Visit Website →
← Back to blog

Call recording laws in Canada: what you need to know

August 15, 2026
Call recording laws in Canada: what you need to know

Recording a phone call in Canada is generally legal if you are a participant in the conversation. That is the core of Canada's one-party consent rule under the Criminal Code. You do not need to tell the other person you are recording. What you do need to understand is that this criminal law baseline is only the starting point, not the finish line.

Three authorities govern how call recording works in Canada:

  • Criminal Code, s.184: Sets the one-party consent rule and defines what counts as illegal interception.
  • PIPEDA and the Office of the Privacy Commissioner (OPC): Impose notice, consent, and data-handling duties on businesses that record customer or employee calls.
  • Quebec's Loi 25: Adds a stricter provincial layer for businesses operating in or serving Quebec residents.

Lawful recording under the Criminal Code does not exempt you from privacy law obligations. A business that records calls without notifying callers, or that stores recordings without a documented retention policy, can face regulatory complaints and fines even when no criminal offence occurred. The two regimes run in parallel, and both apply.

Key takeaways

Canada's call recording laws require businesses to go well beyond the one-party consent rule: PIPEDA and provincial privacy statutes impose notice, consent, and retention obligations that the Criminal Code alone does not cover.

PointDetails
One-party consent baselineAn active participant may record a call without telling others, under Criminal Code s.184.
Businesses must notify and obtain consentPIPEDA requires notice at call start, a stated purpose, and a genuine consent option before recording.
Provincial rules vary significantlyQuebec's Loi 25 adds Privacy Impact Assessments and stricter consent; BC and Alberta have their own PIPA statutes.
Preserve authenticity for evidenceSave unedited originals, document chain of custody, and log the date, parties, and purpose at the time of recording.
Dexcoretechnologies for compliant automationDexcoretechnologies configures built-in notice prompts, purpose-limited capture, and scheduled deletion for Canadian businesses.

Table of Contents

What do Canada's call recording laws actually permit?

Section 184 of the Criminal Code makes it a criminal offence to knowingly intercept a private communication. The key saving provision, however, exempts the originator or intended recipient of the communication. In plain terms: if you are on the call, you can record it. If you are not on the call, you cannot.

The participant requirement is stricter than it sounds. You must be actively present and engaged in the conversation at the moment of recording. Leaving a recording device running in a room after you leave, or setting up software to capture a call you are not on, crosses the line from permitted recording into illegal interception. Physical or digital presence matters throughout the recording, not just at the start.

Criminal penalties for unlawful interception are serious. Under s.184, the offence is hybrid, meaning the Crown can proceed by indictment and seek up to five years imprisonment. The statute does carve out targeted exceptions for law enforcement with proper authorisation and for telecommunications service providers operating within their technical functions, but those exceptions are narrow and do not apply to ordinary individuals or businesses.

Red flags that turn permitted recording into prohibited interception:

  • Recording a call you joined only to capture others' conversation, with no genuine participation
  • Setting a device to record a room or phone line while you are absent
  • Intercepting communications between two other parties, even with one party's knowledge
  • Using spyware or call-capture software installed on someone else's device without their knowledge

Pro Tip: The participant test is about presence and purpose. Courts have looked at whether the recorder was genuinely part of the conversation or was essentially a third-party eavesdropper. If your role in the call is pretextual, the protection likely does not apply.

How do PIPEDA and OPC guidance affect businesses that record calls?

Passing the Criminal Code test is necessary but not sufficient for businesses. PIPEDA applies to private-sector organisations that collect, use, or disclose personal information in the course of commercial activity. A recorded call almost always contains personal information, which means PIPEDA's ten fair information principles apply the moment you press record for business purposes.

The OPC's guidance on recording customer calls is specific: organisations must inform callers at the start of the call that it is being recorded, state the purpose clearly, and obtain consent. Continued participation after that notice can constitute implied consent, but only when the caller genuinely has a real choice. Implied consent is not a loophole. The OPC expects that callers who object to recording are offered a meaningful alternative, such as transfer to a non-recorded line or a different service channel.

