Your phone shakes hands with a tower on the commute, and that handshake writes a log. It can show where you slept and which clinic you walked into before noon.
Police already freeze a named person's records. An officer convinces a judge, the carrier holds that one file, and my commute stays out of it. Bill C-22, the Lawful Access Act, 2026, reverses the sequence. Cabinet and the Public Safety Minister get the power to make electronic service providers keep the logs first, on every subscriber, then wait for a warrant.
Public Safety Minister Gary Anandasangaree and Justice Minister Sean Fraser tabled that power on March 12 with a one-year ceiling. The House passed third reading on June 18. You are the map, and Ottawa wants six months of your towers on standby, which is the cap sitting in the Senate.
The File Built in Advance
Part 2 of the bill, the Supporting Authorized Access to Information Act, lets the Governor in Council name classes of core electronic service providers through the schedule and write regulations that force those companies to retain categories of metadata, including transmission data, for a reasonable period not exceeding six months. Cabinet can add a sector to that schedule by regulation. The first-reading ask was one year. The House sent six months.
The minister does not have to wait for a class. Section 7 lets the Public Safety Minister issue a capability order to any electronic service provider in the country, core or not, once the Intelligence Commissioner approves it. The order can carry the same retention duty. House-passed orders last up to two years. The subscriber has no opt-out.
Tamir Israel at the Canadian Civil Liberties Association named the distinction. Ordering companies to keep everybody's information, he said, not just people suspected of crimes, is different from a backdoor aimed at one target. You put privacy at risk, and a file that large is a target for anyone who can breach it.
The Gag on the Carrier
The company that receives the order cannot tell you it exists. Section 14 bars a provider from disclosing the order, the technical duties inside it, or the representations it made while bargaining with the minister in private. The minister can bless a disclosure. Silence is the default. Non-compliance is an administrative monetary penalty of up to $250,000 a day for a corporation on a continuing violation, and a separate offence with fines reaching $500,000.
The same statute adds a warrantless confirmation-of-service demand. An investigator who wants to know whether a target utilizes a given telecommunications service can send the carrier a yes-or-no demand without a judge. That demand can carry a non-disclosure condition lasting up to one year, so the subscriber never hears that the account was flagged.
They Kept the Logs
Officials lean on a carveout. The House-passed text does not let them require providers to retain message content. It also keeps browsing history and social media activity out of the mandatory file. Anandasangaree told reporters the bill is not surveillance of Canadians going about daily life.
Here's the thing. Nobody has to read the text. Six months of your towers already draws the clinic and the overnight address. The carveout is the sales pitch, and the logs are the trap.
A no-logs VPN that starts keeping that map is no longer the product you bought. NordVPN and Toronto-based Windscribe said they would rather leave the Canadian ecosystem than start keeping those logs. Signal said the same about its service. After the House cut the cap to six months, the secret orders and the gag were still in the bill the Senate received.
The House already passed it, and the text sits in the Senate. You cannot pick a private path through an ecosystem where a minister can order the map in secret and fine the carrier into silence.
0 comments