I asked some companies about their plans for Bill C-22
In response to interest shown in my comment in my previous post, here are some responses I got from companies regarding Bill C-22.
Some parts are omitted where it would be especially personally identifying.
My question to all of these companies was essentially "If bill C-22 passes in Canada, how will Canadian users be affected? Will you comply? What plans do you have in place? What should Canadian users be aware of?"
These emails and responses were from June of this year.
Kagi
We're following Bill C-22 closely. It's still being amended, so the final text isn't settled yet. Once it's finalized and voted on, we'll be able to assess exactly what, if anything, applies to Kagi and share a clear plan.
In the meantime, nothing changes about how we operate. We don't log your searches or tie them to your account and tools like Privacy Pass are there to keep your activity unlinkable regardless of how the law lands.
GrapheneOS
As mentioned previously on our social media, GrapheneOS server infrastructure is hosted in several locations across the world. We don't believe we will be affected by this. People should still campaign against such legislations.
Tailscale
[Employee name] from the Tailscale support team here, thanks for writing in. I understand you had some questions about the Canadian Bill C-22.
Tailscale’s stance on the Canadian Bill C-22 is discussed in this blog post from our CEO: https://tailscale.com/blog/bill-c22-canada
I hope this helps – I’m not able to provide any further comment on the issue.
Mullvad
We will never keep any activity logs from our VPN servers, and of course we won't install surveillance tools.
If they asked that and there was no way to fight it legally then we would shut down our servers in Canada.
1Password
Thanks for contacting 1Password Support. My name is [employee name] , and I’m happy to help you today.
Great questions, and completely understandable concerns given the current discussion around Bill C-22. The most important thing to know is that due to 1Password’s zero-knowledge encryption, even under a valid legal demand, 1Password cannot decrypt your vault data - regardless of region or legislation.
The jurisdiction affects what legal challenges are possible and what metadata (such as your account email or billing information) could be subject to a request, but not the vault contents themselves. So regardless of the type of request or which law applies, the end result is always the same: no one but you can see your data.
Bill C-22, as currently written, is focused on subscriber metadata - not encrypted vault contents. And since we have no ability to decrypt your vault in the first place, there is nothing to hand over even if compelled.
What if there was a valid court order?
Even under a valid court order, 1Password cannot decrypt your vault - it is technically impossible for us to do so. Only you know your Account Password and Secret Key, and without both, the data cannot be accessed. There is no backdoor, no master key, and no mechanism for us to retrieve your information on anyone’s behalf.
We are continuing to monitor Bill C-22 closely and would challenge any requirements that could weaken customer privacy or security. Protecting your data by design is at the core of how 1Password works, and that won’t change.
I hope that gives you some reassurance. Please don’t hesitate to reach out if you have any further questions!
Synology
We are aware of the proposed Bill C-22 and are closely monitoring the legislative developments in Canada. As the Bill is still undergoing the legislative process, we will continue to evaluate any potential impact on our services and operations as the legislation develops.
We remain committed to protecting user privacy and handling personal data in accordance with applicable laws and our privacy commitments. For more information, please refer to our Privacy Statement at https://www.synology.com/en-ca/company/legal/privacy.
Thank you for your understanding.
Proton response 1
Thank you for reaching out.
We share your concerns about the Canadian C-22 bill, and we have recently, together with other organizations, experts and companies, signed this letter sent to the Canadian government. We believe the C-22 bill is dangerous for Canadians' privacy and security. There is no way to implement backdoors securely, and far from making Canadians safer, it will expose them to new, dangerous cyber threats.
Over the years, we have had a consistent message, whether in Russia, Iran, the EU, the UK or anywhere encryption is being threatened: we will refuse to do anything that undermines our encryption or our users' rights. As our services run globally, complying with this bill would mean undermining the safety of our users all over the world, which is unacceptable. We plan on continuing to serve our users in Canada, regardless of what happens with the bill.
We encourage Canadian citizens to reach out to their government and to voice their opposition to this text.
After I told them politely that their answer was dogshit and didn't answer my questions, this is their follow up
Proton response 2
Be informed that we will do none of what you mention [regarding complying with C-22 orders for Canadian Proton accounts] , as we would not comply with Bill C-22. No steps are taken to remove Canadian association from any Proton account or service.
Also, we welcome Canadians to our services and very much intend to continue doing so.
If there's anything else we can help you with, please feel free to contact us.
I think there may be more but can't find them!