Core business obligations under PIPEDA for call recording:

  • Notice: Inform callers at the start of the call, before recording begins.
  • Purpose: State specifically why the call is being recorded (quality assurance, dispute resolution, regulatory compliance).
  • Consent: Obtain implied consent through continued participation, or express consent for sensitive purposes.
  • Limitation: Collect only what is necessary for the stated purpose.
  • Retention: Keep recordings only as long as necessary, then securely delete.
  • Safeguards: Protect recordings with appropriate technical and organisational controls.
  • Third-party contracts: Require vendors who process recordings on your behalf to meet equivalent standards.

Sample IVR notification script businesses can adapt:

"This call may be recorded for quality assurance and training purposes. If you do not wish to be recorded, please press 2 to speak with an agent on an unrecorded line."

The OPC does acknowledge limited exceptions where consent may not be required, including debt collection and fraud investigations. Even in those cases, the guidance expects minimisation and safeguards. These exceptions are narrow and do not permit open-ended recording without controls.

Employer-employee recording carries its own layer of complexity. Workplace monitoring of employee calls requires advance notice, a documented policy, and a clear legitimate business purpose. Recording employees without notice, even for performance management, can expose employers to privacy complaints and labour relations consequences.

How do PIPEDA and OPC guidance affect businesses that record calls? — overview diagram

How do provincial laws change your obligations?

PIPEDA is displaced in provinces that have enacted substantially similar private-sector legislation. Quebec, British Columbia, and Alberta each have their own statutes that govern how businesses handle personal information, including recorded calls. Federally regulated businesses (banks, airlines, telecommunications carriers) remain under PIPEDA regardless of where they operate.

Quebec carries the most significant compliance burden. Loi 25 (formally An Act to modernize legislative provisions as regards the protection of personal information) raised the bar considerably. Businesses serving Quebec residents must meet enhanced consent thresholds, conduct Privacy Impact Assessments for new technologies that process personal data, appoint a privacy officer, and publish a privacy policy. The penalties for non-compliance are among the highest in Canada. If your business records calls with Quebec customers, Loi 25 compliance is not optional.

British Columbia and Alberta have substantially similar statutes (PIPA in both provinces) that mirror PIPEDA's core principles but with some procedural differences. In practice, the notice, consent, and retention requirements are comparable, though businesses should review each statute directly for nuances.

Cross-border calls add another layer. A call between a business in Ontario and a customer in Quebec triggers Quebec's rules for the Quebec party. A call with a U.S. party may engage U.S. state laws (some states require all-party consent) depending on where the recording is processed and stored. Multi-jurisdictional calls are one of the clearest triggers for legal advice before you build a recording programme.

Provincial compliance checklist differences to watch:

  • Quebec: Privacy Impact Assessment required for new recording technologies; privacy officer appointment mandatory; stricter consent documentation.
  • BC and Alberta: PIPA applies instead of PIPEDA; substantially similar obligations but review each statute for procedural specifics.
  • Federally regulated sectors: PIPEDA applies regardless of province; sector-specific regulators (OSFI, CRTC) may add further requirements.

Will a recording hold up as evidence in court?

Lawful recording under the Criminal Code does not guarantee admissibility. Canadian courts apply their own evidentiary rules, and a judge can exclude a recording for reasons entirely separate from whether it was legally obtained.

The factors courts typically examine include authenticity (can you prove the recording has not been altered?), context (was the conversation what it appears to be?), and chain of custody (who had access to the recording between capture and court?). A recording that was legally made but then edited, compressed, or passed through multiple hands without documentation faces real admissibility challenges. Searching CanLII for cases involving recorded conversations shows a consistent judicial concern with metadata integrity and unexplained gaps in audio.

Confidentiality obligations and court orders can also block a recording from being used even when it was lawfully made. A recording of a conversation with a lawyer, for example, may be subject to solicitor-client privilege regardless of who made it.

Best practices to preserve authenticity:

  • Save the original, unedited file immediately after recording.
  • Use a format that preserves metadata (timestamp, device ID, file creation date).
  • Limit access to the original file and document every person who handles it.
  • If transcription is needed, keep the original audio alongside the transcript.
  • Note the date, time, parties, and purpose of the recording in a contemporaneous log.

Pro Tip: If you think a recording might ever be used in litigation, treat it like physical evidence from the moment you make it. Courts are not forgiving about recordings that were "cleaned up" before being produced.

