Last updated 2026-07-09
TL;DR
Under the FTC's Telemarketing Sales Rule, an established business relationship (EBR) lets a seller call a customer without prior express consent for up to 18 months after a purchase, payment, or delivery, or 3 months after a consumer-initiated inquiry. The exemption has hard limits: it never overrides a do-not-call request, it does not transfer to affiliated companies without clear disclosure, and it does nothing for the TCPA's wireless rules.
What is the established business relationship exemption under the Telemarketing Sales Rule?
The established business relationship exemption lets a seller call a consumer whose number sits on the National Do Not Call Registry, as long as the two of them already have a real relationship and the call falls inside the time limits. It is the main escape hatch from the DNC rules.
The Telemarketing Sales Rule (TSR), run by the Federal Trade Commission, generally bars telemarketers from calling any number on the Registry [1]. The EBR exemption is the carveout that keeps you from having to treat your own customers like strangers.
The definition has two branches. The first covers a relationship from a purchase, rental, or lease of goods or services. That relationship lasts 18 months from the date of the transaction, most recent payment, or delivery, whichever is latest. The second covers a consumer who makes an inquiry or application to the seller. That one lasts 3 months from the date of the inquiry [2].
These are not soft guidelines. They are codified at 16 CFR Part 310, and the FTC enforces them directly. Miss either window by one day and you are outside the exemption entirely.
Here is what trips up a lot of teams. The TSR EBR is a federal floor, not a ceiling. States can go stricter, and several do. Florida has its own telemarketing act with a narrower EBR. Check the state layer before you lean on this exemption.
How long does an established business relationship last for TSR purposes?
Two windows run the whole show. A purchase-based EBR lasts 18 months from the last transaction, payment, or delivery. An inquiry-based EBR lasts 3 months from the date of the inquiry. A written do-not-call request ends either one on the spot [2].
| Relationship trigger | EBR window |
|---|---|
| Purchase, rental, or lease of goods or services | 18 months from date of last transaction, payment, or delivery |
| Consumer-initiated inquiry or application | 3 months from date of inquiry |
| Written do-not-call request from consumer | EBR expires immediately, regardless of time remaining |
The 18-month clock runs from the most recent event, not the first one. A customer who bought in January 2023 and again in November 2024 gives you a window that runs until May 2026. Each purchase resets the timer.
The 3-month inquiry window is much shorter, and it surprises sales teams constantly. Someone fills out a contact form, requests a quote, or calls your inbound line with a question, and you have 90 days to reach them under the EBR. After that, they need to be on your opt-in list or you need another legal basis. Plenty of lead gen shops burn through the window without noticing [2].
A written do-not-call request ends the EBR immediately. The rule at 16 CFR 310.4(b)(1)(iii)(B) is blunt: even with a valid EBR, a seller may not call a person who has asked to be put on the seller's internal do-not-call list [2]. Honor that request within 30 days and keep the record for at least 5 years.
Make your CRM timestamp every transaction and every inquiry. If the FTC comes knocking, or a plaintiff does, that timestamp data is how you prove the EBR was alive on the date of each call.
Does the TSR established business relationship apply to the National Do Not Call Registry?
Yes, but only as a narrow carveout. The EBR lets you call your own active customers inside the 18- and 3-month windows even though their numbers sit on the Registry. It does not erase the DNC registration itself. The consumer stays on the list. You are just allowed to call anyway because of the relationship.
The National DNC Registry, run by the FTC, holds the numbers of consumers who opted out of telemarketing from companies they have no relationship with [1]. The moment your relationship expires, or the moment they send a written do-not-call request, you go right back to treating them like any other Registry number.
Sellers keep confusing the EBR with permission to call past customers forever. It is not that. A customer who bought from you four years ago and sits on the Registry is off-limits unless you have separate prior express written consent. For cold calling teams that recycle old CRM data, this is where the expensive mistakes live.
The FTC requires sellers to access the Registry at least every 31 days and drop any number that no longer qualifies under the EBR [1]. Wait 60 days between scrubs and you could be dialing Registry numbers without a valid EBR, which is a violation even if those people were once customers.
Does an established business relationship transfer to affiliated companies or subsidiaries?
