The Misconception: It Is Not Two-Party Consent

You likely assume Canada operates under a two-party consent model. That belief stems from confusion with strict US state laws like California’s. The federal reality is different.

Section 184 of the Criminal Code establishes a one-party consent framework for individuals. If you are an active participant in a conversation, you may record it without informing others. This right applies across the country, including in Ontario.

The critical distinction lies in your role. You must be part of the conversation to record it legally. A bystander eavesdropping and recording commits criminal wiretapping. That offense carries a penalty of up to five years in prison.

This federal rule often clashes with business obligations. Many organizations mistakenly apply the stricter two-party standard to their internal operations. They do so to avoid legal friction, even though the criminal law does not require it.

Businesses face a separate set of rules under PIPEDA. When a company records calls, it must inform customers of the recording. It must also state the purpose clearly and obtain consent. Implied consent usually suffices if the customer proceeds with the call after hearing the disclosure.

The Office of the Privacy Commissioner emphasizes that organizations must not misstate the purpose of recording. Claiming a call is recorded for quality assurance while using it for marketing is prohibited. You must offer alternatives if recording is not integral to the service.

This distinction matters for compliance. My AI Call Center operates under these PIPEDA guidelines. We treat recording as optional and only proceed with full disclosure and consent. Our consent verification process ensures that every call aligns with these privacy standards before launch.

Understanding the difference between criminal law and privacy regulation protects you. It keeps your recordings admissible and your business compliant.

Key legal distinctions to remember:

• One-party consent applies to individual participants under federal criminal law.
• PIPEDA requires businesses to disclose recording purposes and obtain consent.
• Recording a conversation you are not part of is illegal in all provinces.
• Voiceprints are sensitive biometric data requiring express consent under PIPEDA.

The Privacy Commissioner of Canada advises stating purposes as clearly and narrowly as possible. Do not use recordings for undisclosed reasons. This practice protects both the customer and your organization from liability.

For cross-border calls, apply the stricter jurisdiction’s rules. If one participant is in a two-party consent state, assume that law governs the entire interaction. This approach minimizes risk for multi-jurisdiction campaigns.

Always verify your specific legal position before launching recording features. Consult legal counsel if your operations span multiple provinces or countries. The stakes are high, and the rules are specific.

The Hard Line: Criminal Wiretapping

There's a line you don't cross in Canada, and the Criminal Code draws it in plain language. Under Section 184, intercepting a private communication you are not part of is an indictable offense. The punishment is real: up to five years in prison.

The rule is simple on its face. If you are not a participant in the conversation, you have no business recording it. The recorder must be an active participant, not a silent listener tapping a line or running a device in someone else's office. Crossing that line is criminal wiretapping, not a civil misstep or a regulatory technicality.

A few points worth keeping straight:

• The offense is intercepting a "private communication," which covers ordinary phone calls and similar exchanges between individuals.
• Liability is triggered by the act of intercepting, regardless of whether the recording is ever shared or used.
• The five-year maximum applies on top of any civil claims the recorded parties may bring.
• Workplace policies can make covert recording a separate cause for termination, even where criminal exposure is unclear.

For a managed calling operation, this is the bright line that shapes everything else. Any campaign that touches live conversations has to assume the people on the other end are protected by this criminal threshold. The practical discipline is straightforward: only record when you are a participant, only record when the purpose is legitimate, and only record when the other party knows it is happening.

That posture is what keeps a calling program inside the law rather than running alongside it. A campaign review that checks list source, consent records, and calling windows before launch is the same review that keeps the recorder on the right side of Section 184. Approved, permissioned, reviewed lists aren't just a quality filter; they're the boundary that separates lawful outreach from criminal interception.

For organizations running structured outbound campaigns across multiple provinces or across the border, the safe assumption is that the stricter rule applies wherever the call lands. A prospect in a jurisdiction that requires all-party consent should be treated as if the recording is off the table, full stop. The cost of getting this wrong is not a fine or a policy note. It is a criminal record and a prison sentence, and no campaign goal is worth that trade.

Business Obligations Under PIPEDA

If your business records customer calls, the rules change. You can't just hit record and hope for the best.

Federal privacy law imposes strict duties on organizations that handle personal information. This applies whether you or the customer initiates the call. The Office of the Privacy Commissioner of Canada outlines these requirements clearly. You must inform the customer that recording is happening.

