Google warns lawful access bill creates a ‘surveillance infrastructure,’ undermines transparency

Google is pressing the Canadian government to further revise Bill C-22, warning that the proposed lawful-access legislation could establish a sweeping “surveillance infrastructure,” weaken transparency and allow authorities to impose broad data-retention requirements on technology companies.

In a briefing note sent to senators reviewing the bill, the technology giant recommends stronger protections for encryption and tighter limits on the government’s ability to secretly order companies to modify their systems.

Bill C-22 would require electronic service providers operating in Canada to maintain capabilities that could assist police and the Canadian Security Intelligence Service with lawful surveillance. Companies would also be prohibited from disclosing ministerial orders issued under the legislation.

Google argues that this framework is “highly problematic” because it could undermine due process and prevent the public from understanding how state surveillance powers are being used.

“Public transparency is critical for the effective functioning of a democratic state, particularly in the context of state surveillance,” Google’s briefing says. “If surveillance directives are made in secret, citizens cannot understand or scrutinize state power.”

The company’s objections add to criticism from the Canadian Chamber of Commerce and major technology businesses including Apple and Meta. Signal, the encrypted messaging service, has previously warned that it could leave Canada rather than comply with an order requiring it to compromise user privacy.

<>

Government says bill includes independent oversight

Simon Lafortune, a spokesperson for Public Safety Minister Gary Anandasangaree, rejected claims that the legislation would authorize indiscriminate surveillance or force companies to create systemic security weaknesses.

The government argues that publishing the technical details of ministerial orders could reveal investigative capabilities and help criminals evade detection.

According to Lafortune, confidentiality does not eliminate accountability. Ministerial orders under Bill C-22 would need approval from the Intelligence Commissioner and could face judicial review. The government says these safeguards provide independent oversight without exposing sensitive investigative methods.

Google challenges bulk metadata retention

One of Google’s central concerns is the bill’s proposed power to require companies to collect and retain customer metadata for up to six months.

Metadata would not include the contents of emails, text messages, social media posts or browsing histories. However, it could reveal which phone numbers communicated, when those interactions occurred and information capable of identifying a person’s location.

Google is asking senators to remove the retention provisions, arguing that they could permit blanket collection without requiring authorities to demonstrate individualized suspicion.

“This treats all users as potential criminals,” the company says in its submission. It also stresses that metadata is not simply administrative information: when analyzed or combined with other records, it can expose intimate details about a person’s relationships, routines and private life.

The company points to Supreme Court of Canada decisions recognizing that people can have a reasonable expectation of privacy in metadata. It argues that Canadian law already provides targeted preservation orders that allow investigators to retain relevant information when the request is necessary, proportionate and constitutionally compliant.

Centralized records could become targets for hackers

Anandasangaree introduced several amendments after the bill drew criticism from civil-liberties organizations, academics, lawyers and technology companies. Among those changes was a reduction in the maximum metadata-retention period from one year to six months.

Google says the shorter period does not resolve the underlying issue. In its view, the legislation could still enable population-scale retention without a connection to a specific suspect or investigation.

Large repositories of metadata would also create cybersecurity risks. Databases holding location and communications records could become valuable “honeypots” for cybercriminals, hostile states or malicious insiders. A breach could expose sensitive information about millions of people even if the contents of their communications remained encrypted.

Encryption protections may not go far enough

Bill C-22 states that service providers would not have to comply with an order or regulation if doing so required the introduction of a “systemic vulnerability.” An amendment adopted in the House of Commons expanded the definition of that term, offering clearer protection against direct attempts to break end-to-end encryption.

Google nevertheless argues that the wording remains too narrow. While the bill may prevent an explicit encryption backdoor, the company says it does not adequately address other technical changes that could weaken confidentiality or system security.

It is therefore recommending a broader definition of systemic vulnerability—one designed to protect encryption as well as prevent modifications that create a credible risk to users, infrastructure or stored data.

The debate reflects a longstanding conflict between law-enforcement demands for access to digital evidence and warnings from security specialists that exceptional access cannot reliably be restricted to authorized investigators. Any weakness created for one party may eventually be discovered or exploited by criminals and foreign intelligence services.

Senate review could bring further amendments

The bill is expected to move to a Senate committee, where additional changes could be proposed. Senators will be tasked with weighing the government’s stated need for modern investigative tools against concerns about privacy, cybersecurity, transparency and constitutional rights.

Google says it supports efforts by police and intelligence agencies to combat crime and terrorism. However, it maintains that these objectives can be pursued without engineering weaknesses into widely used products and services.

In a separate statement, the company said amendments adopted by the House of Commons did not adequately resolve several critical issues. Google said it would continue discussing the legislation with both the federal government and senators as the review proceeds.