Sometimes, but only under conditions most companies never actually meet. The EBR can extend to a seller's affiliates, and that is where a lot of corporate structures assume too much.
Under 16 CFR 310.2(n), the EBR reaches an affiliated business only if two things are true: the consumer would reasonably expect calls from that affiliate given the nature of the original transaction, AND the seller clearly disclosed that the relationship would extend to those affiliates [2]. Both conditions, not one.
In practice, very few companies satisfy the disclosure requirement. Burying it in terms-of-service language nobody reads probably does not count. The FTC has been skeptical of broad disclosure arguments in enforcement. If your structure relies on EBR transfer between subsidiaries or related companies, you need explicit, clear disclosure at the time of the original transaction, and you should have a lawyer confirm your disclosure actually holds up.
Lead generation businesses that sell leads to multiple buyers face a harder version of the problem. A consumer's EBR with Company A does not become an EBR for Company B just because A sold B the lead. The EBR belongs to the seller the consumer actually transacted with. Third-party buyers need their own consent or their own independent EBR.
How does the TSR established business relationship differ from the TCPA's EBR rule?
They share a name and almost nothing else. The TSR and the TCPA both use the phrase 'established business relationship,' but they are separate laws with different EBR definitions and different enforcement. Confusing them is a costly mistake.
The TCPA is a federal statute enforced by the FCC and through private lawsuits [3]. For residential wireline calls, the FCC historically recognized an EBR that looked a lot like the FTC's version. But for calls and texts to cell numbers, the TCPA requires prior express written consent no matter what EBR you have. The EBR does not apply to autodialed or prerecorded calls to cell phones. Period.
The FCC settled this in its 2012 Report and Order (FCC 12-21), which killed the EBR exception for autodialed or prerecorded calls to cell numbers [4]. The order took effect October 16, 2013. Most people now use cell phones as their main line, so teams that leaned on EBR for TCPA compliance on mobile outreach have been exposed since 2013.
The TSR EBR, by contrast, covers calls to Registry numbers, and the Registry holds both landlines and cell numbers. So you might have a valid TSR EBR that lets you call a customer's cell number on the Registry, and still be barred from using an autodialer or prerecorded voice for that same call without separate TCPA written consent [10]. The two rules run in parallel. You comply with both at once or you comply with neither.
For a wider breakdown of cold call compliance, the cold calling definition guide walks through how these layers stack.
Does the telemarketing sales rule EBR apply to business-to-business calls?
Mostly no, because the EBR framework lives in the business-to-consumer world. The National DNC Registry protects consumers, so the EBR windows matter far less for true B2B outreach. But the TSR does not hand B2B calls a blanket pass.
The telemarketing sales rule business-to-business exemption is narrower than sales teams assume. It exempts calls to businesses that result in a sale or transaction to that business, as long as the goods or services are for the business's own use rather than resale to consumers [5]. The rest of the TSR still bites: no fraud, no misrepresentation, no unauthorized billing, and the upsell rules still apply.
B2B calls do not require DNC Registry scrubbing the way consumer calls do. The Registry is a consumer tool. A business listing its number generally does not get the protection a residential number does. So for real B2B outreach, the EBR is largely beside the point, because your DNC obligations were limited to begin with.
The mess starts with mixed-use numbers. A sole proprietor using a personal cell for business. A home-based operation. The FTC looks at how the number is primarily used. Primarily personal means consumer protections apply. When you are unsure, treat the number as a consumer number. That is the safer default every time.
For teams building cold calling scripts for B2B outreach, the sharper compliance question is usually do-not-contact list maintenance and state registration, not the federal EBR.
What records do you need to prove an established business relationship under the TSR?
You need to show a valid EBR existed on the date of every call you made to a Registry number. That means records, not memory. If the FTC investigates, or a private plaintiff sues, your timestamped data is the whole case.
At a minimum:
1. A timestamped record of the transaction or inquiry that started the EBR. A date-stamped order confirmation, payment record, or inquiry log. CRM screenshots work if they carry the date.
2. A clear method for calculating expiration dates. Most teams add a CRM field that sets EBR expiration at 18 months from the last transaction date. Automate it. Manual math does not scale.
3. A log of every written do-not-call request and the date you honored it. The TSR requires you to honor these within 30 days and keep the record for 5 years [2].
