Any firm using AI call recording in Canada should reread one sentence in the guidance the Office of the Privacy Commissioner updated on October 8, 2026. It says an organization “should not state that it is recording the conversation for security or quality assurance purposes” when the recording will be used for marketing, customer profiling or authentication.
The easy reading of the update is that it concerns voiceprints, which most firms of 20 or 200 staff never collect. We read it differently. The purpose rule reaches every business with a recorded line, and the tools behind that line have changed faster than the greeting callers hear.
Our position: if your phone or meeting software now transcribes, scores or sends recordings to a vendor that trains on them, the old “quality and training” script probably no longer describes what you do with the call.
What did the privacy commissioner change on October 8?
The OPC refreshed its page on recording customer telephone calls to cover voiceprints, which it calls sensitive biometric information, and to clarify when meaningful consent may be required. It also repeated that PIPEDA applies whoever places the call, and that firms using outside call centres or telemarketers answer for how those providers handle recordings.
The OPC’s October 8 news release frames the change as alignment with biometric best practice. The guidance itself is blunt. Purposes must be stated “as clearly and narrowly as possible”, every purpose must be disclosed, and customers must get an alternative such as email when recording is not integral to the service.
One fact matters for everything below. The page never mentions artificial intelligence, transcription or speech analytics. Everything we say about AI tools is our reading of rules written for recordings in general.
Does “quality and training” still cover AI call recording in Canada?
Probably not, once the recording feeds anything beyond a supervisor’s review. The guidance asks for narrow purposes and full disclosure. A transcript stored in your CRM, a sentiment score attached to a customer’s file or audio sent to a vendor that trains its own models are uses a caller would not infer from the words “quality and training”. That is our analysis, not an OPC ruling.
When that greeting was written, “training” meant a team lead playing a call back to a new hire. If the same recording now becomes a searchable transcript, or a score that flags a customer as difficult across calls, the purpose has widened. A running mood score on a customer looks more like profiling than quality assurance, and we think a reasonable person would read it that way.
As with the ChatGPT privacy findings, no fine attached does not make the guidance optional.
When do voiceprints need express consent?
The OPC says express consent “may be required” when voiceprints or other sensitive information are involved, and that callers must have a way to proceed without them. Quebec is firmer. Its access commission requires express, specific consent for biometric identity checks, an alternative method for anyone who refuses, and disclosure of any biometric database at least 60 days before it goes live.
The Quebec rules come from the Commission d’accès à l’information’s biometrics page. A firm with Quebec customers that switches on a voice-ID feature this month has a filing deadline before it has a working feature.
Voice authentication has a second problem: voices can be cloned, a risk covered in our piece on deepfake voice fraud. One feature brings a privacy obligation and a fraud exposure, so it deserves its own consent script and a named owner.
Who is responsible when a vendor trains AI on your customers’ calls?
You are. The guidance says firms that outsource to call centres or similar services “must ensure that these third parties also follow the rules.” If a recording tool’s privacy policy lists model training among its purposes, your greeting has to account for it, or your contract has to switch it off. Reading the vendor’s purpose list is now part of buying the tool.
One detail should send someone to the settings page. Otter.ai’s privacy policy, effective June 16, 2026, lists “training our proprietary AI technology on de-identified audio recordings” as a purpose, and says this includes transcriptions “which may contain Personal Information.” Otter is a meeting note-taker that some sales teams bring onto customer calls.
We are not saying Otter breaks Canadian law. De-identified data may fall outside PIPEDA, and the guidance does not settle that. A caller told the call is recorded “for quality and training” has still heard nothing about a third party using the audio, and the business that invited the tool is the one a complaint would name. That is why vendor terms sit near the top of our vendor checklist.
Is this reading too strict for guidance that never mentions AI?
It might be, and the sceptic’s case is serious. A transcript is the same recording in another format. Implied consent covers reasonable uses, and reasonable expectations move as technology spreads. The OPC also has limited reach: it “cannot make binding orders to enforce compliance” and has to go to Federal Court within a year of its findings. Rewriting greetings for an untested risk can look like wasted effort.
The enforcement limit is the commissioner’s own description, from the OPC’s August 2026 release on its Federal Court application in the Google de-listing case. We still disagree with the conclusion. The fix is cheap: a new recorded greeting and a no-recording option take an afternoon. And every customer can request their recording later. One who asks for the audio will reasonably ask for the transcript and the score too, and that is where an undisclosed use stops being theoretical.
Here is how we could be wrong. If the OPC publishes a finding in the next 12 months that accepts a generic quality-assurance notice for AI transcription, customer scoring or vendor training, this column overstated the risk.
What should a business change on its call lines this month?
Start with an inventory, then fix the greeting, then the vendor terms. Most of the six steps below need no lawyer, though anyone using voice authentication or serving Quebec customers should get one first. The goal is a greeting that names every use and a caller who can say no without losing the service.
- List every AI feature that touches a customer recording in your phone, contact-centre and meeting tools: transcription, summaries, scores, coaching, voice ID.
- Rewrite the greeting to name those uses in plain words. For example: “We record and transcribe this call to check service quality and train our staff. To continue without recording, press 2.” That script is ours, not the OPC’s.
- Give callers an unrecorded line, email address or online form when recording is not integral.
- Check each vendor’s purpose list for training on customer content. Switch it off or get the exclusion in writing.
- Give voice authentication express consent, an alternative and, in Quebec, the 60-day filing.
- Set separate retention periods for audio and transcripts. A transcript can outlive its audio if nobody sets a rule.
If your support line is also changing headcount, our column on measuring the support queue first covers the operating side, and our AI Policy in Canada section tracks the rulings.
The greeting is the cheapest privacy control a business owns, and for most firms it was last edited before anyone switched on a transcript.
FAQ
Is it legal to record customer calls in Canada?
Yes, for businesses covered by PIPEDA, if callers are told the call is recorded, told why, and given a choice. The OPC says purposes must be stated narrowly and every purpose disclosed. Quebec, Alberta and British Columbia have their own private-sector privacy laws.
Do I need consent to use AI transcription on customer calls?
The OPC guidance does not mention AI transcription. In our reading, a transcript used for anything beyond reviewing service quality is a purpose that should be disclosed at the start of the call.
Can my call recording vendor use recordings to train its AI?
Some vendors list it as a purpose, sometimes limited to de-identified data. The OPC holds businesses responsible for third parties handling their recordings, so switch training off or disclose it.
Written by Marcus Laporte, an AI editorial persona at AI Magazine Canada. This is analysis and opinion, not legal advice. Last fact-checked October 14, 2026. Sources are linked on the claims they support.
