Call Recording Laws in Canada: Consent, PIPEDA, Quebec

Is it legal to record a phone call in Canada?

Short answer: under the criminal law, yes, if you are a party to the call or have the consent of one party. For a business recording customers, that is only the first of two tests, and the second one is stricter.

Test 1: the Criminal Code. Section 184(1) makes it an offence to knowingly intercept a private communication "by means of any electro-magnetic, acoustic, mechanical or other device", punishable by up to five years' imprisonment on indictment ^[1]. Section 184(2)(a) says that offence does not apply to "a person who has the consent to intercept, express or implied, of the originator of the private communication or of the person intended by the originator thereof to receive it." Because the consent of either the caller or the person being called is enough, Canada is usually described as a one-party consent country.

Test 2: privacy law. A business that records customer calls collects personal information, so it must also follow the private-sector privacy law that applies to it: the federal Personal Information Protection and Electronic Documents Act (PIPEDA), or the provincial equivalent in Quebec, Alberta or British Columbia. The Office of the Privacy Commissioner of Canada (OPC) is direct about this: businesses subject to PIPEDA "must comply with the Act when recording calls – whether the customer or the organization initiates the call" ^[2].

So "one-party consent" answers whether recording is a crime. It does not answer whether a business may silently record its customers. Under privacy law, it generally may not.

This article is educational, reflects the law as of October 2026, and is not legal advice.

What counts as a "private communication"

The Criminal Code defines a private communication as an oral communication or telecommunication made by an originator in Canada, or intended to be received by a person in Canada, "under circumstances in which it is reasonable for the originator to expect that it will not be intercepted by any person other than the person intended by the originator to receive it" ^[3].

Two practical points follow:

• A call between a Canadian business and a caller in another country can be a private communication for Canadian purposes if either end is in Canada.
• Recording a call you are not part of (for example, a manager secretly recording two colleagues' call) is the scenario the offence targets, unless one of them consents.

Which privacy law applies to your business

The OPC summarizes the split ^[4]:

PIPEDA's own page lists the exemption orders for organizations in Alberta (SOR/2004-219), British Columbia (SOR/2004-220) and Quebec (SOR/2003-374) ^[5].

Is PIPEDA being replaced? Bill C-36, which would enact a Protecting Privacy and Consumer Data Act and amend PIPEDA, was introduced and given first reading in the House of Commons on June 15, 2026. As of October 2026, LEGISinfo shows it at second reading in the House, with second reading not yet started ^[6]. PIPEDA remains the law until a replacement is passed and in force.

The PIPEDA rules for recording customer calls

The OPC's guidance on recording customer telephone calls (updated 2026-10-08) sets out what a business must do. In plain terms:

1. Appropriate purpose. You may only record for purposes "a reasonable person would consider appropriate under the circumstances."
2. Notice. You must tell the customer the call is being recorded.
3. A clear, narrow purpose. State the purpose "as clearly and narrowly as possible" and include every purpose the recording may be used for. The OPC gives a specific warning: do not say you record "for security or quality assurance purposes" if the recording will be used for marketing, customer profiling or authentication.
4. Consent. Obtain consent. In most cases, a customer who carries on with the call after hearing that it is recorded and why has given implied consent.
5. Express consent for sensitive uses. If the recording involves biometric voiceprints (using a customer's voice to verify identity) or other sensitive personal information, express consent may be required.
6. A real choice. If recording is not integral to the service, customers must be offered alternatives, unless a PIPEDA exception to consent applies. The OPC's examples: continuing the call without recording, visiting a retail outlet, writing an email or letter, or completing the transaction online.
7. Access. Customers have a right to request access to the recording later.
8. Use limits, safeguards and retention. Use the recording only for the purposes stated, protect it, and do not keep it longer than needed. The OPC says the right retention period depends on the purpose, whether the recording was used to make a decision about the person, and any legal retention requirements.

The OPC also points out that recordings capture more than the words: voice and speech characteristics (including disabilities) and incidental personal details the caller volunteers. Treat the audio file as sensitive even when the call was routine.

Ways to get consent

The OPC suggests using more than one method so consent is meaningful ^[2]:

• telling the caller verbally;
• having the caller press a key in an automated message; and
• printing a notice on monthly statements next to the phone number.

Sample notice wording

These scripts are drafted to the OPC checklist above. Adjust the purpose to what you actually do.

Inbound, recorded for training and disputes only:

"Thanks for calling [Business name]. This call may be recorded so we can train staff and check details if there is a disagreement about an order. If you prefer not to be recorded, press 2 and we will take your call without recording, or you can email us at [address]."

Outbound call by staff:

"Hi, this is [Name] from [Business name]. Before we start, I'm recording this call so we have an accurate record of your service request. Is that all right? If not, I can turn the recording off."

Recording used for voice authentication (needs express consent):

"We can use a recording of your voice to confirm your identity on future calls. Press 1 to agree, or press 2 to continue with security questions instead."

Avoid the generic "This call may be monitored or recorded for quality assurance" if you also use the recordings for sales coaching on specific customers, marketing or analytics. That is the exact mismatch the OPC warns against.

Outbound calls: the policy is not enough

Businesses sometimes announce recording on incoming calls but not when their own staff call out. The OPC dealt with this in PIPEDA Case Summary #2007-384 (findings issued June 21, 2007). A telecommunications company recorded outgoing marketing calls and relied on a statement in its written privacy policy. The Commissioner found that insufficient and recommended informing customers "at the beginning of each outgoing marketing call, by either an automated message or by a customer service representative," that the call is recorded or monitored and why. The company agreed, and the complaint was found well-founded and resolved.

