Two Legal Layers and Scripts for Call Recording Consent in Canada

Recording a phone call in Canada is legal under the Criminal Code as long as one person on the call, including you, consents to it. That is the federal criminal-law baseline, and it applies whether you are a private citizen or a business. Businesses face a second, stricter layer: PIPEDA requires meaningful consent before you record customers, which usually means telling them at the start of the call. When you are unsure which standard applies, default to explicit notice and give callers a real way to opt out.

---

TL;DR:

• Recording a call you participate in is legal in Canada under the Criminal Code, but intercepting conversations without consent is criminally punishable.
• Businesses must provide clear, near-start notice of recording, explicitly state its purpose, and offer easy options to decline or stop recording to meet privacy laws.
• Quebec’s stricter privacy laws require informed, free, and explicit consent and may demand data residency and impact assessments for cross-border call data processing.
• Call recordings used as evidence need verification of authenticity, proper handling, and must avoid privilege or hearsay issues to be admissible in court.
• Automated and AI-driven recordings should include strict consent protocols, regular review of scripts, and contractual safeguards to ensure ongoing compliance and data security.

---

Table of Contents

• What Does Call Recording Consent Mean Under Canadian Law?
• How Does PIPEDA Apply to Business Call Recordings?
• Do Provincial Privacy Laws Add Stricter Rules Than PIPEDA?
• Can a Recorded Call Be Used as Evidence in Court?
• Practical Compliance Steps and Scripts for Businesses
• Common Myths About Call Recording Consent in Canada
• Balancing Automation and Privacy in Call Recording
• Making Compliant Call Recording Easier to Manage
• Sources
• FAQ

What Does Call Recording Consent Mean Under Canadian Law?

Canada runs on a one-party consent model at the criminal level. Under section 184 of the Criminal Code, intercepting a private communication is a criminal offense unless the person doing the intercepting has the consent of at least one party to that conversation. If you are on the call and you hit record, you are that consenting party. No one else on the line needs to agree, at least not for the recording to clear the criminal-law bar.

This is where a lot of people trip up. One-party consent means a participant can record. It does not mean a stranger can tap someone else’s line, plant a device in a room, or intercept a conversation they are not part of, even with one person’s blessing after the fact. Section 184.2 actually carves out narrower rules for law enforcement, requiring judicial authorization for wiretaps in most circumstances, and section 184.1 covers emergency interceptions to prevent bodily harm. Those provisions exist precisely because eavesdropping on a conversation you are not part of is treated far more seriously than recording your own call.

The Criminal Code does not stop at interception. Section 193 makes it an offense to use or disclose a private communication that was intercepted unlawfully, or even one that was lawfully intercepted but is then disclosed for an improper purpose. In plain terms:

• Recording your own call as a participant is legal under s.184(2)(a).
• Intercepting a call you are not part of, without any participant’s consent, is a criminal offense.
• Disclosing or using a recording obtained illegally carries separate criminal liability under s.193.
• Law enforcement interception outside a warrant generally requires the emergency exception in s.184.1 or judicial authorization under s.184.2.

Violating these provisions is not a civil slap on the wrist. It falls under the Criminal Code, meaning penalties can include imprisonment, not just fines. That single fact is why “is call recording legal in Canada” gets asked so often, and why the honest answer needs a caveat attached almost every time. The Criminal Code answers the “can I legally press record” question. It says almost nothing about what a business is allowed to do with that recording afterward, and that is where a second body of law takes over.

How Does PIPEDA Apply to Business Call Recordings?

Passing the Criminal Code test does not mean a business has satisfied its privacy obligations. The Personal Information Protection and Electronic Documents Act governs how private-sector organizations collect, use, and disclose personal information, and a recorded phone call is personal information the moment a caller’s voice and details are on it. The Office of the Privacy Commissioner is direct about the relationship between the two laws: legal permission to record under the Criminal Code and lawful collection under PIPEDA are separate questions, and a business can clear the first while failing the second.

PIPEDA’s consent principle scales with sensitivity. Routine appointment confirmations warrant a lighter touch than a call touching health details or financial account numbers, where express consent is the safer standard. In every case, the caller needs to know three things: that the call is being recorded, why, and that they have some ability to object.

The Office of the Privacy Commissioner has spelled out exactly what compliant notice looks like for customer telephone calls. It comes down to a short list of obligations:

• Tell the caller the call is being recorded near the start of the interaction, not buried in fine print.
• State the purpose plainly, whether that is quality assurance, order processing, or dispute resolution.
• Offer a practical way to decline or ask for the recording to stop.
• Limit retention to what the stated purpose actually requires.
• Use the recording only for the purpose disclosed, not a different one discovered later.

What compliant notice sounds like: “This call may be recorded for quality and training purposes. If you’d prefer not to be recorded, let me know and I’ll turn it off.” That single sentence, delivered before substantive conversation starts, is close to what OPC guidance treats as the floor for meaningful consent on inbound business calls.

