“This call may be recorded”: Canada’s privacy commissioner on what that allows

Almost every call to a bank, phone company or airline starts with the same line: this call may be recorded for quality and training purposes. On October 8, 2026, the Office of the Privacy Commissioner of Canada updated its guidance on recording customer calls, with new attention on one use in particular: recognizing you by your voice.

The guidance is written for businesses, but it doubles as a clear list of what you can expect when you call one.

What’s new: voiceprints

Some companies use recordings to verify who you are on future calls. When they do, the commissioner’s guidance says, they usually collect “voiceprints,” uniquely identifying characteristics of your voice, which are a form of sensitive biometric information.

That matters for consent. In most cases, if you stay on the line knowing the call is recorded and why, your consent is implied. But if the recording involves voiceprints or other sensitive information, the guidance says express consent may be required. In plain terms: a company shouldn’t quietly turn your voice into a password just because you didn’t hang up.

The guidance also points out that a recording can capture more than the conversation: your tone, an accent, a speech or vocal disability, and personal details you mention that have nothing to do with the call.

What the rules say businesses must do

Under PIPEDA, Canada’s federal private-sector privacy law, the guidance says a business that records calls must:

• record only for purposes a reasonable person would consider appropriate
• tell you the call is being recorded, explain why, and get your consent
• state the purpose as clearly and narrowly as possible, and name every use. It shouldn’t say “quality assurance” if the recording will be used for marketing, profiling or authentication
• give you a choice, if recording isn’t integral to the service, such as continuing without recording, going to a store, writing an email or letter, or doing it online
• use the recording only for the purposes it named, keep it safe and not keep it longer than needed

You also have the right to ask for access to a recording later. And the rules apply whether you called them or they called you, including when a company uses an outside call centre.

What you can do

1. Ask what the recording is for. If the message just says “quality and training,” you can ask whether it’s also used for anything else, such as verifying your identity.
2. Think before you enrol your voice. If a company offers voice ID, it’s a choice. Ask how the voiceprint is stored, how long it’s kept and how to remove it. If you’d rather use a PIN or a passcode, ask for that instead.
3. Ask for an alternative. If recording isn’t essential to what you’re doing, the guidance says the company must offer another way: an unrecorded call, an email, a branch visit or the website.
4. Ask for your recording. If there’s a dispute about what was said, you can request access to it.
5. Raise concerns. Start with the company’s privacy officer; the commissioner’s office publishes tips for raising a privacy concern with a business. If you’re not satisfied with the answer, you may be able to file a complaint with the office.

One more habit worth keeping: a recording message doesn’t prove a call is real. The Canadian Anti-Fraud Centre advises never giving passwords, PINs or one-time verification codes to anyone who contacts you unexpectedly, and not relying on caller ID. If something feels off, hang up and call back on a number you found yourself.

Sources

• Office of the Privacy Commissioner of Canada, OPC updates guidance on safe handling of voice data when recording customer calls, October 8, 2026
• Office of the Privacy Commissioner of Canada, Recording of Customer Telephone Calls
• Canadian Anti-Fraud Centre, Spotting fraud in a changing digital landscape, October 2026
• Office of the Privacy Commissioner of Canada, Guidance for processing biometrics – for businesses