Criminal exposure is the floor, not the ceiling. Even a recording that was lawfully made can generate civil liability, professional discipline, or employment consequences depending on how it is used afterward.

Civil risks to know:

  • Invasion of privacy torts: Several provinces recognise a tort of intrusion upon seclusion. A recording that captures highly personal information, even lawfully, can ground a civil claim if the use is offensive and unjustified.
  • Breach of confidence: Sharing a recording that contains confidential information disclosed in the context of a relationship of trust can attract liability independent of privacy statutes.
  • Defamation: Publishing a recording that contains false statements of fact about an identifiable person carries the same defamation risk as publishing those statements in writing.
  • Contractual breach: Many service agreements, NDAs, and employment contracts contain confidentiality clauses that recording and sharing conversations may breach.

Professionals face additional constraints. Lawyers recording client calls without consent may breach Law Society rules in some provinces. Health professionals recording patient conversations must navigate both privacy legislation and college conduct standards. Even where recording is technically lawful, professional obligations can require disclosure.

Pro Tip: Before you share a recording with anyone, ask two questions: does sharing it breach a confidence, and could the content defame someone? If the answer to either is "possibly," get legal advice before you distribute it.

Practical compliance checklist for individuals and businesses

The gap between "legally permitted to record" and "fully compliant" is where most problems arise. A common operational error is treating one-party consent as sufficient for a business recording programme, then forgetting notice, purpose documentation, and retention rules entirely.

For individuals

  • Confirm you are an active participant in the conversation before recording.
  • Do not record calls you join solely to capture others' conversation.
  • Store recordings securely and limit who can access them.
  • Before sharing or publishing, consider civil and professional risks (see above).
  • For high-stakes recordings (employment disputes, legal matters), consult a lawyer.

For businesses

  • Notice script (IVR): "This call may be recorded for [state specific purpose]. To continue without recording, press [number] now."
  • Live agent script: "I want to let you know this call is being recorded for [purpose]. Is that okay with you?"
  • Document the specific purpose for recording in a written policy before you start.
  • Offer callers a genuine alternative if they object (non-recorded line, email, in-person).
  • Obtain express consent for sensitive categories of information (health, financial details).
  • Set retention periods and automate deletion at the end of the retention window.
  • Require third-party vendors (transcription services, CRM platforms) to sign data processing agreements.
  • Train staff on the policy and conduct periodic audits.

Suggested retention framework:

Pro Tip: Configure your call platform to auto-delete recordings at the end of the retention window rather than relying on manual deletion. Document the configuration setting and the date it was applied. That record is your evidence of compliance if a regulator asks.

Can you publish or share a recording you made?

Making a recording lawfully and distributing it publicly are two different legal acts. Publication raises risks that private retention does not.

Posting a recording online, sending it to media, or sharing it in a group chat can trigger defamation claims if the content includes statements that damage someone's reputation. It can also attract privacy tort claims, particularly if the recording captures sensitive personal information. The fact that you were legally permitted to make the recording does not carry forward as a defence to every downstream use.

Before publishing or sharing any recording:

  • Review the content for statements that could be defamatory.
  • Identify whether any party to the conversation disclosed information in confidence.
  • Check whether any party is a minor, which adds consent and privacy complications.
  • Consider whether the platform's Terms of Service permit audio recordings of private conversations.
  • Redact or bleep personal identifiers (names, addresses, account numbers) where possible.
  • For recordings involving employees or clients, check contractual confidentiality obligations first.

Legally recording a call is not the same as lawfully publishing it. Civil privacy torts, defamation law, and professional conduct rules can restrict subsequent use even when the original recording was entirely above board.

Pro Tip: If you are considering publishing a recording to support a public complaint or legal claim, obtain express consent from all parties if possible, and have a lawyer review the content before release. The reputational and legal cost of a defamation claim typically outweighs whatever you hoped to achieve by publishing.

When should you consult a lawyer before recording?

General guidance covers the common cases. Some situations carry enough complexity or risk that proceeding without legal advice is a genuine gamble.

