The meeting starts, and the participant list has one name too many: "Notetaker". Someone on your team connected their calendar to Otter, Fireflies or a similar tool, and the bot can now invite itself to every call. It listens, records, transcribes, then emails a summary. The client on the other side never opened an account with that vendor.
When we handle website security and compliance for a small business, the question arrives as "is this legal?". It hides two questions. The Criminal Code says whether you may record. Quebec's private-sector privacy Act (Law 25, for short) says what your business must do with the recording. The first one takes a paragraph.
The short answer, for the busy
In Canada, recording a meeting you take part in is not a crime: section 184 of the Criminal Code exempts a person who has the consent of the originator of the communication or of the person it is intended for, and, in our reading, a participant is one or the other. The Criminal Code only deals with interception, though. Once an AI note taker such as Otter, Fireflies or Plaud records a meeting for a Quebec business, the Act respecting the protection of personal information in the private sector applies to every participant's voice and words. The business must set its purposes before collecting, tell each person those purposes, the means used and that the information may leave Quebec, carry out a privacy impact assessment before handing recordings to a vendor based in the United States, bind that vendor with a written contract, and destroy the transcript once the purposes are achieved. The client on the call agreed to nothing: informing them is your job.
Two laws, two questions
Section 184 of the Criminal Code makes it an offence to use a device to knowingly intercept "a private communication". Under section 183, intercepting includes listening to or recording. Subsection 184(2) exempts a person who has the consent, "express or implied", of the originator or of the intended recipient. This is the one-party consent rule, which we read this way: a participant who records their own meeting commits no offence.
The vendor is a third party that keeps the conversation on its servers. In the United States, In re Otter.AI Privacy Litigation, filed in August 2025 in the federal court for the Northern District of California, is about exactly that: the plaintiffs allege that Otter's assistant joins meetings without the consent of every participant and that the company trains its models on the conversations. The US federal wiretap statute removes the one-party exemption when the interception serves a criminal or tortious purpose, and on August 13, 2026, ruling on Otter's motion to dismiss, Judge Eumi K. Lee declined to throw out that claim. At this stage the court takes the allegations as true without deciding the merits, and US law is not ours. The lesson still holds, in our reading: the consent of whoever plugs in the tool does little to cover what the vendor does with the conversation afterwards.
Law 25 asks a different question. It applies to personal information whatever its form, sound included (section 1). A recorded meeting holds voices, names and opinions about people: see our article on personal information edge cases.
Who is collecting, exactly?
The vendors hand the question back to you. Otter's privacy policy (effective June 16, 2026) makes the enterprise customer the data controller under an Otter Business agreement, and asks users to "make sure you have the necessary permissions" from co-workers and other third parties before sharing an audio recording. Fireflies' policy (updated September 28, 2026) tells a participant without an account to "reach out to the meeting host to request deletion of the meeting recording."
The host is your business. It must set its purposes before collecting (section 4), collect only what is necessary (section 5) and, at the time of collection, tell each person the purposes, the means, their rights, which third parties will receive the information and whether it may be communicated outside Quebec (section 8). Spotting the bot when the call opens does not meet that obligation.
A technical detail makes it heavier. Otter files its speaker identification information alongside biometric information, and Fireflies writes that the voice characteristics extracted to tell speakers apart may be considered biometric in some jurisdictions. In our reading, a technology that recognizes who is speaking falls under section 8.1: the person must be told in advance that it is used and how the identification function can be activated.
Then there is the personal account. An employee who connects a free account in their own name makes Otter the data controller under its own policy, and your clients' words leave under a contract your business never signed. That is shadow AI in its textbook form.
The mandate, and model training
Law 25 lets a business hand personal information to a vendor without the people's consent when it is necessary to a mandate or a service contract (section 18.3). The written contract must set out the measures ensuring the information is used only for that mandate and not kept once it expires.
