Here is a scene that plays out a few weeks after a Canadian business moves its phones over to an AI voice agent. The agent is answering every call, booking jobs, taking messages at 2 a.m. — and then someone on the team asks the obvious question: "Can we keep recordings of these calls?" Maybe for training. Maybe to settle a "that is not what I was quoted" argument six months from now. Maybe just because the old phone system did it and nobody questioned it.
It feels like a settings toggle. It is not. Recording calls in Canada sits on top of two different sets of rules that most vendors — especially the big US platforms — barely mention. Get it right and your recordings are a genuinely useful asset. Get it wrong and you have quietly built a privacy liability that runs on autopilot, one call at a time, while you sleep. So let us walk through what the law actually asks for, and exactly how to set your agent up so it stays on the right side of it.
The short version: yes, you can record — with a notice
Start with the part that scares people most, because it turns out to be the simplest. Canada is a "one-party consent" country when it comes to the act of recording a conversation. Under section 184 of the Criminal Code, it is generally not an offence to record a conversation as long as one person taking part in it consents — and when a call comes into your business, your business is a party to that call. The recording itself is not a wiretapping crime.
That is where a lot of articles stop. For a business, it is only half the story. The moment you record a customer, you are also collecting personal information — their voice, their name, their address, their account details, whatever they happen to say. And collecting personal information is governed by privacy law: PIPEDA across most of Canada, plus provincial laws in Quebec, British Columbia and Alberta. One-party consent keeps you out of criminal court. Privacy law is the thing you actually have to design your agent around.
Two rules sharing one phone call
It helps to hold these two ideas apart. The Criminal Code question is "am I allowed to press record?" — and the answer, as a party to the call, is basically yes. The privacy question is "what do I owe the person on the other end when I do?" — and the answer is a short list of obligations that do not go away just because a machine is handling the call instead of a human receptionist. In fact the machine makes them easier to get right, because it says the exact same thing on every single call and never forgets. We dug into the broader data side of this in our guide to what PIPEDA asks of Canadian businesses using voice AI; recording is one specific slice of that bigger picture.
What PIPEDA actually asks of you
The federal Privacy Commissioner publishes a plain-language fact sheet called Recording of Customer Telephone Calls, and it is the clearest map you will find. Three things have to happen before you record: you inform the customer the call is being recorded, you state the purpose clearly, and you obtain their consent. That is the whole spine of it. Notice, purpose, consent.
Purpose carries more weight than people expect. The Commissioner says you can only record for purposes that a "reasonable person would consider appropriate," and you have to state them "as clearly and narrowly as possible." In practice that means "this call may be recorded for quality and training" is fine — as long as quality and training is genuinely what you use it for. Quietly reusing those same recordings to build marketing profiles, or to voice-authenticate the caller later, is a different purpose, and you would have needed to say so up front. A business in Halifax recording for dispute resolution and a clinic in Calgary recording for staff coaching are collecting for different reasons, and each should name its own.
A phone on a desk recording a call, shown by a soundwave and a red recording dot
Implied consent versus express consent
Here is the part that keeps your call flow smooth: in most cases, consent is implied. If the caller hears that the call is recorded and why, and then keeps talking, that counts. You do not need them to recite a formula or press a button. The important exception is sensitive information — and for voice AI, the big one is biometrics. If your system builds a voiceprint to recognize or authenticate callers, that is sensitive data, and the Commissioner indicates you likely need express consent for it. We will come back to voiceprints, because they are the one spot where it is worth genuinely slowing down.
What your agent should actually say
This is where an AI voice agent has a real edge over a human front desk, and over a clunky "your call may be recorded" robot message bolted onto an old PBX. The notice can be the agent speaking naturally, in the first breath of the call, before a single detail is collected. Something like: "Hi, thanks for calling Northside Plumbing — just so you know, this call is recorded for quality and training. How can I help you today?"