4. DNC scrub records showing you checked your list against the Registry within the past 31 days before each campaign.
The FTC has subpoenaed CRM exports and dialer logs going back years in past enforcement. Incomplete or inconsistent records get treated as evidence against you. Good recordkeeping is not a nicety here. It is the defense.
LeadCompliant's free compliance kit includes an EBR tracking template and a DNC scrub log format that match the documentation FTC investigators tend to request. Worth grabbing before you need it.
What happens if you call someone after the EBR window expires?
Calling a Registry number after the EBR expires is a TSR violation, and each call counts separately. The civil penalty runs up to $51,744 per violation as of the FTC's most recent inflation adjustment [6]. A dialer campaign that hits 1,000 expired-EBR numbers in a single day carries theoretical exposure north of $50 million.
FTC enforcement over DNC and expired-EBR calls has produced settlements in the millions. A 2022 action against a home security company ended in a $7.5 million settlement for, among other things, calling Registry numbers without a valid EBR or consent [7]. Not hypothetical. The FTC works consumer DNC complaints hard and escalates from warning to lawsuit quickly.
Private plaintiffs can sue under state law too. Florida, Oklahoma, and others give consumers a private right of action for state telemarketing violations that track the DNC and EBR framework. Some carry per-call statutory damages of $500 to $1,500, in the same neighborhood as the TCPA's private right of action.
The practical move is boring and effective: build a 30-day buffer before the EBR expires. Do not run campaigns at the edge of the 18-month window without double-checking dates. When a contact nears expiration, ask for written consent before the window closes. Consent you obtain on purpose is far safer than one call placed one day late.
How does the inquiry-based EBR work for inbound leads and lead generation?
The 3-month inquiry window causes more confusion in lead gen than any other part of the rule. When a consumer submits a form, calls your inbound line, or messages you for information, that inquiry starts a 3-month EBR clock for the company that received it. The company that received it. That phrase is doing all the work.
For companies buying leads from third-party generators, this gets ugly fast. A consumer submits a form on a lead gen website, and that form gets sold to your company within seconds. Do you have an EBR? Generally, no. The EBR sits between the consumer and the company they actually contacted. If the consumer never contacted you directly, the third party's inquiry does not give you an EBR.
The FTC's guidance is direct on this point: the EBR under the TSR attaches to the entity the consumer actually did business with or inquired with, not to downstream buyers of that consumer's data [5].
Lead gen companies that aggregate inquiries and sell them across buyers should not tell those buyers an EBR exists. Buyers should treat third-party leads as needing independent consent unless they can document the inquiry was specifically directed to them.
For teams using AI cold calling tools on aged leads, this matters a lot. Aged leads (more than 90 days old, sourced through a third-party form) almost never carry a valid EBR for the buyer. Assume they do not. Get written consent before you call.
Can a consumer revoke an established business relationship?
Yes, and immediately. A consumer ends the EBR any time by making a written do-not-call request. The TSR at 16 CFR 310.4(b)(1)(iii)(B) requires the seller to honor it within 30 days and keep it on an internal do-not-call list for at least 5 years [2].
The request does not have to take any set format. An email saying 'stop calling me' likely qualifies. A letter, a text message, a note left with a service rep, any of these can count as a written request depending on how broadly a court or the FTC reads 'written.' The safe approach: treat any explicit opt-out from any channel as a do-not-call request and honor it right away.
Once a consumer revokes this way, no new purchase or inquiry resets the DNC status unless the consumer affirmatively asks to hear from you again. A later purchase alone does not override a prior written DNC request, at least not without clear evidence the consumer changed their mind about being contacted.
For what is cold calling in sales teams working out of a CRM, the internal DNC flag should be the first thing any rep checks before an outbound attempt. EBR status and DNC status are two separate fields. Both have to be clear before the call goes out.
What does the TSR established business relationship not cover?
The limits matter as much as the permissions. Here is what the EBR flatly does not cover.
Autodialed or prerecorded calls to cell phones under the TCPA. The FCC killed that carveout in 2013 [4]. TSR EBR and TCPA cell phone consent are separate questions with separate answers.
Calls outside the 18-month or 3-month windows. No rounding up, no grace period, no informal extension.
Registry numbers where the consumer sent a written DNC request to you specifically, even if the general EBR clock is still running.
