move and would rather relocate than begin logging users. Proton has said it would never accept a requirement that contradicts its no-logs policy.
All three keep no logs, and none of their statements turns on the six-month figure. What they are reacting to is the possibility that the core-provider definition lands on an architecture they cannot adapt without rebuilding it. That question is settled by whoever drafts the definition. A Senate vote does not settle it.
Relocation is a costly answer to a requirement that has not been written in final form, and three companies volunteering it is a rough measure of how they size the compliance burden.
One section of the guide cuts against the product it describes. A VPN does not make an unlawful activity lawful. Copyright infringement and fraud remain illegal however a person connects, and unauthorised gambling and cryptocurrency platforms carry their own legal risk. The guide separates ordinary privacy use from those cases area by area — streaming, travel, gambling, cryptocurrency — which is less flattering to the service being sold than a blanket assurance would be.
The public argument over Bill C-22 has been conducted largely between platforms and police. The person using a VPN to check email on hotel Wi-Fi shows up in it as an abstraction. Planet VPN organises its guide around four plain questions instead: whether VPNs remain legal, what providers could be required to keep, what is still undecided, and which activities stay unlawful regardless of how a person connects.
Planet VPN’s interest in the subject follows from where it sits. It operates from Romania, an EU member state outside the Five Eyes, Nine Eyes and Fourteen Eyes intelligence-sharing arrangements. Romania’s Constitutional Court struck down the country’s data-retention laws in 2009 and again in 2014. The company says it does not log browsing activity.
Those facts do commercial work, and they also describe a jurisdictional position. A retention duty written in Ottawa would attach to a Romanian company selling to Canadians, and whether that produces an enforceable obligation on a provider with no Canadian presence is a question the bill leaves open.
The service itself is straightforward. The free tier covers six locations — both coasts of the United States, the United Kingdom, the Netherlands, Germany and France — and the paid tier more than 100, including Canadian servers that subscribers travelling abroad can use to reach Canadian services.
“The question Canadians ask most about VPNs is simple: is it legal? Today the answer is yes, and Bill C-22 doesn’t change that,” said Roman Bogoslavsky, who wrote the guide. “What the bill could change is what service providers must keep and be able to produce, and much of that will be decided in regulations that haven’t been written yet.”
A versioned record of a moving bill is a modest product, and it is also the kind of commitment a company can be held to: if the regulations arrive in a form the earlier versions did not anticipate, those versions stay online. Everything the guide says about the bill is secondary to the bill. Planet VPN sends readers to LEGISinfo for its status, which is the right division of labour: the company’s account is a reading of a public document, and the document is one it cannot edit.
What the guide contains this week is a status update and a list of gaps. That is an accurate description of where Bill C-22 stands.
This article was prepared by the expert team at Global Infinity Labs, drawing on insights and data provided through its MCP data services.
About Global Infinity Labs
Global Infinity Labs is an AI innovation company specializing in MCP data services.
Email: support@globalinfinitylabs.com