ExpressVPN has joined a growing group of privacy and VPN companies criticizing Canada’s proposed Bill C-22, also known as the Lawful Access Act, over concerns that it could weaken the privacy guarantees buyers expect from a premium VPN.
The company told TechRadar it is carefully reviewing the bill, especially provisions linked to user data access and technical capabilities that could support government access to protected communications. Its core position is blunt: no-logs architecture and encryption are non-negotiable.
For anyone comparing VPNs, this is not just a policy dispute in another country. It goes directly to the claims that usually drive a VPN purchase: whether the provider stores activity logs, whether encrypted traffic can stay private, and whether the company would be able to hand over meaningful user data if compelled.
Why Bill C-22 matters to VPN buyers
Bill C-22 is designed to modernize lawful access powers for law enforcement and national security investigations. The proposal includes rules that could require certain electronic service providers to maintain technical capabilities for authorized access, as well as regulations for retaining categories of metadata for a reasonable period of up to one year.
The Canadian government has said the bill contains safeguards, including limits around systemic vulnerabilities and metadata retention. Privacy companies and digital rights advocates remain concerned that technical access requirements and retention rules could still conflict with the privacy model that secure VPNs and encrypted messaging services are built around.
That distinction matters when you are choosing a VPN. A strict no-logs VPN is supposed to avoid collecting records of what you do online. If the provider does not keep activity logs, there should be little useful browsing data to provide later. Metadata rules are different from content access, but privacy-focused buyers often care about both, because metadata can still reveal patterns about connections, timing and accounts.
ExpressVPN Aircove Wi-Fi 6 VPN Router
Aircove is a Wi-Fi 6 router with ExpressVPN built in, so devices that cannot run a VPN app directly can still connect through the router. It is best suited to readers who want router-level VPN coverage and understand that VPN features require an active ExpressVPN subscription.
As an Amazon Associate I earn from qualifying purchases.
The core concern: access tools can become security risks
ExpressVPN’s argument is that encryption and no-logs systems are not optional extras. They are the foundation of the service. The company warned that laws requiring data retention or technical access can undermine the security millions of users rely on, even when the stated goal is legitimate law enforcement access.
The practical worry is simple: if a company is required to build a technical route into protected systems, that route may not remain useful only to the intended authorities. Attackers, hostile states or insiders may try to exploit the same capability. That is why privacy providers often describe mandated access systems as backdoors, even when governments use the language of lawful access.
For buyers, the key issue is not whether a VPN brand says it supports privacy. Most do. The better question is whether its architecture, jurisdiction, transparency record and public commitments make that claim credible under pressure.
How major privacy companies are responding
ExpressVPN is not the only company pushing back. Proton VPN, NordVPN, Windscribe and Signal have all criticized the proposed legislation or warned about its possible impact on privacy-focused services.
| Company | Reported position | Why it matters for buyers |
|---|---|---|
| ExpressVPN | Says no-logs architecture and encryption are non-negotiable | Reinforces the importance of architecture, not just marketing claims |
| Proton VPN | Says it will not compromise its no-logs policy | Highlights jurisdiction and provider resistance as buyer factors |
| Windscribe | Has warned it could move operations if the bill passes | Shows how local legal pressure can affect where a VPN operates |
| Signal | Has warned it would rather leave a market than weaken user trust | Shows similar concerns apply to encrypted messaging, not only VPNs |
This does not mean every VPN will respond in the same way if Bill C-22 advances. It does mean privacy shoppers should treat legal resilience as part of the product, alongside speed, streaming performance, server coverage and app design.
What to check before choosing a VPN now
If you are buying or renewing a VPN subscription, this debate is a reminder to look beyond the discount banner. A low price is useful only if the service still matches the privacy risk you are trying to reduce.
- No-logs policy: Look for clear wording on what is not collected, including browsing activity, connection timestamps and IP addresses.
- Independent audits: Prefer providers that have had no-logs claims and infrastructure reviewed by outside auditors.
- Jurisdiction: Check where the company is legally based and where it operates key infrastructure.
- Transparency: Look for warrant canaries, transparency reports or public explanations of how legal requests are handled.
- Encryption design: Strong encryption is expected, but buyers should also consider whether the provider explains how its systems limit access to user data.
ExpressVPN Aircove Go Portable VPN Router
Aircove Go is a compact Wi-Fi 6 router with ExpressVPN built in for creating a VPN-protected network while traveling or working from shared spaces. It is most useful for people who want one travel network for laptops, phones, streaming devices and other gear.
As an Amazon Associate I earn from qualifying purchases.
The buyer takeaway
Bill C-22 is still a proposed Canadian law, so the final impact on VPN providers will depend on how the legislation develops, how rules are implemented, and how companies respond. But the backlash from ExpressVPN and other privacy brands is already useful for buyers because it reveals which providers are willing to draw public lines around logging and encryption.
If privacy is your main reason for using a VPN, prioritize services that can explain their no-logs architecture in practical terms, have independent audit history, and are clear about how they handle government pressure. The best VPN for streaming or travel is not always the best VPN for a high-privacy threat model, and Bill C-22 is a timely reason to make that distinction before you pay.