Consult a lawyer before recording when:

  • The call involves parties in different countries, particularly U.S. states with all-party consent requirements.
  • You intend to publish the recording to a wide audience or use it in litigation.
  • Any party to the conversation is a minor.
  • The recording relates to an employment dispute, termination, or workplace investigation.
  • You are implementing a large-scale business recording programme for the first time.
  • You are integrating AI transcription into call workflows, which can convert a personal recording into a commercial data processing activity that triggers PIPEDA obligations.
  • Your business operates in a regulated sector (healthcare, financial services, telecommunications) where sector-specific rules layer on top of the Criminal Code and PIPEDA.
  • Your business serves Quebec residents and you have not yet assessed Loi 25 compliance.

The AI receptionist and medical office context is a good example of where multiple regimes converge: health privacy legislation, PIPEDA, professional college standards, and the Criminal Code all apply simultaneously. No single general guide resolves that intersection.

What this guide covers and what it does not

This guide is a general legal explainer, not legal advice. It reflects the law as it stands in Canada at the time of writing, but statutes change, regulators update their guidance, and courts interpret provisions in ways that can shift the practical meaning of the rules described here.

The guide covers the federal criminal baseline, PIPEDA and OPC guidance, Quebec's Loi 25, provincial variations in BC and Alberta, admissibility principles, civil risks, and practical compliance steps. It does not cover sector-specific regulatory regimes in depth (OSFI for financial institutions, provincial health privacy statutes such as Ontario's PHIPA or Alberta's HIA), nor does it address every nuance of employment law or professional conduct codes.

For any recording programme that involves sensitive data, regulated industries, Quebec operations, or potential litigation use, consult a qualified Canadian lawyer. The OPC's website and CanLII are good starting points for self-research, but they are not substitutes for advice tailored to your specific situation.

Dexcoretechnologies works with Canadian businesses that automate call handling. Configuring an automated system to collect only what is necessary, notify callers at the start of every call, and delete recordings on a defined schedule is one of the most practical ways to reduce compliance risk without adding manual overhead.

Pro Tip: Automated call platforms can be configured to anonymise transcripts, suppress recording for specific call types, and trigger deletion workflows automatically. Documenting those settings in your privacy policy is itself a compliance step.

Dexcoretechnologies handles the compliance-heavy parts of call recording for you

Canadian businesses that record calls for quality assurance, appointment booking, or dispute resolution face a real operational burden: every call needs a notice prompt, every recording needs a retention window, and every vendor needs a data processing agreement. Getting all three right manually is where most compliance gaps appear.

Dexcoretechnologies

Dexcoretechnologies builds compliant call handling into the workflow from the start. The AI receptionist delivers a caller notification before any interaction is captured, limits what it collects to what the business actually needs, and integrates with your existing CRM and scheduling systems without creating uncontrolled data flows. Retention settings are configurable, so recordings are deleted on schedule rather than accumulating indefinitely. For Canadian service businesses, contractors, clinics, and restaurants that want 24/7 call coverage without the compliance headache, that combination is the practical answer. See how it works for service businesses and book a demo to review the configuration options for your specific use case.

Primary sources and official references

These are the authoritative sources to consult directly when verifying the rules described in this guide.

  • Criminal Code, s.184 (Justice Canada): The statutory text of the interception offence and the participant saving provision. Start here for the criminal law baseline.
  • OPC guidance: Recording of Customer Telephone Calls: The regulator's own interpretation of PIPEDA obligations for business call recording. The most practical single document for compliance teams.
  • PIPEDA overview (OPC): The full framework of federal private-sector privacy obligations, including the ten fair information principles.
  • PIPEDA principles (OPC): Detailed breakdown of accountability, purpose, consent, safeguards, and access principles relevant to recording programmes.
  • CanLII: The best free resource for Canadian case law. Search for decisions involving s.184, PIPEDA complaints, and privacy torts to understand how courts and tribunals have applied these rules in practice.
  • Canadian Privacy Law Blog: AI recording and the law: Practical analysis of how AI transcription and automated recording tools interact with Canadian privacy law.

For statutory text, use the Justice Canada and OPC sites. For how those statutes have been applied in real disputes, CanLII is the right tool. For sector-specific rules (health, finance), go directly to the relevant provincial health privacy regulator or federal sector regulator.

This article provides general legal information about call recording laws in Canada. It is not legal advice. For guidance specific to your situation, consult a qualified Canadian lawyer or your provincial law society's referral service.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Sources