The Commissioner’s guidance also draws a sharp distinction businesses often miss: implied consent, meaning the caller stays on the line after hearing a recorded notice, might be acceptable for low-sensitivity purposes like general inquiries. It is a thinner basis for consent than an explicit “yes,” and organizations that rely on it should document why they judged the interaction low-risk enough to use it.

Do Provincial Privacy Laws Add Stricter Rules Than PIPEDA?

Quebec does, and it is not close. The Act respecting the protection of personal information in the private sector requires clear, free, and informed consent for collecting personal information, and it goes further than PIPEDA on cross-border data handling. If a Quebec business (or a business serving Quebec residents) stores or processes call recordings outside the province, including in a cloud transcription service hosted elsewhere, it may need to complete a privacy impact assessment before that transfer happens.

That is a meaningfully higher bar than the federal standard, and it signals where Canadian privacy law is heading generally. Quebec’s approach looks less like an outlier every year and more like the direction other provinces are drifting.

A few other things to keep in mind if you operate across provincial lines:

• Alberta and British Columbia have their own private-sector privacy statutes that can apply instead of PIPEDA for organizations operating solely within those provinces.
• Healthcare and financial services carry sector-specific rules on top of general privacy law, often demanding tighter retention limits and access controls for recordings that touch medical or financial details.
• Quebec’s consent and data-residency requirements apply based on who the caller is, not just where your head office sits, so a national contact center handling Quebec residents needs Quebec-compliant scripts even if it is headquartered in Ontario.

The practical takeaway for any business with customers in more than one province is to build your recording and retention policy around Quebec’s requirements, then apply that same standard everywhere. It costs little to be consistent, and it removes the guesswork of tracking which caller falls under which regime. The team at Service HLP covers Quebec-specific consent nuances in more depth if your call volume in the province is significant enough to warrant a closer look.

Can a Recorded Call Be Used as Evidence in Court?

Often, yes. A recording made with one participant’s consent, meaning you recorded your own conversation, is generally admissible in Canadian courts and does not run afoul of the Criminal Code’s interception rules. Admissibility, though, is not automatic. Courts still look at whether the recording is authentic, unaltered, and properly attributed to the people speaking on it.

Three things typically determine whether a recording holds up:

1. Authenticity. The party introducing the recording needs to establish it is a true and accurate copy of the original conversation, generally through testimony about how it was made and stored.
2. Chain of custody. A recording that passed through unclear hands, with no record of who accessed or edited it, invites challenges to its reliability. Clean, documented handling from creation to courtroom strengthens its evidentiary weight.
3. Privilege and exclusions. Solicitor-client communications, settlement discussions, and certain confidential conversations can be excluded even when the recording itself was legally made. One-party consent gets a recording past the Criminal Code; it does not override privilege rules.

Hearsay is another wrinkle. A recording of someone else’s out-of-court statement, offered to prove the truth of what was said, can face hearsay objections depending on how it is used and what exception might apply.

For businesses, preservation practices matter as much as the initial recording decision. Keep original files with accurate timestamps, retain metadata rather than stripping it out, and store recordings in access-controlled systems rather than shared drives anyone can edit. If a transcript is produced, keep the audio alongside it. A transcript without the source recording is easy to dispute; the two together are much harder to challenge.

Practical Compliance Steps and Scripts for Businesses

Getting call recording consent right in practice comes down to scripting, logging, and vendor discipline. None of it is complicated, but skipping any one piece is usually what leads to an OPC complaint.

Start with the notice itself. Here are two scripts that satisfy the “inform at the start of the call” standard the Office of the Privacy Commissioner has laid out:

1. Inbound IVR script: “Thanks for calling [Business Name]. This call may be recorded for quality and training purposes. Press 1 if you’d prefer we don’t record this call, or stay on the line to continue.” A keypress gives you a documented, timestamped consent signal rather than a vague assumption.
2. Outbound agent script: “Hi, this is [Agent Name] calling from [Business Name]. Before we continue, I want to let you know this call is being recorded for [specific purpose]. Is that okay with you?” This matters more for outbound calls specifically because the OPC’s 2007 case findings found that a written privacy policy alone does not satisfy consent obligations when a business initiates the call.

Once notice is given, log it properly. A defensible consent record includes the timestamp, the agent or system ID, the method of consent (verbal confirmation or IVR keypress), and a copy of the resulting transcript. Tie your retention period to the stated purpose. If the purpose is quality assurance for a 90-day training cycle, keeping recordings for three years undercuts your own stated justification and creates unnecessary exposure if you are ever audited.

