Quebec asks for consent differently, and the difference is where most businesses fail it.
Law 25 requires the consent request to be presented separately from everything else. A privacy policy paragraph does not satisfy it.
Quebec's Law 25 applies to any business handling the personal information of people in Quebec, including businesses based elsewhere that offer them goods or services. Its consent standard is stricter than the rest of Canada's in one structural way: the request for consent has to be presented separately from any other information given to the person, and it has to be specific to each purpose. A recording notice buried in a longer greeting, or in a privacy policy, is the exact shape Law 25 was written against.
What makes Law 25 consent different?
Two things. It must be requested separately from other information rather than bundled into it, and it must be granular, specific to each purpose the information will be used for. Clear, free and informed is the standard; separate and specific is how it has to be delivered.
For an AI receptionist this is a design constraint, not a wording change. A greeting that says the call may be recorded for quality assurance, training, analytics and service improvement in one breath is asking for four purposes with one request. Granularity means the caller can tell what they are agreeing to for each.
The separation requirement is the one that catches web-trained teams. Online, the fix is a distinct consent banner rather than a line inside the terms. On a phone call, the equivalent is a discrete moment that exists only to obtain consent, not a clause inside a sentence about opening hours.
Which specific rules bite on a recorded call?
Consent granularity and separation, the right to withdraw at any time, and the age threshold. Law 25 sets the age of consent at 14, so a business whose callers may be younger needs parental consent for children under that.
| Provision | What it means for a recorded call |
|---|---|
| Separate request | The consent moment cannot be folded into other information |
| Granular consent | One request per purpose, not one request for four purposes |
| Withdrawal | A caller may withdraw consent at any time, and processing must stop |
| Age 14 | Below that age, parental or guardian consent is required |
| Extraterritorial reach | Applies to out-of-province businesses serving Quebec residents |
Withdrawal is the one most systems have no mechanism for. It is worth deciding what happens operationally before someone asks.
What is the exposure?
Substantially larger than elsewhere in Canada. Administrative and penal provisions reach $25,000,000 or 4% of worldwide turnover for the preceding year, whichever is greater, with a lower bound in the tens of thousands. For natural persons the range is smaller but still meaningful.
The number is not the useful part. The useful part is what it signals about how Quebec expects this regime to be treated: the scale is deliberately comparable to European data protection rather than to the rest of Canada's, and it is a reason to treat a Quebec-facing line as its own design problem rather than a copy of the Alberta one.
For most small businesses the realistic risk is not a maximum penalty. It is having no answer when a customer asks how to withdraw consent, and no record of what was asked for in the first place.
Law 25 requires the consent request to be presented separately from everything else you tell someone, which means a recording notice folded into a greeting has technically informed the caller and has not asked them anything.
A Quebec-facing line needs its consent moment built as a moment. That is a scripting decision, and it belongs in the build rather than the review afterwards.
Start free pilotWhat this page does not cover
This is a reading of the legislation as it applies to an AI receptionist answering a business phone, not legal advice. Statutes are amended and regulators publish new guidance; check the source links, which are dated, and take advice on anything that matters.
- Law 25 in full. The Act covers privacy officers, impact assessments, breach reporting, portability and automated decision-making. This page addresses consent for recorded calls only.
- Language obligations. Quebec's language legislation is a separate regime with its own requirements for customer communication, not addressed here.
- Automated decision-making. Law 25's notification duty for decisions based exclusively on automated processing is a distinct provision this page does not analyse.
Questions this raises
- Does Law 25 apply to a business outside Quebec?
- It can. The Act reaches organizations that process the personal information of people in Quebec, including out-of-province businesses offering goods or services to Quebec residents.
- Is a recording notice in the greeting enough for Law 25?
- Not if it is folded in with other information. The request for consent has to be presented separately from anything else being communicated, which is a structural requirement rather than a wording one.
- What happens if a caller withdraws consent?
- Processing has to stop. The practical question is whether the business can act on that (find the recordings, stop using them, and confirm it) which is worth deciding before the situation arises.
- What is the age of consent under Law 25?
- Fourteen. Consent for a child under 14 must come from a parent or guardian, which matters for any line that may take calls from young people.
- Are the penalties really 4% of global turnover?
- The upper range reaches $25,000,000 or 4% of worldwide turnover for the preceding year, whichever is greater. That is the ceiling rather than the expectation, but the scale is deliberate.
Sources
- Act respecting the protection of personal information in the private sector (as amended by Law 25)Légis Québecconsulted 2026-08-09
Want an AI receptionist built around these rules rather than despite them?
We build a working receptionist on your calls, your booking rules and your escalation rules, and you call it yourself before committing to anything. About 14 days, no call limit during the pilot.
Start free pilot