Canadian Legal Alerts, October 2026: AI Governance, Voiceprints, Dark Patterns and the Clearview AI Ruling

October was not the month Canada passed a new AI law. It was the month regulators showed they do not need one. Between Ottawa, Gatineau and Quebec City, seven developments quietly moved the compliance baseline for any organization that builds, buys or deploys technology touching personal information.

A National AI Council that sits next to the Prime Minister

On October 2, 2026, the Prime Minister launched the Prime Minister's National Council on Artificial Intelligence.¹ Its mandate is to give independent, practical advice on the evolution of AI for All, the national AI strategy announced in June. It will focus on accelerating adoption, fostering national champions and building sovereign AI infrastructure. Its members include researchers, investors, entrepreneurs, former senior public servants and specialists in AI safety and governance.

The novelty is less the idea than where the council sits. Canada has had an Advisory Council on Artificial Intelligence since 2019, which advises through Innovation, Science and Economic Development Canada (ISED).² The new council does not replace it; ISED describes it as complementary.

What changes is the proximity to power. The new council is supported by a small team within the Privy Council Office, the department that serves the Prime Minister and Cabinet. Responsible ministers keep accountability for policy decisions. In plain terms, AI advice now goes to the centre of government, not only through a single department.

The legislative picture explains why this matters. The Artificial Intelligence and Data Act, proposed in Part 3 of Bill C-27, would have regulated high impact AI systems directly. It died on the Order Paper in January 2025.³ Its successor on privacy, Bill C-36, was tabled in June 2026 without a standalone AI statute.⁴ Instead, it imposes transparency obligations on automated decision systems that make predictions, recommendations or decisions about individuals. Online harms are addressed separately in Bill C-34.⁵

The result is an AI framework spread across privacy law, online safety law, procurement and strategy, with no single AI regulator. For businesses, federal AI policy will be shaped by procurement, infrastructure and adoption incentives at least as much as by prohibitions. A council at the centre of government is useful precisely because it can connect those pieces. Its value will depend on two things: whether its advice is published, and whether governance experts carry as much weight as growth targets.

The Competition Bureau: there is no AI exception

On October 5, 2026, the Competition Bureau published its submission to ISED's consultation on AI transparency.⁶ The Bureau proposed three principles. Transparency should support competitive markets, obligations should be proportionate, and regulation should target harms rather than technologies.

Two points deserve attention. First, the Bureau warned that prescriptive or costly disclosure rules can burden smaller firms and new entrants more heavily than incumbents. That would turn a consumer protection measure into a barrier to entry.

Second, the Bureau stated plainly that there is no AI exception to the Competition Act.⁷ An AI generated claim that misleads a consumer is analyzed like any other representation under the deceptive marketing provisions. Founders who assume AI marketing sits in a regulatory grey zone should recalibrate.

The Privacy Commissioner changes how complaints end

Privacy Commissioner Philippe Dufresne spoke at the Ontario Bar Association Privacy Law Summit on October 8, 2026.⁸ He described how his Office is adapting to an 82 percent jump in complaints over the previous fiscal year. The headline is a new complaint outcome called "action warranted." The Office no longer has to decide whether the Personal Information Protection and Electronic Documents Act (PIPEDA) was contravened. It can instead tell an organization that it must review the issue and, if needed, bring itself into compliance.⁹

This sits alongside a wider toolkit:

• compliance letters, in which organizations commit to specific measures on a timeline while the investigation stays open;
• proactive engagement with entire sectors;
• more frequent use of the power to decline or discontinue complaints.

The Commissioner also pointed to recent findings that generative AI products had been launched or trained in ways that did not comply with Canadian privacy law.

Softer tools do not mean softer consequences. An "action warranted" letter creates a documented record that the regulator flagged a problem. That record will matter in litigation, in due diligence and under any future penalty regime.

That regime is coming. Bill C-36 would replace PIPEDA's private sector rules and transfer enforcement to a new Digital Safety and Data Protection Commission with powers to issue orders and penalties.⁴ The Commissioner welcomed most of the Bill and will make recommendations to Parliament.

Voiceprints are biometrics, even when the call is "for quality purposes"

On October 8, the Office of the Privacy Commissioner (OPC) updated its guidance on recording customer calls.¹⁰ The key change concerns voiceprints, the uniquely identifying voice characteristics some organizations use to authenticate callers. The OPC now describes them as sensitive biometric information. It states that express consent may be required where a recording involves them.