This is where training settings matter. Otter's policy lists, among its purposes, "training our proprietary AI technology on de-identified audio recordings and on transcriptions (which may contain Personal Information)", and it shares data with data labeling providers. Fireflies states: "We do not use personal information for AI model training", and says it prohibits its vendors from doing so by contract. Plaud's policy (updated June 16, 2026) commits never to train models on your content without your "explicit and informed consent in advance." In our reading, a vendor that reuses your meetings to improve its product steps outside section 18.3, which limits use to the mandate. You would then need every participant's consent.
The servers are in the United States
Otter, a Delaware company, names Amazon Web Services in the United States among its cloud providers. Fireflies processes data on servers in the United States and other countries. Plaud lists servers in the United States, Germany, Japan and Singapore.
Section 17 requires a privacy impact assessment before personal information is communicated outside Quebec, weighing among other things the legal framework of the destination, followed by a written agreement. The same applies when you entrust the keeping of information to a body outside Quebec, and section 3.3 already requires one for any project to acquire an information system, which in our reading includes a note-taker subscription. The full reasoning is in our article on AI agents hosted outside Quebec, and our privacy impact assessment generator produces the document.
A transcript is a document like any other
Once recorded, the meeting is information your business holds. A client can ask for a copy, and section 27 obliges you to provide it. The steps are in our article on answering an access request within 30 days: add your note-taking tool to the list of places to search.
Retention is up to you. Fireflies and Plaud say they keep account-related data for as long as the account stays active, while section 23 requires you to destroy or anonymize information once the purposes of its collection are achieved. Once the minutes are approved, the recording rarely has a reason to exist.
A tool that turns "I'll see what I can do" into "commits to delivering Friday" creates inaccurate information, which the person can have rectified (section 28). And section 11 requires information to be accurate when you use it to make a decision about the person, in a performance review for instance. A human reading the summary before it goes out solves both.
Professional secrecy does not extend to a bot
Section 9 of Quebec's Charter of human rights and freedoms protects the right to non-disclosure of confidential information, and section 60.4 of the Professional Code requires every professional to "preserve the secrecy of all confidential information that becomes known to him in the practice of his profession." When an accountant or a notary lets a bot record a client meeting, the conversation passes through the servers of a vendor bound by no such secrecy. In our view, the minimum is a tool that trains no model on conversations, under a business contract, and your professional order's opinion before adopting it. For clinics, the Collège des médecins has its own rules: see our article on AI scribes in clinics.
Plaud, or the question walks into the room
On a video call, the bot shows up in the participant list. Plaud's NotePin can be worn as a magnetic pin, a clip, a wristband or a necklace, and is sold on 20 hours of continuous recording. Plaud's desktop app can also start recording on its own when it detects that a meeting application is running.
Under the Criminal Code, the wearer is part of the conversation and can consent. In our reading, the exemption no longer covers two colleagues talking nearby, a conversation the wearer is not part of. Under Law 25, if the device is used for the business, the obligations are the same, with one more difficulty: nobody can see that recording is under way.
A short policy
Here is the rule we would suggest. Meetings are recorded only with a tool the business chose, under a business account and a contract that rules out training on our content. Auto-join is off: a person starts the recording, announces it in the invitation and at the start of the call, and stops it if anyone objects. Meetings covered by professional secrecy, disciplinary discussions and health matters are never recorded. A human reads the summary before it is sent, and the recording is deleted once the minutes are approved.
If the goal is to file meeting minutes into your CRM, that is the job of an AI agent built on your own tools. And if you already work in Google's ecosystem, see our comparison of Gemini Enterprise and a custom AI agent.
Where to start
This week: ask your team who has connected a note taker to their calendar, read the data-use page of the tool you keep and note its date, and add one sentence to your meeting invitations. If you are unsure about a setting or a clause in the vendor's contract, we can go through them with you.
This article explains legal obligations to help a small business ask the right questions; it is not legal advice. The text of the Criminal Code, Quebec's Act respecting the protection of personal information in the private sector, the Charter of human rights and freedoms, the Professional Code and each vendor's policy as of the date you read it prevail: for a specific situation, consult a lawyer or your professional order.
Written byXavier Peich