Leads bought from third parties where the consumer never inquired with or transacted with you.
Affiliated company calls, unless the affiliation was clearly disclosed to the consumer at the time of the original transaction.
Calls about products or services unrelated to the original transaction or inquiry. The FTC treats the EBR as contextual. A consumer who bought a car warranty from you has an EBR for warranty calls, not for an unrelated home security pitch from a subsidiary.
Fraudulent or deceptive calls, regardless of EBR status. The EBR is not a license to lie.
For teams building a full process around their cold call workflows, mapping each of these exclusions to your actual calling activity is the right first move.
How should small outbound teams operationalize EBR compliance?
Build EBR management into your tools, not into the judgment of whoever is on the dialer floor. Small teams rarely have a dedicated compliance officer, so the process has to run itself.
Here is the setup that works for most teams under 50 reps.
First, add two fields to every contact record: EBR start date (the last transaction or inquiry) and EBR expiration date (auto-calculated as 18 or 3 months out). Filter out any contact whose expiration date has passed and who has no documented written consent.
Second, scrub against the National Registry at least every 31 days. Drop any registered number without a live EBR or documented prior express written consent. The FTC runs the official access point at the National Do Not Call Registry website [1].
Third, build a written DNC request workflow. Any rep who gets an opt-out in any format should be able to flag it in the CRM within minutes. That flag suppresses the contact from all outbound campaigns immediately, with a timestamp.
Fourth, document every scrub. A spreadsheet log with date, list size, and method is the floor. If you get audited, that log proves you ran a compliant process.
LeadCompliant offers a free DNC number checker and a one-time compliance kit with EBR tracking templates, scrub log formats, and written consent examples. Practical tools, not legal advice.
Nobody runs a perfect process on the first try. A documented imperfect process beats an undocumented one every time, because documentation shows intent to comply, and that matters to regulators and courts alike.
Frequently asked questions
Does an established business relationship under the TSR expire if the customer does not buy again?
Yes. The EBR clock runs 18 months from the most recent transaction, payment, or delivery. If a customer bought once and never again, the EBR expires 18 months after that single purchase. Nothing extends it without a new transaction or inquiry. After expiration, if their number is on the National DNC Registry, you cannot call them without separate written consent.
Does the TSR established business relationship apply to text messages?
The TSR EBR applies to telemarketing calls, which the FTC has read to include certain commercial texts. But texts to cell phones also fall under the TCPA, which has stricter consent rules and recognizes no EBR exemption for autodialed or prerecorded texts to mobile numbers. In practice, for any compliant SMS campaign to cell numbers, rely on TCPA written consent, not EBR.
Can a company share an established business relationship with a partner company?
Only if the original seller clearly disclosed to the consumer that calls from the partner would be part of the relationship, and the consumer would reasonably expect those calls. The TSR allows EBR extension to affiliates under 16 CFR 310.2(n), but the disclosure requirement is strict. Vague terms-of-service language is unlikely to satisfy it. Lead buyers who receive transferred leads generally cannot claim the original company's EBR.
What counts as a written do-not-call request that kills the EBR?
The TSR requires the seller to honor any consumer request not to receive outbound calls. The FTC has not defined 'written' narrowly, so an email, letter, or documented verbal request logged in your system likely qualifies. Honor it within 30 days, flag the contact, and keep the record for 5 years. A later purchase does not automatically override a prior DNC request.
Does the EBR exemption protect a seller from TCPA class action lawsuits?
No. The TSR EBR is an FTC-enforced exemption from DNC Registry obligations. The TCPA is a separate statute enforced by the FCC and through private lawsuits. The TCPA eliminated the EBR exemption for autodialed or prerecorded calls to cell phones in 2013. TSR EBR compliance gives you no defense in a TCPA class action about cell phone calls made with an autodialer.
How often do you need to scrub your call list against the National DNC Registry?
The TSR requires sellers to access the Registry at least every 31 days and remove any number that is registered and lacks a valid EBR or written consent. Miss a scrub cycle and you could call Registry numbers with no legal basis, which is a per-call violation carrying civil penalties up to $51,744 per call as of the FTC's current penalty schedule.
Does a customer inquiry from a third-party website count as an inquiry for EBR purposes?
