Can Your AI Receptionist Legally Answer and Record Calls in Canada? The 2026 Rules

Yes, with conditions most vendors never mention. The Criminal Code lets a business record a call it is party to, because section 184(2)(a) exempts interception with the consent of the originator or intended recipient. Privacy law is a separate test: PIPEDA requires you to tell the caller, state the purpose narrowly, and offer an alternative. An AI phone receptionist in Canada is legal. Deploying one on a default configuration usually is not compliant.

Written by Cody Wise, founder of Wise Media, a Calgary based web design, SEO and automation agency. This article summarises published statutes and regulator guidance as those sources state them. It is not legal advice and does not assess any specific deployment. Privacy and telecommunications obligations vary by province and by whether your business is federally regulated. Verify your position with counsel before you put an AI agent on a live line.

Summary

• “One party consent” answers the wrong question. It is the criminal law answer. It tells you the recording is not an illegal interception. It says nothing about your privacy obligations.
• PIPEDA requires disclosure, narrow purpose, and an alternative. The Office of the Privacy Commissioner’s guidance states that customers must be given a choice about whether their voice is recorded, and that alternatives must be provided where the recording is not integral to the service.
• Voiceprints change the analysis. The OPC says express consent may be required where recording involves biometric voiceprints or other sensitive personal information.
• In Quebec, a voiceprint database has a filing deadline. Under the Act to establish a legal framework for information technology, a biometric database must be disclosed to the Commission d’accès à l’information no later than 60 days before it is put into use.
• Outbound AI calling is a different regime entirely. The CRTC requires express consent for automated dialing announcing device telemarketing, and it specifically refused to exempt calls made under an existing business relationship.
• You own what the agent says. A price, a promise or a policy stated by your AI on your line is your representation.

Table of Contents

• Is it legal to use an AI receptionist in Canada?
• What PIPEDA requires once your AI answers the phone
• Three rules that are not on the vendor’s pricing page
• Who is liable for what the AI says?
• The compliant setup, step by step
• Build, buy, or keep the human
• Common mistakes
• FAQ

Is it legal to use an AI receptionist in Canada?

Yes. No Canadian statute prohibits an automated system from answering a business telephone line. What the law regulates is three narrower things: whether the call may be intercepted or recorded, what you must tell the caller about the personal information you collect, and, for outbound calls, whether you had consent to place the call at all. An AI receptionist usually touches all three at once, which is why it feels more complicated than it is.

What the Criminal Code actually says

Section 184(1) makes it an offence to knowingly intercept a private communication “by means of any electro-magnetic, acoustic, mechanical or other device.” Section 184(2)(a) then exempts “a person who has the consent to intercept, express or implied, of the originator of the private communication” or of the person intended by the originator to receive it. That is the whole basis of the phrase people repeat as “Canada is a one party consent country.”

It is accurate as far as it goes. If your business is a party to the call, you have the consent of a party, so recording it is not an illegal interception under section 184. The error is treating that as the end of the analysis. Section 184 is a criminal prohibition on eavesdropping on other people’s conversations. It was never a privacy compliance framework, and it does not authorise you to collect, use or keep the recording for whatever purpose you like.

Why one party consent is not the end of it

A recorded call contains personal information. The moment your organisation collects personal information in the course of commercial activity, federal privacy law applies, or substantially similar provincial legislation does in Alberta, British Columbia and Quebec. That regime has its own consent rules, and they are not satisfied by the fact that you were on the call.

Read down that table and the pattern is clear. Every row after the first is a privacy or telecom obligation, and none of them are addressed by the one party consent rule that vendors put on their compliance page.

What PIPEDA requires once your AI answers the phone

The Office of the Privacy Commissioner of Canada publishes guidance specifically on recording customer telephone calls, and it applies whether the customer started the call or you did. For organisations outside PIPEDA’s reach the OPC describes the same list as best practices. Six requirements come out of it.

1. A reasonable purpose. The OPC states that an organisation “can only record a call for purposes that a reasonable person would consider” appropriate.
2. Disclosure. “The organization must inform the customer that they are recording a call.”
3. A narrow stated purpose. The purpose “should be stated to the customer as clearly and narrowly as possible.” The guidance also says an organisation should not claim it is recording for security or quality assurance if the recording will be used for marketing, customer profiling or authentication.
4. An alternative. “Customers must be given a choice about whether their voice is recorded during the call.” Where recording is not integral to the product or service, the organisation “must provide customers with alternatives,” unless a PIPEDA consent exception applies. The OPC’s examples include continuing without recording, visiting a retail outlet, writing an email or letter, or completing the transaction online.
5. Purpose limitation. “An organization may only use the information collected for the purposes specified.”
6. Access and retention. Customers have a right to request access to the recording later, retention length depends on the purpose and any legal obligation to keep it, and appropriate safeguards are required.

