The Canadian Radio-television and Telecommunications Commission approved a broader range of network-level cybersecurity blocking on June 18, 2026, giving carriers more discretion over their tools while drawing a dissent over weaker privacy and oversight safeguards.
In Compliance and Enforcement and Telecom Decision CRTC 2026-140, Expansion of network-level blocking framework, the majority replaced a framework focused on blocklists with one permitting any blocking method that meets requirements of necessity, accuracy and consumer privacy.
The authorization is limited to cybersecurity. It does not permit blocking for commercial, competitive or political purposes, or create a general power to block otherwise illegal activity.
Broader tools, with compulsory blocking for affected customers
The decision followed a 2025 consultation on expanding the framework beyond lists of known indicators of malicious activity. Carriers told the commission they already used other techniques, including blocking particular network ports, forged source addresses and unusual traffic volumes.
The majority concluded that detailed rules prescribing permitted technologies could quickly be overtaken by evolving threats. Such rules could also force carriers to stop using established protective methods. It instead allowed carriers to choose tools, vendors and implementation details, provided they could demonstrate compliance with the framework's principles.
The approval rests on section 36 of the Telecommunications Act, which requires commission approval when Canadian carriers control the content or influence the meaning or purpose of telecommunications they carry for the public. Blocking can prevent delivery of those communications.
Carrier participation remains voluntary. A carrier that chooses to block under the framework must follow its conditions, and customers on participating networks cannot opt in or out. Carriers must nevertheless allow legitimate services that can bypass blocking, including virtual private networks and alternative domain-name-system resolvers.
Providers that do not own or operate transmission facilities were encouraged to follow a similar approach. The commission left open further regulation if their cybersecurity blocking proved inconsistent with the framework.
Complaints and reporting requirements change
The revised rules require a process for receiving, validating and resolving complaints about legitimate traffic being blocked. They extend the resolution period from two business days to five and give carriers flexibility over the investigative and corrective steps, recognizing that complex complaints may depend on third-party cooperation.
Carriers must keep blocking accurate and minimize false positives and overly broad blocking. Third-party suppliers must have appropriate technical expertise and no potential conflicts that could compromise unbiased operation in Canadians' interests.
Public website notices must explain blocking in plain language, disclose reliance on third-party providers, including whether any are outside Canada, and explain complaints and relevant privacy information. The majority reduced the technical detail required, accepting that detailed disclosure could help attackers evade protections.
Confidential annual reports must identify the blocking methods and suppliers used, give totals for blocked indicators of compromise and customer complaints about erroneous or excessive blocking, and explain how the measures comply. The commission may make the metrics public or produce industry-wide summaries. It did not require a fixed set of annual public performance reports.
The June decision required reports within 30 calendar days of the reporting period's end. The Canadian Telecommunications Association's filing list records a September 11 application to extend that deadline. No disposition of that request was identified in the later-source checks for this report.
Privacy limits remain central to the disagreement
The majority found no need for additional privacy safeguards beyond existing protections, while expressly limiting deep packet inspection to exceptional circumstances such as a court order or fine-tuning a system after a cyber attack. Even then, inspection must be limited to packet headers and must not examine communications content.
The framework requires compliance with applicable privacy laws. It does not independently authorize extra collection, use or disclosure of personal information. The majority said the privacy principle could accommodate lawful, consent-based or otherwise authorized secondary uses.
Commissioner Bram Abramson agreed that cybersecurity blocking should expand, but dissented from the safeguards adopted. He warned that broader carrier discretion was being paired with less observable and less accountable decision-making.
Abramson noted that the consultation had attracted telecommunications providers and a law-enforcement agency but no dedicated public-interest advocate, user group or privacy intervener. He questioned whether customers would even recognize erroneous blocking well enough to complain.
He would have required reporting that connected blocking volumes to the traffic assessed, tracked changes to measures and suppliers, recorded corrections and classified complaint outcomes. He also favoured auditable complaint records, an escalation path and consistent public reporting of aggregate results.
On privacy, Abramson said techniques involving closer observation and inference created risks that simple blocklist matching did not. He criticized the absence of clearer, time-limited and reviewable rules for exceptional deep packet inspection.
He also objected that the new wording relaxed an earlier restriction on secondary uses of personal information, although the consultation had asked about adding safeguards, not narrowing them. That objection did not alter the majority's authorization, which took effect on June 18 subject to the revised conditions.
