Under Bill C-22, police could ask a phone or internet company, without going to a judge, only one thing: whether it provides service to a particular person, account or number. Getting the customer's name, address and other subscriber details would still need a court order, though a new and easier one to obtain. Bill C-22, the Lawful Access Act, 2026 , passed the House of Commons on June 18, 2026 and passed second reading in the Senate on October 22, 2026. It is now being studied by the Standing Senate Committee on National Security, Defence and Veterans Affairs. It is not law yet, and it could still be amended.
According to LEGISinfo, Parliament's bill tracker, Bill C-22 was introduced on March 12, 2026, passed third reading in the House of Commons on June 18, 2026, and passed second reading in the Senate on October 22, 2026. The bill text discussed below is the version passed by the House. If the Senate amends it, the House would have to consider those changes before the bill could receive royal assent.
The bill would add section 487.0121 to the Criminal Code, creating a confirmation of service demand. A police officer could require a telecommunications service provider to confirm whether it provides, or has provided, service to a subscriber, account or identifier named in the demand. The answer is yes or no. The demand does not, on its own, produce the customer's name, messages or location.
The bill sets limits on the demand:
The demand would apply only to telecommunications service providers, such as phone and internet companies. It could not be used on hotels, car rental companies or medical facilities, according to the Department of Justice .
To get subscriber information, police would apply to a justice or judge for a new subscriber information production order (proposed section 487.0142). The bill defines subscriber information broadly: name, pseudonym, address, telephone number and email address, account numbers, the types of services and when they were provided, and information identifying the devices used. The judge must be satisfied, on sworn information, that there are reasonable grounds to suspect an offence and that the provider holds the information and it will assist the investigation.
That is a lower threshold than the general production order police use today, which requires reasonable grounds to believe (section 487.014), which is why the government describes the new order as narrower and faster. Message content, such as texts and emails, would still require other court orders.
The bill would also allow police to seize subscriber information without an order where the conditions for an order exist but exigent circumstances make it impracticable to get one. It would confirm that police do not need an order or warrant to receive information someone provides voluntarily or is required by law to provide, or to use information that is available to the public.
The Department of Justice says these changes respond to two Supreme Court of Canada decisions, R. v. Spencer (2014) and R. v. Bykovets (2024), which held that police need lawful authority to obtain basic identifying information such as subscriber details and IP addresses.
Part 2 of the bill would enact the Supporting Authorized Access to Information Act. It sets up a framework so that electronic service providers can help police and CSIS use access powers granted under the Criminal Code or the CSIS Act. For "core providers" (providers in classes listed in a schedule to that Act), the government could make regulations on technical capabilities and could require certain categories of metadata to be kept for up to six months. The bill states that these regulations cannot require keeping the content of communications, a person's web browsing history or their social media activity. A core provider would also not have to comply with a regulation if doing so would require it to introduce a systemic vulnerability into its service.
Phone and internet records can be evidence in criminal cases, from fraud to threats. If the bill passes, the path from a phone number to a name could become faster. The rules on how police obtain that information would still matter in court: the Charter protects against unreasonable search and seizure, and a defence lawyer can challenge whether a demand, order or emergency seizure met the conditions the law sets. If police contact you about phone or online records, our article on the types of search warrants in Canada explains the orders they currently use, and a Toronto criminal lawyer can advise you before you answer questions.
If you learn that police are looking at your phone, internet or online accounts, speak to a lawyer before you give a statement or hand over devices. Mass Tsang LLP has practised criminal, quasi-criminal and traffic defence exclusively since 2013. Contact us for a free, confidential consultation.
No. As of November 10, 2026, Bill C-22 has passed the House of Commons and second reading in the Senate, and is being studied by a Senate committee. It does not apply until it receives royal assent and comes into force.
Not through the new demand. Without a judge, police could only ask whether the company serves a specified person, account or identifier. Your name and other subscriber details would require a judicial production order, except in exigent circumstances where getting an order is impracticable.
It is a proposed demand, in new section 487.0121 of the Criminal Code, that would require a telecommunications provider to confirm whether it provides or has provided service to a named subscriber, account or identifier. Police would need reasonable grounds to suspect an offence.
It is a lower standard than "reasonable grounds to believe," which applies to a standard search warrant (section 487) and to the general production order (section 487.014). Bill C-22 uses the reasonable suspicion standard for both the confirmation of service demand and the subscriber information production order.
No. The new demand and subscriber order do not cover the content of communications. Content would still require other court orders, and the bill bars metadata retention rules from covering content, browsing history or social media activity.
A provider could apply to a judge within five business days to revoke or vary a confirmation of service demand. It would not have to answer until the application is decided. Failing to comply without lawful excuse would be an offence with a fine of up to $5,000.
Legal Content Disclaimer:
Legally Reviewed by
Jeff Mass
| Updated: November 11, 2026