The guidance is sharper than the familiar "this call may be recorded" script suggests:

• The stated purpose must be as narrow as possible.
• An organization should not cite quality assurance if the recording will feed marketing, profiling or authentication.
• Where recording is not integral to the service, customers must be offered an alternative.
• Outsourcing does not move the obligation. A business using a call centre or telemarketer must ensure the provider follows the rules.

Quebec organizations have a second layer to check. Under Quebec's Act to establish a legal framework for information technology, verifying identity through biometric characteristics requires express consent. Creating a biometric database must also be disclosed to the Commission d'accès à l'information in advance.¹¹ Biometric information is also sensitive under Quebec's private sector privacy act, which requires express consent for its use.¹²

If your voice authentication vendor arrived through a procurement process rather than a privacy review, this is a good month to revisit it.

A Children's Privacy Code that previews future investigations

On October 20, the OPC released Canada's first Children's Privacy Code.¹³ It explains how existing federal law applies to children's and teens' information. Organizations are expected to:

• obtain meaningful consent, including parental consent for children under 13 and opt in consent for non essential uses;
• write privacy information in age appropriate language;
• offer practical correction and deletion;
• avoid profiling children for marketing or AI driven decisions;
• turn location tracking, profile visibility and third party sharing off by default.

The Code also names deceptive design that pushes children to share more than necessary as inappropriate.

The Code is guidance, not regulation. In practice, it is the yardstick the OPC will use in its next investigation. Quebec already sets a higher age threshold. Its private sector act requires parental consent to collect information from a minor under 14, unless the collection is clearly for the minor's benefit.¹² Platforms operating nationally should design to the stricter threshold. Comments on the Code are open until January 20, 2027.

Clearview AI: Quebec law follows the data, not the office

On October 16, 2026, the Commission d'accès à l'information (CAI) reported that the Court of Québec had upheld its December 2021 order against Clearview AI.¹⁴ The company built a facial recognition database from billions of images collected online. It sold search access to clients, including police services. The CAI had ordered it to stop collecting Quebecers' information and to destroy their images and biometric identifiers.

Clearview argued that Quebec law could not apply to a U.S. company with no office, employee or client in Quebec since July 2020. The Court disagreed on every point it decided:

• It found a real and substantial connection with the province, so Quebec law applies.
• It held that collecting images in breach of the law cannot amount to a serious and legitimate interest.
• It held that the consent requirements did not unjustifiably limit freedom of expression.

The lesson reaches well beyond facial recognition. Any organization that scrapes, buys or trains on data about Quebec residents should assume Quebec law applies, wherever its servers or staff sit. "Publicly available online" is not a legal basis in Quebec, and a foreign corporate structure is not a shield.

Dark patterns can void consent in Quebec

On October 22, the CAI published a guidance page on deceptive design, which it calls "interfaces truquées."¹⁵ It cites a 2024 international sweep, conducted with other privacy authorities, that found deceptive design patterns on 97 percent of websites reviewed.¹⁶ The CAI groups them into five families:

• interference, such as false hierarchy, preselected options and emotional manipulation;
• nagging;
• obstruction;
• complex and confusing language;
• forced action.

The legal consequence is what matters. Quebec requires consent that is manifest, free, informed and specific.¹² The CAI states that a design which makes "accept" easier than "refuse" could invalidate consent. Every later use or disclosure of that information would then be unlawful.

Quebec law also requires the highest level of confidentiality by default. Technologies that identify, locate or profile a person must stay off unless the person activates them.¹² The CAI names cookie banners, privacy settings and privacy policies as the places to look first.

The CAI also reminds organizations that tools bought from vendors must be configured lawfully. That includes software development kits, content management systems and consent management platforms. A default setting chosen by your vendor is still your compliance decision. Product, design and legal teams should review consent flows together, because a regulator will read your interface the way a user experiences it, not the way your policy describes it.

The pattern behind the alerts

Read together, October's alerts share a thread. Canada still has no comprehensive AI statute, and federal privacy reform is still at second reading. Yet regulators are not waiting. They are using guidance, complaint outcomes, consultation submissions and court victories to set expectations. Those expectations will be very hard to argue against once new enforcement powers arrive.

Three questions are worth putting on the next leadership or product agenda:

• Where do we collect biometric or children's information without having labelled it as such?
• Would our consent screens survive a regulator reading them as a user would?
• If a regulator sent us an "action warranted" letter tomorrow, who owns the answer?

This article provides general information and does not constitute legal advice.