Short, upfront, in plain language, and — this is the part people forget — before the caller starts handing over personal details. If the notice lands after someone has already read out their credit card number, it has done nothing. The agent should also be ready for the caller who says "actually, I would rather not be recorded." That is a real path, not an edge case, and your flow needs an answer for it.
One thing worth keeping separate: whether your agent says the call is recorded is a different question from whether it tells callers it is an AI in the first place. That disclosure question has its own nuances, and we covered it in our piece on whether your AI voice agent should tell callers it is not human. Two separate notices, two separate decisions — do not let one stand in for the other.
Setting it up right: a six-step checklist
None of this is hard once you treat it as a setup task instead of an afterthought. Here is the order that keeps you clean:
- Decide whether you actually need to record at all. "A reasonable person would consider it appropriate" is easier to defend when you have a concrete reason — dispute resolution, training, accuracy on complex orders. "Because we can" is not a purpose.
- Put the notice at the very top of the call script. First few seconds, before any information is collected. This is a one-line change in your agent's greeting, and it is the single most important one.
- State the purpose narrowly and truthfully. Name what you use recordings for, and nothing you do not. If the purpose later changes, the script changes with it.
- Capture consent and log it. Implied consent (the caller continues) is fine for ordinary calls, but have your platform timestamp that the notice was played. If you ever need to show you gave notice, that log is your proof.
- Build the opt-out path. If someone does not want to be recorded, the agent should be able to continue without recording, or hand the call to a human. The Commissioner notes that when recording is not integral to the service, you should offer an alternative.
- Set retention and access rules before you go live. Decide how long recordings are kept and who can pull one, because a customer has the right to ask for theirs later.
A compliance checklist flat-lay with a microphone and a check mark
Quebec plays by a stricter set of rules
If any of your callers are in Quebec, add a layer. The province's Law 25 is tougher than the federal baseline on purpose limitation, consent and how long you can hold personal information, and it is enforced by its own regulator. On top of that, a notice to a Quebec caller needs to reach them in French first. The practical takeaway for a business operating across several provinces is simple: build your agent to the Quebec standard and you are comfortably above the bar everywhere else. We break down the Quebec-specific requirements in our French-language guide; if a meaningful share of your calls come from Montreal, Quebec City, Laval or Gatineau, start there.
Voiceprints: the one place to stop and think
Most small businesses recording ordinary calls never touch this. But if a vendor is pitching "voice authentication" or a feature that recognizes returning callers by the sound of their voice, pay attention. A voiceprint is biometric data — it is treated as sensitive, and that generally raises the bar from implied to express consent. It also means a data breach is a bigger deal, because a person cannot change their voice the way they can change a password. None of this makes voiceprints off-limits; it just means they are not a feature to switch on casually. If you do not have a clear reason to identify callers biometrically, leave it off.
How long to keep recordings — and the request you will eventually get
There is no magic number of days in the law. The Commissioner says retention "will vary" depending on why you collected the recording, whether it was used to make a decision about the person, and any legal requirements to keep it. The honest default for most small businesses: keep recordings only as long as the stated purpose needs, then delete them on a schedule. A dispute-resolution recording does not need to live on a server for three years.
And plan for this one, because it will happen eventually: a customer has the right to request access to a recording of their own call. If you keep recordings, you need a way to find a specific one and hand it over. A good AI voice agent platform makes this searchable instead of a frantic dig through audio files. Think of it less as a compliance chore and more as basic hygiene — if you cannot retrieve a recording when asked, you probably should not be keeping it.
The bottom line
Recording calls through an AI voice agent in Canada is allowed, useful, and completely manageable — as long as you treat the notice as part of the greeting rather than a legal footnote. Tell callers at the top, keep your purpose narrow and honest, give people a way out, hold recordings only as long as you need them, and be ready to hand one over on request. Do that and your recordings earn their keep instead of becoming a quiet risk.
This article is general information for Canadian businesses, not legal advice. Privacy rules differ by province and your situation may have wrinkles of its own — when in doubt, run your setup past a lawyer or privacy professional before you flip the switch.