VPNs with servers in Canada

Bill C-22, the Lawful Access Act, 2026, was introduced on 12 March 2026 and passed the House of Commons on 18 June 2026. As of 3 November 2026 the Senate has completed second reading and referred it to committee, so it is not law. Part 1 would add Criminal Code routes to subscriber information; Part 2 would enact the Supporting Authorized Access to Information Act.

That Act would cover any “electronic service provider” serving persons in Canada or doing business there; listed “core providers” would face regulations on technical capability and on keeping metadata, never content or browsing history, for up to six months. The Minister could order any such provider, with the Intelligence Commissioner’s approval. Whether a VPN operator would be covered is not established.

The Criminal Code makes it an offence to make, distribute, possess or access child sexual abuse and exploitation material (section 163.1) and to wilfully promote hatred against an identifiable group (section 319(2), which needs the Attorney General’s consent to prosecute).

Under section 164.1 a judge may order the custodian of a computer system to make listed illicit material unavailable and to provide information needed to identify and locate the person who posted it.

Blocking exists as a civil remedy for copyright: in Teksavvy Solutions Inc v Bell Media Inc, 2021 FCA 100, the Federal Court of Appeal upheld a Federal Court order requiring internet providers to block two sites, finding jurisdiction under the Federal Courts Act and the Copyright Act.

Uttering a threat to cause death or bodily harm (section 264.1) carries up to five years’ imprisonment. Criminal harassment (section 264), which includes repeatedly communicating with a person by telecommunication so as to make them fear for their safety, and publishing an intimate image without consent (section 162.1) are crimes; so is the wilful promotion of hatred.

Police need judicial authorisation to learn who is behind an IP address (R v Spencer, 2014 SCC 43), and since R v Bykovets (2024 SCC 6, decided 5–4 on 1 March 2024) even a request to a third party for the address itself is a search.

The National Security and Intelligence Review Agency reviews any activity of the Canadian Security Intelligence Service (CSIS) or the Communications Security Establishment (CSE), and of other departments in national security, and investigates complaints (NSIRA Act, s. 8). The National Security and Intelligence Committee of Parliamentarians reviews the national security and intelligence framework and departments’ activities (NSICOP Act, s. 8).

Since July 2019 an Intelligence Commissioner, a retired superior-court judge, has had to approve certain ministerial authorisations for CSE and CSIS, deciding whether the minister’s conclusions are reasonable, generally within 30 days. On 16 July 2020 the Federal Court found that CSIS and the Attorney General had failed to disclose to it CSIS’s reliance on information likely collected unlawfully when seeking warrants.

The order of the rows is the security score, and a server’s location is not a recommendation.