Canada's Surveillance Summer: What the 2026 Digital Bills Actually Do

In a few short weeks before its summer break, Canada advanced four bills that reset the ground rules of its internet at once: who gets watched, who has to show ID, and what cannot be said. The headline bill would have your provider keep a year of your activity on file, ready for police on request.

The short version, ordered by how hard each one hits your privacy:

• Bill C-22, the Lawful Access Act: a year of mandatory metadata retention, easier police access to your subscriber data, and powers Apple and the EFF call an encryption backdoor in all but name.
• Bill C-34, the Safe Social Media Act: a ban for under-16s that, to enforce, makes every user prove their age, adults included.
• Bill C-36, a rewrite of the federal privacy law: stronger rights on paper, but it sidelines the one independent official whose job is enforcing them.
• Bill C-9, the Combatting Hate Act: already law as of 18 June. A speech law more than a privacy one, but cut from the same cloth.

Bill C-22: a year of your life, kept on file

Tabled on 12 March by Public Safety Minister Gary Anandasangaree (LEGISinfo), the Lawful Access Act does three things at once. It forces providers to keep your metadata for up to a year. It lets police and CSIS pull your subscriber details on a low "reasonable suspicion" bar. And its second half lets the minister issue secret orders telling companies to build government access into their systems, with a permanent gag attached (OpenMedia).

That last part restarted Canada's oldest tech fight: encryption. Apple told a House committee, flatly, that the bill "allows the government of Canada to force companies to break encryption by inserting backdoors into their products" (via Michael Geist). The EFF agreed, and pointed to the 2024 Salt Typhoon hack, where state-backed attackers walked straight through a lawful-access system built for police, as proof of where this leads (EFF). The government says a clause forbidding a "systemic vulnerability" keeps encryption safe. Apple, the EFF and Citizen Lab say that clause does not survive contact with reality.

Where it stands: the bill cleared the House and reached the Senate on 18 June, with study expected in the fall, so it is not law yet (Global News). The pushback is striking for its range. Meta and Apple objected. Signal said it would leave Canada rather than comply. And the federal Privacy Commissioner was kept out of the committee room while the RCMP and CSIS were invited in to shape the amendments (Geist).

Bill C-34: to check the kids, it checks everyone

The Safe Social Media Act, tabled 10 June, bars under-16s from social accounts and stands up a new Digital Safety Commission with fines reaching $10 million or 3% of global revenue (Canadian Constitution Foundation). The catch is simple arithmetic. To keep one fifteen-year-old out, a platform has to verify the age of every adult too.

We have already seen how that ends. In October 2025 a breach at Discord exposed roughly 70,000 users' government IDs that had been handed over for age checks (Geist). The bill tries to head this off by barring platforms from keeping anything beyond the age result, but it leaves the actual method to a regulator that does not exist yet, one of roughly 50 decisions punted to later. Law professor Michael Geist calls the safeguards "an illusion, at least for years to come." The Canadian Civil Liberties Association calls age verification "highly invasive" and "ineffective," and warns the vague "harmful content" duties could double as a censorship lever (CCLA). It has had only a first reading.

The hardest question hangs over the whole bill: the targeted tools already exist. A parent who wants a child off social media can block it on that child's own device today, without a new law and without putting every other adult's ID at risk. FDAT's Focus Mode locks chosen sites, social platforms included, behind a passphrase the child does not have; Apple's Screen Time and Android's Family Link do the same for apps. Leave the decision where it belongs, with parents for their own household and schools teaching kids to handle the web, and the case for making tens of millions of adults prove who they are just to log in gets very thin. When the precise tool is already on the shelf and a government reaches for the population-wide one instead, it is worth asking what the law is really for.

Bill C-36: a privacy law that benches the privacy referee

Tabled 15 June, the Protecting Privacy and Consumer Data Act replaces Canada's 25-year-old privacy law and, on paper, reads well: privacy as a fundamental right, a right to deletion, data portability, real penalties (DLA Piper). Then comes the twist. It pulls the independent Privacy Commissioner off private-sector oversight and hands the job to a new body with less independence. Geist's read: real enforcement may not arrive until 2030 or 2031, because everything waits on a commission that has to be built first (Geist). A privacy bill worth reading past the headline. It sits at first reading.

Bill C-9: the one already on the books

The Combatting Hate Act received royal assent on 18 June (LEGISinfo). It toughens hate-crime and hate-propaganda law and protects access to places of worship. It is a speech law more than a privacy one, but it rode the same wave, and the CCLA's warning is the throughline of the whole session: broad, rushed law, in its words, "gets used against Indigenous peoples, racialized communities, protestors, and dissidents" (CCLA). That pattern has played out before, in other countries and other decades, and it rarely lands on the powerful.

What you can actually do

None of this is settled. C-22 is in the Senate, and C-34 and C-36 return in the fall. There is still a window, and bills like these have been narrowed by public pressure before.

• Tell your MP and senator. OpenMedia runs a one-click tool for it and says more than 10,000 Canadians have already used it (openmedia.org).
• Follow the people reading the fine print.Michael Geist, the CCLA, OpenMedia and the EFF are tracking each bill clause by clause.
• Get around the gates that are already up. When a site blocks you or demands ID because of the region you are in, routing your connection through somewhere the rule does not apply makes the page load normally. That, plus encrypted messaging and tracker blocking, leaves far less of you to collect in the first place.

Where FDAT fits

This is the exact problem FDAT was built for. When a site walls you off or demands ID based on where you are, Smart Routing sends that request through a region where the wall is not up, and the block disappears. The same extension clears the ads and trackers logging your visits and scrambles the fingerprint sites use to follow you around, so the profile being built on you stays thin.