Requirement four is the one that breaks most AI receptionist deployments, and it is worth sitting with. If the recording is the mechanism by which the AI works, you can argue it is integral. If you are also transcribing, summarising, scoring the call, enriching a CRM record and feeding a model, those are additional purposes, and they are not integral to answering the phone. A caller who says “I would rather not be recorded” needs somewhere to go.

The disclosure line, written properly

Most deployments ship with some variant of “this call may be recorded for quality and training purposes.” That sentence is doing three things wrong at once. “May be” is not disclosure if it is always recorded. “Quality and training purposes” is the broad framing the OPC’s guidance warns against. And it says nothing about the caller talking to a machine.

A defensible version names the automation, names the actual purposes, and offers the exit, in roughly fifteen seconds:

“Hi, you have reached [business]. You are speaking with an automated assistant. This call is recorded and transcribed so we can book your appointment and keep a record of what you asked for. If you would rather not be recorded, say “agent” and I will take a message for a person to call you back, or you can book online at [address].”

Say the automation part. Nothing in privacy law requires you to disclose that the voice is synthetic, but the reputational and consumer protection exposure of a caller discovering it mid conversation is real, and callers who know they are talking to a machine behave more usefully: they speak in short factual phrases, which is also what makes the transcript accurate.

If you operate in Alberta, British Columbia or Quebec

Those three provinces have private sector privacy legislation declared substantially similar to PIPEDA, so for most commercial activity inside the province their statute governs rather than PIPEDA. The practical consequences for an AI receptionist are small in Alberta and British Columbia, where the consent, purpose and access concepts track closely. They are not small in Quebec, where Law 25 added obligations that have no clean federal equivalent, and where the biometric rule discussed below carries a hard deadline. If you have locations in more than one province, build to the strictest requirement and deploy one configuration. Running different disclosure scripts per province is how a call centre ends up out of compliance in the one place nobody checked.

Three rules that are not on the vendor’s pricing page

1. A voiceprint is biometric data, and it raises the consent bar

Several AI phone platforms offer caller recognition: the system identifies a returning customer by voice and pulls up their file. It is a genuinely useful feature and it changes your legal position. The OPC’s guidance states that where recording involves biometric voiceprints or other sensitive personal information, express consent may be required. Express means an affirmative act, not proceeding with the call.

There is a clean test for whether you have crossed this line. If the system stores a voice template and compares future calls against it, you are running biometrics. If it only converts speech to text and discards the audio characteristics, you are not. Ask your vendor that question in writing, because the answer determines everything downstream and the marketing material will not contain it.

2. In Quebec, a biometric database has a 60 day filing deadline

Quebec’s Act to establish a legal framework for information technology, as amended by Law 25, requires that the creation of a database of biometric characteristics be disclosed to the Commission d’accès à l’information in advance. Counsel summarising the provisions report that the disclosure must be made no later than 60 days before the database is put into use, that the existence of the database must be disclosed whether or not it is in service, and that a process using biometrics to verify or confirm identity must be reported to the Commission beforehand even where no database is created. Voiceprints are listed among the biometric characteristics covered.

Sixty days is longer than most AI phone rollouts take from signed contract to live line. If voice identification is part of your plan and you operate in Quebec, the filing is the first task in the project, not a compliance item to tidy up afterwards. The safer alternative, and the one we recommend by default, is to turn voice identification off and authenticate the caller the ordinary way, by asking for a booking reference or a postal code.

3. Outbound AI calls are automated calls, and express consent is required

This is the rule that catches people, because the inbound receptionist and the outbound follow up agent are usually sold as one product. The CRTC’s Unsolicited Telecommunications Rules govern automatic dialing announcing devices, and in Compliance and Enforcement Regulatory Policy 2014-155 the Commission denied the Canadian Marketing Association’s request to permit ADAD telemarketing without express consent where an existing business relationship exists. Express consent remained required. The Commission also declined to carve out dual purpose calls, holding that a call containing any solicitation is not exempt.

So an AI agent that phones your past customers to tell them about a seasonal offer needs their express consent first, and having bought from you before does not supply it. An AI agent that phones to confirm an appointment they booked is not soliciting, which is a different footing, but the moment the script adds “and while I have you, we are running a promotion,” the whole call becomes a solicitation.

Non solicitation automated messages carry their own identification requirements under the Rules: the message must begin with the name of the person or organisation on whose behalf it is made and a brief description of the call’s purpose, must include an email or postal address plus a local or toll free number where a representative can be reached, must keep that contact information valid for at least 60 days, and must repeat the identification at the end if the message runs longer than 60 seconds. Calling hours are restricted, and reasonable efforts are required to ensure the equipment disconnects within 10 seconds after the recipient hangs up. Sequential dialing is prohibited, and calls must not be placed to emergency lines or healthcare facilities.