You also need to state the purpose of the recording. This purpose must be clear and narrow. Do not claim "quality assurance" if you later use the file for marketing. That misrepresentation violates privacy standards.

Consent is the next critical step. In most cases, implied consent is sufficient. If the customer proceeds with the call after hearing your disclosure, they have agreed. However, you must offer an alternative if recording is not essential to the service. The customer must have a choice.

This distinction matters for sensitive data. Voiceprints are considered biometric information. Collecting them often requires express consent. The regulator warns that voice data poses significant privacy risks. You should treat this category with extra caution.

Businesses that outsource call handling must ensure their vendors follow these rules. This includes third-party telemarketing or call center services. You remain responsible for how that data is handled.

Here is what your process needs to include:

• Disclose the recording before the conversation starts.
• State the specific, narrow purpose of the recording.
• Obtain implied or express consent as required.
• Offer an alternative if the customer objects.
• Never use recordings for undisclosed purposes.

My AI Call Center operates within these boundaries. We treat recording as optional. It only happens with proper disclosure and consent. We verify list sources and consent records before launch. If the permission isn't clear, we flag it.

You should avoid inventing numbers or assuming consent. The law is clear on the risks. Unlawful interception can lead to severe penalties. While federal criminal law focuses on non-participants, business privacy breaches carry their own weight.

Compliance protects your reputation. It also protects your clients. Do not rely on vague policies. Be specific about what you record and why.

If you run campaigns across borders, apply the stricter law. This might mean following US state rules if your team is in Texas. Or adhering to Canadian standards if your clients are in Ontario. When in doubt, get consent from all parties.

Check your current scripts. Do they meet these standards? Review your consent logs. Are they complete and verifiable?

Small details make the difference. A clear disclosure builds trust. It shows you respect the customer's privacy. It also keeps you out of legal trouble.

Remember, you are responsible for your data. That includes any recordings you make. Ensure your processes align with PIPEDA.

The goal is simple. Run useful calls without breaking the law. Confirm, qualify, and retain customers with confidence.

Need help structuring your consent process? We handle the compliance side of outbound calling. We only work with approved, permissioned lists.

See how we manage consent verification for your campaigns. Visit myaicallcenter.app/campaigns to review our approach.

Or contact us directly at [email protected]. We will review your list and consent records. We tell you plainly if the list will not support the campaign.

No invented numbers. No hidden fees. Just structured, compliant calling.

Implementing a Compliant Recording Protocol

If your business records calls, a script that says "this call may be recorded" is not a legal strategy on its own. In Canada, the rules split into two tracks: what an individual participant may do under the Criminal Code, and what an organization must do under federal privacy law. Getting the second track right takes a written protocol, not good intentions.

Start with the criminal baseline. Under Section 184 of the Criminal Code, intercepting a private communication is an indictable offence carrying up to five years in prison, but the offence does not apply where one party to the conversation consents, as this review of international call recording law explains. That is why participant recording is generally lawful across Canada. Recording a call you are not part of is a different matter entirely, and it is where the hard line sits.

Businesses face the stricter standard. Under PIPEDA, an organization recording customer calls must inform the customer, state the purpose clearly and narrowly, and obtain consent, which is implied when the customer keeps talking after being told, according to guidance from the Office of the Privacy Commissioner of Canada. Customers must also be offered a choice, and recordings cannot be reused for purposes you never disclosed.

Build your protocol around these steps:

• Script updates: open every recorded call with a plain disclosure of the recording and its purpose, and keep that purpose narrow.
• Consent verification: log how and when consent was captured, and confirm the customer's choice before the recording begins.
• Alternatives: if a customer objects, offer a path that does not involve recording.
• Cross-border calls: apply the stricter jurisdiction's rules, since consent turns on where the person is physically located.
• Third parties: if you contract out calling work, confirm those vendors follow the same rules.

Cross-border campaigns deserve special care. When participants span jurisdictions, the practical answer is to follow the stricter rule, a principle both international compliance guides and US recording law resources recommend. For a Halifax-based operation running campaigns into the United States, that means checking the consent model of the state where the person actually sits, not the area code on the list.

This is why My AI Call Center treats recording as optional and only with disclosure and consent, and why list source, consent records, and calling windows are reviewed before any campaign launches. Nothing runs until you approve the script, disclosure, and opt-out handling. None of this is legal advice, and requirements vary by location, industry, contact type, and consent status, so get your own counsel before launch.