A cloned voice starts as a real recording of a real person, which is what makes it, in Canadian privacy law’s plain wording, information about an identifiable individual the moment a business collects or uses it — not a novel legal category invented for AI.
Key takeaways
PIPEDA does not need a special category for biometric or voice data — its general definition already reaches it: “personal information means information about an identifiable individual.” (laws-lois.justice.gc.ca) That triggers the statute’s ordinary purpose-and-consent machinery. Section 5(3) permits collection, use or disclosure “only for purposes that a reasonable person would consider are appropriate in the circumstances.” (laws-lois.justice.gc.ca) Schedule 1’s Principle 2 adds that the purposes for which personal information is collected “shall be identified by the organization at or before the time the information is collected.” (laws-lois.justice.gc.ca, Schedule 1) A business recording customer calls for one stated purpose does not automatically have the right to reuse those recordings for a second, different purpose such as training a voice model — the second use needs its own identified purpose under the statute’s own wording.
Québec runs a materially different regime under Law 25. The province’s privacy regulator, the CAI, states the automated-decision rule on its own site, in French: organizations must inform a person when they are the subject of a decision based exclusively (“fondée exclusivement”) on automated processing of their personal information, no later than when they are informed of the decision, and must give them the opportunity to make representations to a staff member able to review it. (cai.gouv.qc.ca) (The description above is a plain-English paraphrase of the CAI’s French-language page, read directly this session rather than machine-translated.) A national business handling voice data cannot assume its PIPEDA-based process automatically satisfies Québec’s separate requirement — the two regimes have to be checked independently.
The same Québec page adds a second rule that reaches voice technology specifically. Where a business collects personal information using a technology with functions that identify, locate or profile the person concerned, it must inform them beforehand of the use of that technology and of the means available to activate those functions — and, in the CAI’s own words, those identifying, locating or profiling functions “ne pourront être activées par défaut” (cannot be activated by default). A voice-identification feature is exactly this kind of technology, which means a Québec-facing product cannot ship with voice-based identification switched on unless the person concerned turns it on themselves, after being told it exists.
Voice-cloning tools are commonly run by a third-party vendor, and often on infrastructure outside Canada. PIPEDA does not prohibit that on its own: the OPC’s cross-border guidance states plainly that “PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing,” and that a transfer for processing “is a ‘use’ of the information; it is not a disclosure” requiring fresh consent, provided the information is used for the purpose it was originally collected for. (priv.gc.ca) What does not travel with the data is accountability: “the transferring organization is accountable for the information in the hands of the organization to which it has been transferred,” primarily “through contract,” and the same guidance is blunt that “no contract can override the criminal, national security or any other laws of the country to which the information has been transferred.” A business choosing a voice-cloning vendor is choosing which country’s laws its customers’ voice data becomes subject to, whatever the contract says.
Canada’s telecommunications regulator, the CRTC, separately governs telemarketing calls that use a synthesized voice message under its own Unsolicited Telecommunications Rules. That page could not be independently re-fetched in this session — crtc.gc.ca returned a Cloudflare access challenge across every attempt — so its specific consent mechanics are not reproduced here. Anyone relying on the detail of that rule should check crtc.gc.ca directly rather than take it secondhand from any source, including this one.
As the companion piece on deepfakes and Canadian law sets out, no dedicated Canadian statute names voice cloning. Two ordinary mechanisms still apply. First, PIPEDA’s own definition of a “breach of security safeguards” covers “the loss of, unauthorized access to or unauthorized disclosure of personal information” — if a business’s stored voice recordings are accessed or leaked and then cloned from, that triggers the statute’s breach obligations regardless of what happens to the clone afterward. Second, where a cloned voice is used to impersonate a business’s own spokesperson and creates confusion about the source of the message, the same passing-off analysis in the companion piece applies to a voice exactly as it applies to a video.
A financial-services call centre records customer calls for “quality assurance,” and a vendor proposes reusing those recordings to train a voice-authentication model. Under section 5(3) and Schedule 1’s identifying-purposes principle, that second use needs its own identified purpose — “quality assurance,” on its plain wording, does not obviously cover “train a biometric voice model.” If the business operates in Québec as well, it also has to check Law 25’s separate automated-decision notice requirement independently, because satisfying PIPEDA does not automatically satisfy Québec’s regime. The reasonable reading of both statutes is that the business should go back to affected customers for that specific new purpose rather than treat consent already on file as sufficient.
Related: the same statutes applied to video and image impersonation, how confidentiality duties interact with sending data to an AI vendor, why federal, provincial and sector rules move independently
No, and it doesn’t need to. Its definition of personal information — “information about an identifiable individual” — already covers a voice recording, so the statute’s ordinary purpose and consent rules apply without any AI-specific provision.
No. Law 25’s automated-decision notice-and-review right is a separate, Québec-specific mechanism, distinct from PIPEDA’s general consent framework. A business operating in both needs to satisfy each independently.
PIPEDA does not prohibit that transfer, but the transferring organization stays accountable for the information; the primary means of meeting that duty is through the contract with the processor, and any resulting breach still has to be reported under the same rules as a domestic one.
Checking how voice or biometric data was collected and consented to is part of evaluating any AI-enabled target or vendor.