Telemarketers must also maintain an internal do not call list, process requests immediately, update the list within 14 days, and keep numbers on it for three years, in addition to subscribing to the National Do Not Call List. An AI dialer that cannot honour a verbal “take me off your list” in the moment is not a product you can deploy in Canada.

Who is liable for what the AI says?

You are. A statement made by an automated agent on your line, in your business name, about your prices or policies, is your representation. Canadian decision makers have already worked through this in the chatbot context, and the reasoning does not change because the channel is voice instead of text. We covered the Canadian position in detail in our article on whether your business is liable for what its AI chatbot says, and the conclusion there applies here with more force, because a phone call leaves the customer with no screenshot and you with the only recording.

Three design decisions reduce that exposure more than any disclaimer will.

• Give the agent a closed price list, not a general knowledge of your pricing. If it is not in the published list, the answer is “I will have someone confirm that for you,” full stop.
• Do not let it commit to outcomes. Appointment times it can see in a calendar are facts. Turnaround times, approval odds, warranty coverage and eligibility are not, and should route to a human.
• Keep the transcript and read a sample weekly. You cannot supervise what you do not read. Twenty calls a week is enough to catch a drifting script before a customer does.

For regulated businesses the stakes go up again, because advertising and representation rules in your profession apply to whatever your agent says. A clinic’s AI cannot make claims the college prohibits, as we set out for dental and medical clinic websites, and a law firm’s AI cannot say things its law society would not let a lawyer say, which we covered in law firm website design in Canada.

The compliant setup, step by step

Work these in order. Steps one to five are the floor. Steps six to nine are what make the thing worth paying for.

1. Decide whether you are recording, transcribing, or both, and write down every purpose you intend to use the output for. Booking, record keeping, staff coaching, lead scoring, model training. Each one is a purpose you have to disclose.
2. Turn off voice identification unless you have a specific reason for it. If you keep it, treat it as biometric collection, get express consent, and file with the Commission d’accès à l’information at least 60 days ahead if you operate in Quebec.
3. Write the greeting to cover automation, recording, the actual purposes, and the alternative. Keep it under twenty seconds. Have it read by whoever handles your privacy obligations.
4. Build the alternative path and test it. A keyword like “agent” or “no recording” that takes a message without retaining audio. If the path does not exist, the disclosure is a notice rather than a choice.
5. Update your privacy policy to name call recording and transcription, the purposes, the retention period and how to request access. If you do not have one, start with whether you need a privacy policy in Canada.
6. Set a retention period and enforce it automatically. Keeping every recording indefinitely because storage is cheap is the single most common privacy failure in this category.
7. Scope the agent’s knowledge to published facts. Price list, hours, locations, services, calendar availability. Nothing inferred.
8. Instrument it properly. Call outcome, booking rate, abandonment point, escalation rate and the exact phrases that triggered a handoff. If you are also tracking phone leads for marketing attribution, read our note on whether call tracking hurts your local SEO before you add dynamic numbers.
9. Read transcripts weekly for the first month, then monthly. Keep a short log of every change you make to the script, because that log is your evidence of supervision.

Build, buy, or keep the human

The honest framing is not “AI versus receptionist.” It is “which calls does a machine handle better than voicemail.” Most Canadian service businesses are not choosing between an AI agent and a full time front desk. They are choosing between an AI agent and the after hours calls that currently reach voicemail and never come back.

The fourth row is the pattern that actually holds up. The AI answers, confirms what the caller wants, books the appointment if it is a booking, and takes a message with a callback commitment if it is anything else. That configuration satisfies the PIPEDA alternative requirement almost by accident, because the human path already exists.

On cost, be sceptical of per minute comparisons that ignore the integration work. The platform fee is rarely the expensive part. The expensive parts are connecting the calendar and CRM so a booking actually lands in the right place, writing the knowledge base the agent reads from, and the ongoing transcript review. If you are evaluating whether to build automation in house at all, our breakdown of hiring in house versus working with an agency applies to the same decision.

Common mistakes

• Quoting “one party consent” as the compliance answer. It resolves the Criminal Code question and nothing else.
• Shipping the vendor’s default greeting. “This call may be recorded for quality and training purposes” is vague about whether, vague about why, and silent about the automation.
• No alternative path. Disclosure without an option is notice, not consent, and the OPC guidance is explicit that customers must be given a choice.
• Leaving voice identification on because it demoed well. It converts a telephone system into a biometric collection, with a 60 day Quebec filing attached.
• Using call recordings to train a model without saying so. Purpose limitation means you may only use the information for the purposes specified at collection.
• Pointing the same agent outbound. Inbound and outbound are different legal regimes. Outbound automated solicitation needs express consent and an existing business relationship does not provide it.
• Letting the agent improvise prices. Every figure it says is a representation you will be held to.
• Indefinite retention. Cheap storage is not a retention policy.
• No transcript review. An unsupervised agent drifts, and you find out from a customer.
• Assuming PIPEDA applies when provincial law does. Alberta, British Columbia and Quebec have their own private sector statutes, and Quebec’s is materially stricter.