If you use a third-party transcription or AI answering vendor, run through this checklist before signing anything:

• Confirm where data is stored and processed, especially if any Quebec callers are involved, since cross-border storage can trigger privacy impact assessment requirements.
• Get contractual guarantees on data handling, deletion timelines, and breach notification obligations.
• Verify who at the vendor has access to raw audio and transcripts, and whether that access is logged.
• Ask what happens to call data if you terminate the contract. Deletion should be contractual, not a courtesy.

Pro Tip: Treat your consent script the same way you treat your privacy policy: review it annually. Purposes drift over time, and a script written for “quality assurance” two years ago might no longer describe how you actually use recordings today.

If you are the one who got recorded without a heads-up, you have options. You can ask the business to stop recording immediately and to delete the existing recording. If they refuse or you suspect they never had proper consent in the first place, you can file a complaint with the Office of the Privacy Commissioner, which investigates complaints against federally regulated businesses and companies handling personal information commercially. For situations involving potential criminal interception, meaning nobody on the call consented, a conversation with a lawyer is worth having before you do anything else.

Common Myths About Call Recording Consent in Canada

A few misconceptions come up often enough that they deserve direct correction.

• “One-party consent means my business doesn’t need to worry about privacy law.” Wrong. Criminal Code permissibility and PIPEDA compliance are two separate legal tests, and passing one says nothing about the other.
• “A privacy policy on my website covers outgoing calls.” The OPC’s 2007 case findings rejected this directly. Notice has to happen at the time of the call, not just somewhere on your site.
• “Quality assurance justifies any future use of the recording.” Purpose creep, using a recording collected for training later for marketing or profiling, is exactly what OPC guidance warns against.
• “Retention doesn’t matter as long as I had consent to record.” Consent covers the collection. Purpose limitation governs how long you can justify keeping the file.

Balancing Automation and Privacy in Call Recording

Automated answering and transcription tools make it easier than ever to record every call by default, and that convenience is exactly why I think businesses should build consent-by-default into sensitive workflows rather than treat it as an afterthought bolted on later. If a call touches health, financial, or legal information, express oral consent should be the standard, not implied consent through silence.

Run a privacy impact assessment before deploying any automated system that stores recordings, and repeat that review annually as your call volume and vendor stack change. Cross-border transcription is the quiet risk most businesses overlook: audio processed by a server outside Canada can trigger Quebec’s stricter localization concerns even when your own operations are entirely federal. Build contractual safeguards into every vendor agreement before that becomes someone else’s problem to solve.

— Sam

Making Compliant Call Recording Easier to Manage

Getting the consent notice right is only half the job. The other half is making sure every recorded call is transcribed accurately, stored securely, and handed off cleanly when a human agent needs the context. An effective call answering service should answer every inbound call promptly, provide a consistent recording notice as part of the call flow, and produce real-time transcripts for team review without requiring digging through raw audio files.

If you are evaluating any voice AI vendor for call handling, not just Callspace, ask the same three questions every time: where is the audio and transcript data stored, does the system default to explicit consent for sensitive call types, and what security controls protect that data once it is collected. Callspace’s approach to security and data handling for regulated industries is built around those exact questions, particularly for healthcare and insurance clients who cannot afford a vague answer. Plans start with the Basic tier at $150 per month, and you can see how the platform handles industry-specific compliance needs on the industries page before you commit to anything.

Sources

• Criminal Code (R.S.C., 1985, c. C-46) — section 184
• Act respecting the protection of personal information in the private sector (Quebec)

FAQ

Can Someone Record a Call Without My Permission?

Yes, if they are a participant in the call. Under Criminal Code section 184, only one party needs to consent, so the other person on the line does not need to agree or even know for the recording to be legal under criminal law.

Can I Sue Someone for Recording Me Without Permission in Canada?

If the recording was made by someone who was not a participant in the call and had no one’s consent, that crosses into criminal interception territory under the Criminal Code, and you should speak with a lawyer about your options. If a business recorded you without meeting PIPEDA’s meaningful consent requirements, you can file a complaint with the Office of the Privacy Commissioner rather than going straight to a lawsuit.

Do Businesses Legally Have to Tell Me a Call Is Being Recorded?

Under PIPEDA, yes. Businesses need to inform you at or near the start of the call that it is being recorded and why, and the OPC’s 2007 case findings confirmed a website privacy policy alone does not satisfy that requirement for outgoing calls.

Can I Tell Someone Not to Record Me?

You can ask, and a business subject to PIPEDA generally has to offer that option as part of meaningful consent. A private individual recording their own conversation under one-party consent is not legally required to honor your objection, though many will out of courtesy.

What Does Callspace Do to Support Compliant Call Recording?

Callspace answers calls, plays a consistent recording notice, and produces real-time transcripts so businesses have a documented, timestamped consent trail for every interaction. Pricing starts with the Basic plan at $150 per month, with details on industry-specific compliance features available on the industries page.

Recommended

• Voice AI for Insurance