Many AI voice agents record every call, and so do many call-coaching setups. On October 8, Canada’s privacy regulator updated its guidance on exactly that.
What happened?
On October 8, 2026, the Office of the Privacy Commissioner of Canada updated its guidance for organizations that record customer calls. The update covers voiceprints, which the OPC calls sensitive biometric information, and when meaningful consent may be required. Under PIPEDA, the federal private-sector privacy law, the rules apply whether the customer or the business placed the call. Businesses that contract out call centres or telemarketing must make sure those third parties follow the rules too.
The guidance itself sets out what a business that records calls must do:
- Tell the customer the call is being recorded, state the purpose and get consent.
- State the purpose as clearly and narrowly as possible, and name every use. Don’t say “quality assurance” if the recording will be used for marketing, profiling or authentication.
- Expect implied consent in most cases. If the recording involves voiceprints or other sensitive information, express consent may be required.
- Give customers a choice. If recording isn’t integral to the service, offer an alternative, such as continuing without recording.
- Let customers request access later, keep safeguards in place and limit how long recordings are kept.
For businesses not subject to PIPEDA, the guidance says these are best practices.
What it means for your business
The upside first. Recordings are the feedback loop. An AI system is only as good as the feedback it gets, and call recordings and transcripts are where that feedback comes from. They show where an AI voice agent misheard a caller, and where a new rep lost the call. That is why we build every system to log each call and how it turned out.
The downside is the disclosure most businesses already use. A line like “calls may be recorded for quality purposes” doesn’t name uses like tuning an agent, and the guidance says not to cite quality assurance at all if the recording will be used to market to the caller. And if a vendor runs your calls, the guidance says you must make sure they follow the rules too.
This matters most where the calls sit. For many owner-led firms, the step that limits output is revenue follow-up: how fast you reach leads and how well you follow up. A voice agent that answers every inquiry is AI on that step. A disclosure gap there can push you to switch recording off, and then the feedback that makes the system improve stops. Get the disclosure right once, and the loop keeps running.
What to do this week
- List every purpose your recordings serve today: service, disputes, call coaching, agent tuning, marketing. Rewrite the opening disclosure so it names each one in plain words.
- Check whether any tool creates voiceprints to verify callers. If one does, plan for express consent.
- Ask each calling vendor, including your voice agent provider, how they store and keep recordings, and what happens when a caller says “please don’t record this”.
What would change this view
If the OPC publishes a finding about a business using AI on its phone lines, the disclosure bar is likely to get more specific, and this checklist should be updated against it. Until then, watch for any change to the guidance page’s “date modified” line.