Generally, no. The EBR attaches to the company the consumer directly inquired with. If a consumer filled out a form on a lead aggregator's website, the aggregator may have an EBR; the company that buys that lead does not, unless the consumer specifically directed the inquiry to that buyer. Third-party lead buyers should get independent prior express written consent rather than lean on an EBR they never earned.
What is the civil penalty for violating the National DNC Registry rules under the TSR?
The FTC can impose civil penalties up to $51,744 per violation, with each call counting separately. That figure is adjusted periodically under the Federal Civil Penalties Inflation Adjustment Act. Large campaigns calling thousands of Registry numbers with expired or nonexistent EBRs can generate nine-figure theoretical exposure, and real FTC settlements have reached millions of dollars.
Are there states with stricter EBR rules than the federal TSR?
Yes. Several states have telemarketing laws with shorter EBR windows or added conditions. Florida's Telemarketing Act is a common example. Some states define the inquiry window more narrowly or require state-specific DNC registration on top of the federal Registry. California's consumer privacy laws add another layer around certain contact practices. Check the law for every state where your targets live, more than the federal TSR.
Can the EBR clock reset with a subscription renewal or recurring payment?
Yes. The TSR measures the 18-month window from the 'most recent payment' in an ongoing relationship. A recurring subscription payment resets the clock each time a payment processes, as long as the underlying relationship is genuine and not manufactured just to extend EBR status. Document each payment date in your CRM so the most recent reset is always traceable.
Does the TSR EBR apply to nonprofits or charities making fundraising calls?
Charitable solicitation calls are largely exempt from the TSR itself under 16 CFR 310.6(a), so the EBR framework is less directly relevant to pure fundraising. But if a for-profit telemarketer is hired to make fundraising calls for a charity, TSR rules apply to that telemarketer. The charity's own relationship with a donor is a separate question governed by its exemption status, not the EBR rule.
How does the TSR EBR interact with state do-not-call lists?
State DNC lists are separate from the National Registry, and a consumer can sit on both. The TSR EBR is a federal exemption that applies to the National Registry. State EBR rules vary: some mirror the federal standard, some go stricter. You must comply with both the federal TSR and any applicable state law at once. A valid TSR EBR does not automatically create an exemption under a state's own DNC rules.
What is the difference between established business relationship and prior express written consent for TSR purposes?
The EBR is a relationship-based exemption that expires. Prior express written consent is a consumer-granted permission that does not expire unless revoked. The EBR lets you call a past customer for a limited window without separate consent. Written consent gives you an ongoing basis to call beyond that window. For long-term customer outreach, a consent-based list is far more durable than relying on the EBR alone.
Sources
- FTC, National Do Not Call Registry (donotcall.gov): The National DNC Registry prohibits telemarketers from calling registered numbers without a valid exemption such as EBR; sellers must scrub lists every 31 days
- FTC, Telemarketing Sales Rule, 16 CFR Part 310: EBR under TSR is 18 months from last transaction or 3 months from inquiry; written DNC requests must be honored within 30 days and records kept 5 years; definition at 16 CFR 310.2(n)
- FTC, Complying with the Telemarketing Sales Rule: TSR EBR attaches to the seller the consumer directly transacted with or inquired to; B2B calls to businesses for own use are treated differently under the TSR
- FTC, Penalty Offenses and Civil Penalty Amounts: Civil penalty for TSR violations including DNC Registry violations is up to $51,744 per violation as of the most recent FTC inflation adjustment
- FTC, Press Releases (2022 home security telemarketing action): FTC enforcement action resulted in a $7.5 million settlement for calls to DNC-registered numbers without valid EBR or consent
- FTC, National Do Not Call Registry (consumer information): Sellers must access the National DNC Registry at least every 31 days and are prohibited from calling registered numbers outside of valid exemptions including the EBR
- Federal Civil Penalties Inflation Adjustment Act, Public Law 101-410: FTC civil penalties are adjusted periodically under this Act, which is the basis for the current $51,744 per-violation maximum
- FCC, Rules Implementing the Telephone Consumer Protection Act, 47 CFR Part 64: The TCPA and its implementing rules at 47 CFR Part 64 govern consent requirements for calls to cell phones and are separate from TSR DNC requirements