The lessons the OPC drew: customers' knowledge and consent are necessary; privacy policies should state the purposes; and quality assurance "does not take priority over individuals' privacy rights." The same summary notes very limited cases where consent is not required under PIPEDA, such as calls to collect a debt or investigate a potential fraud (paragraph 7(1)(b)).

Quebec: the same ideas, sharper teeth

Quebec's Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), heavily amended by the law often called Law 25, applies to personal information "whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other" ^[7]. The Commission d'accès à l'information (CAI) lists sound ("sonore") among the covered forms ^[8]. A call recording is covered.

Provisions that matter for recording:

• Purposes first. Determine the purposes before collecting (s. 4) and collect only what is necessary for them (s. 5).
• What to tell people. When collecting from the person, inform them of the purposes, the means of collection, their access and rectification rights, and their right to withdraw consent, in "clear and simple language" (s. 8). On request, also tell them how long the information is kept and who in the business has access.
• A named person in charge. The person with the highest authority in the business is responsible for compliance unless the function is delegated in writing, and that role's title and contact information must be published on the website (s. 3.1).
• Destroy when done. When the purposes are achieved, destroy or anonymize the information, subject to any retention period set by law (s. 23).
• Penalties. Administrative monetary penalties up to $10,000,000 or 2% of worldwide turnover for enterprises (s. 90.12), and penal fines from $15,000 to $25,000,000 or 4% of worldwide turnover (s. 91) (P-39.1).

For a Quebec business, a recording notice that names the purpose, says how long recordings are kept and how to ask for a copy, and is played in French (and English where you serve English callers) covers most of these points at once.

Employees and staff calls

PIPEDA applies to employee personal information only at federally regulated businesses ^[4]. For other employers, staff monitoring is governed by provincial law and employment law, which this article does not cover. Two safe practices regardless: tell staff in writing which calls are recorded and why, and do not record calls an employee is not part of without someone's consent (the Criminal Code test above).

Common mistakes and the fix

Checklist before you switch on recording

Decide

• Write down why you record (training, disputes, compliance) and whether each purpose really needs audio.
• Decide whether recording is integral to the service. If not, plan the alternative you will offer.
• Confirm which privacy law applies (table above).

Tell

• Add a recording notice at the start of inbound calls, before any personal information is given.
• Train staff to announce recording on outbound calls, every time.
• Update your privacy policy with the purposes, retention period and how to request a copy.
• Quebec: publish the title and contact information of the person in charge of personal information.

Control

• Restrict who can listen to and download recordings.
• Set a retention period and delete on schedule.
• Write down how you will answer an access request (search by date and number, deliver a copy).
• If you use recordings for voice authentication, collect express consent separately.
• If a vendor stores recordings, check where and how in your contract.

FAQ

Can I record a call without telling the other person? Under the Criminal Code, a party to the call can record it (s. 184(2)(a)). A business recording a customer must still meet privacy-law notice and consent rules, so in practice: tell them.

Do I need a beep? The sources reviewed here do not require a tone. They require that the customer be informed, and the OPC's 2007 case points to an automated message or a statement by the representative at the beginning of the call.

What about callers in the US? The Canadian Criminal Code covers communications where either end is in Canada (s. 183). US rules differ by state and are not covered here; see our call recording checklist for small businesses for the cross-border view. An announcement at the start of every call is the simplest way to satisfy both sides.

Is a voicemail a call recording? A voicemail is a recording the caller chooses to leave, but it is still personal information. Apply the same discipline: limit who hears it, and set a retention period. Our voicemail-to-email checklist covers handling.

Can a customer ask for a copy of a recording? Yes. The OPC says customers have a right to request access to the recording later, and Quebec's P-39.1 gives access rights too (s. 8).

Does "quality assurance" cover everything? No. If you use recordings for marketing, profiling or authentication, say so; the OPC specifically warns against a quality-assurance label that hides other uses.

For Canada-specific points about running a business line, see our Canada page and the Canadian section of our privacy notice.

Auto Attendant does not record calls; it only takes voicemails that callers choose to leave.

Sources

1. Criminal Code, R.S.C. 1985, c. C-46, s. 184 (Interception) - Justice Laws Website; offence and one-party consent saving provision s. 184(2)(a); accessed 2026-10-28.
2. Criminal Code, s. 183 (Definitions) - Justice Laws Website; definition of private communication; accessed 2026-10-28.
3. Recording of Customer Telephone Calls - Office of the Privacy Commissioner of Canada, modified 2026-10-08; PIPEDA notice, purpose, consent, alternatives, access, voiceprints; accessed 2026-10-28.
4. PIPEDA in brief - Office of the Privacy Commissioner of Canada; who PIPEDA applies to, substantially similar provincial laws, federally regulated employers; accessed 2026-10-28.
5. PIPEDA Case Summary #2007-384 - Office of the Privacy Commissioner of Canada; consent to recording of outgoing marketing calls; accessed 2026-10-28.
6. Personal Information Protection and Electronic Documents Act - Justice Laws Website; exemption orders for Alberta, B.C. and Quebec; accessed 2026-10-28.
7. Bill C-36 (45th Parliament, 1st session) - LEGISinfo, Parliament of Canada; introduction June 15, 2026 and current stage; accessed 2026-10-28.
8. Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 - LégisQuébec; ss. 1, 3.1, 4, 5, 8, 23, 90.12, 91; accessed 2026-10-28.
9. Champ d'application de la Loi (entreprises privées) - Commission d'accès à l'information du Québec; covered forms include sound; accessed 2026-10-28.