Mandatory Metadata Retention on Every Citizen for Up to One Year

—A Major Privacy Red Flag

On March 12, 2026, the Canadian federal government tabled Bill C-22, the Lawful Access Act, 2026.

Marketed as essential modernization to equip law enforcement and national security agencies with tools suited to today’s digital threats, the legislation has instead triggered intense concern among privacy advocates, legal scholars, and civil liberties organizations.

The provision drawing the strongest alarm appears in Part 2—the Supporting Authorized Access to Information Act.

This section would allow the government, through regulations, to compel major telecommunications companies and other designated “core” electronic service providers to systematically collect and retain detailed metadata on every user for periods of up to one year.

The retained data includes:

• Precise location information that can reveal where individuals live, work, receive medical treatment, attend places of worship, participate in protests, or visit family and friends

• Device identifiers, connection timestamps, and transmission records that together reconstruct patterns of movement, communication, and association with high accuracy

The bill explicitly prohibits the mandatory retention of message content, browsing history, or social media activity.

Access to any stored metadata would generally require judicial authorization, such as a warrant or production order, except in limited exigent circumstances.

Even so, the creation of a standing, suspicionless, population-wide retention system represents a profound shift.

It moves away from targeted investigations of known suspects toward a model in which the digital lives of all citizens are archived in advance, available for future querying once legal thresholds are met.

Privacy experts warn that once this infrastructure exists, reversing it becomes extraordinarily difficult—and future expansions become far easier to implement.

Public Safety Minister Gary Anandasangaree has defended the measures, stating that Canada lags behind key allies and that the tools are necessary to combat serious crime, protect victims, and address evolving online threats.

He has stressed repeatedly that the bill is not intended to monitor ordinary citizens in their daily lives.

Critics, including privacy law professor Michael Geist and the Canadian Civil Liberties Association, argue otherwise.

They point out that requiring private companies to serve as long-term data warehouses for the state revives one of the most invasive elements of earlier, widely rejected proposals.

Vast centralized collections of location and transmission data not only erode privacy on a massive scale—they also create significant cybersecurity vulnerabilities, turning telecom systems into high-value targets for hackers and foreign adversaries.

Location and connection metadata alone can expose intimate details of personal behavior, beliefs, and relationships.

In a free society, the presumption should be that citizens are not perpetually tracked and profiled unless there is individualized suspicion.

The legislative process is just beginning.

Bill C-22 remains at first reading.

Second reading, committee study, expert testimony, and opportunities for public input and amendments lie ahead.

This is the window to engage:

• Read the full text and explanatory materials at parl.ca

• Contact your Member of Parliament (contact information available at ourcommons.ca)

• Demand thorough scrutiny, robust privacy safeguards, and meaningful public hearings

• Share accurate information widely—awareness is critical before this becomes law

Canada has long balanced security needs with strong protections for individual rights.

The question now is whether this bill genuinely achieves that balance—or whether it quietly crosses a line that many would find unacceptable once fully understood.

What are your thoughts?

Is this a reasonable step to address real threats, or does it go too far toward mass surveillance?