Frequently asked questions

Is it legal to use an AI receptionist in Canada?

Yes. No Canadian statute prohibits an automated system from answering a business line. The obligations attach to what you do with the call: recording it is permitted under Criminal Code section 184(2)(a) because you are a party to it, but privacy law separately requires you to inform the caller, state the purpose narrowly, and provide an alternative where recording is not integral to the service.

Do I have to tell callers they are talking to an AI?

No Canadian privacy statute currently requires a synthetic voice disclosure in the terms a consumer would recognise. Disclose it anyway. The consumer protection exposure of a caller discovering mid conversation that they were misled about who they were speaking to is real, and callers who know they are talking to a machine give clearer, shorter answers, which makes the transcript more accurate.

Is Canada a one party consent country for call recording?

For the purposes of the Criminal Code, yes. Section 184(2)(a) exempts interception where a party to the private communication consents, expressly or impliedly. That answers whether the recording is a criminal interception. It does not answer your obligations under PIPEDA or provincial privacy legislation, which require disclosure, a narrow stated purpose, an alternative, purpose limitation and access rights.

Does my AI need express consent, or is implied consent enough?

The OPC’s guidance indicates that in most cases, if the customer proceeds knowing the call is recorded and why, consent is implied. It also states that where the recording involves biometric voiceprints or other sensitive personal information, express consent may be required. So a transcription only setup generally runs on implied consent, and a voice identification setup should not.

Can my AI agent make outbound calls to past customers?

Not for solicitation without their express consent. In Compliance and Enforcement Regulatory Policy 2014-155 the CRTC denied a request to allow automated dialing announcing device telemarketing under an existing business relationship, and declined to exempt dual purpose calls that include any solicitation. Automated appointment confirmations for a booking the customer made are a different matter, but adding a promotional line makes the call a solicitation.

What does Quebec require if I use voice identification?

Counsel summarising Quebec’s Act to establish a legal framework for information technology report that a biometric database must be disclosed to the Commission d’accès à l’information no later than 60 days before it is put into use, that the existence of the database must be disclosed whether or not it is in service, and that using biometrics to verify identity must be reported to the Commission beforehand even without a database. Voiceprints are treated as biometric characteristics. Confirm the current requirement and form with Quebec counsel.

How long can I keep call recordings?

There is no fixed number. The OPC states that retention length varies with the purpose of collection and any legal requirement to retain the recording, and that organisations must have appropriate safeguards and limit retention. Set a defined period tied to your stated purpose, write it into your privacy policy, and enforce it automatically rather than by intention.

Can I use call recordings to train an AI model?

Only if that purpose was specified when you collected them. PIPEDA’s purpose limitation means information may only be used for the purposes specified, and the OPC’s guidance warns against stating a recording is for security or quality assurance when it will in fact be used for marketing, profiling or authentication. Model training is a distinct purpose and belongs in the disclosure.

Who is responsible if the AI quotes the wrong price?

Your business. A statement made by your automated agent, on your line, in your name, is your representation. The fix is structural rather than contractual: give the agent a closed set of published facts to answer from and route everything else to a human.

The short version

An AI phone receptionist is legal in Canada and, for most service businesses, a straightforward improvement on voicemail. The compliance work is small and specific: say that the call is automated and recorded, say narrowly why, build a real path for a caller who declines, leave voice identification switched off, set a retention period you actually enforce, keep the agent inside a closed set of published facts, and never point the same agent outbound without express consent. Do those seven things and the remaining risk is operational rather than legal.

Want the system built properly the first time?

Wise Media builds automation for Canadian businesses the same way we build websites: starting from the rule the regulator actually published, not the vendor’s default settings. If you are considering an AI receptionist, or you have one running and nobody has looked at the disclosure script or the retention policy, send us the details through our intake form and we will come back with a scope covering the configuration, the privacy documentation and the reporting. If the phone is not the bottleneck and the site is, the website growth packages are the better place to start, and the website packages cover a rebuild.

Sources

• Criminal Code, section 184, Justice Laws Website
• Office of the Privacy Commissioner of Canada, Recording of Customer Telephone Calls
• CRTC Compliance and Enforcement Regulatory Policy 2014-155, review of the Unsolicited Telecommunications Rules
• CRTC, Unsolicited Telecommunications Rules and telemarketing guidance
• BLG, New Québec biometric requirements: legal risk and mitigation