Bill C-22: Lawful Access Act, 2026

Any business that provides digital or telecommunications services to people in Canada — including internet service providers, mobile carriers, messaging platforms, cloud storage companies, social media services, and app developers — could be directly affected, no matter where they are headquartered. A small Canadian internet provider and a large foreign tech company alike may find themselves subject to demands to hand over subscriber information (like names, account numbers, and device identifiers), store metadata for up to six months, or build technical capabilities that let law enforcement access data. Core providers (those in classes set by regulation) face the most significant obligations, including testing and maintaining intercept-ready systems and complying with ministerial orders. Non-compliance can result in fines up to $500,000 for corporations, and company directors or officers can be personally liable if they authorized or allowed a violation.