AI voice agents and Law 25: what to know

Published July 12, 2026 · Updated October 14, 2026

What does Law 25 provide for an AI voice agent?

Law 25 amends the Act respecting the protection of personal information in the private sector, published by Légis Québec (current to August 12, 2026, in French). Here is what touches an AI voice agent, with the sections of the act.

• Informing the caller of the purposes and means of collection, including recording (section 8)
• Consent that is manifest, free, informed and given for specific purposes (section 14)
• Privacy impact assessment and written agreement before any transfer outside Quebec (section 17)
• Destruction or anonymization of information once its purposes are fulfilled (section 23)
• The person’s rights of access, rectification and withdrawal of consent

When must you inform the caller and obtain consent?

From collection onward, so at the start of the call. A recording notice at the start of the call tells the caller that the call is recorded and why, which documents the information given. The act states that consent is requested for each purpose, in simple and clear terms. Plan another way to serve the caller, such as a transfer to a person, if they decline.

What does the law say about transfers outside Quebec?

It does not forbid them. Before disclosing personal information outside Quebec, the business must assess the sensitivity of the information, the purpose of its use, the protection measures, including contractual ones, and the legal regime of the state where it would go. The disclosure may take place if the assessment shows adequate protection, and it is covered by a written agreement. The same rule applies when the business entrusts a third party outside Quebec with collecting, using or keeping the information. The Commission d’accès à l’information notes that this assessment has been mandatory since September 2023.

What does a call contain, from the law’s point of view?

A call can contain a name, a phone number, an address, the reason for the call and, depending on the industry, health or financial information. The voice and the transcript of a call can also identify a person: they are then personal information. The more the agent collects, the more the framing matters, so limit what it asks to what is necessary.

Where does information go with ATOM Assistant?

What should you ask an AI voice agent provider?

• Where the AI reasoning, voice, audio and transcripts are processed, and by which subprocessors
• Which assessment and written agreement each transfer outside Quebec rests on
• Whether the recording notice is configurable
• What retention period applies, and how to export or delete the data
• What procedure follows a confidentiality incident

Who is responsible for compliance in your business?

By default, the person with the highest authority in the business is responsible for the protection of personal information. They may delegate the function in writing, and the title and contact details of the person in charge must be published on the business’s website. That person answers access and rectification requests within 30 days. Entrusting calls to an AI voice agent provider changes nothing: the business remains responsible for its obligations in a confidentiality incident, including keeping a register.

The comparison of AI voice agents in Quebec records what Voxify, Ask Benny, Dialbox, Smith.ai, Soluvox and Communication LGP publish on the subject. For the vocabulary, see the definitions of Law 25 and cloned voice, then the AI voice agent page. To know what to say to the caller, see the guide Do you have to tell callers they’re speaking to an AI?, and for the analysis required before a transfer outside Quebec, the definition of privacy impact assessment.