How to argue the established business relationship TCPA defense

Last updated 2026-07-11

What is the established business relationship defense under TCPA?

The established business relationship, or EBR, is a legal exception that lets a caller contact a consumer who has previously purchased from, transacted with, or inquired of that caller, even if that consumer never gave fresh prior express consent for the specific call. The theory is simple. If someone already knows you and did business with you recently, a follow-up call is not an unwanted intrusion.

The TCPA itself does not define EBR in the statute text. The definition lives in FCC regulations. Under 47 C.F.R. § 64.1200(f)(5), an established business relationship is "a prior or existing relationship formed by a voluntary two-way communication between a person or entity and a residential subscriber with or without an exchange of consideration, on the basis of the subscriber's purchase or transaction with the entity within the eighteen (18) preceding months, or his or her inquiry or application regarding products or services offered by the entity within the three (3) preceding months" ^[1].

Two numbers matter: 18 months from a purchase or transaction, and 3 months from an inquiry. Those windows close hard. A call on day 547 after the last purchase gets no EBR shelter.

The defense started as a creature of FCC rulemaking, not Congress, and the FCC later pulled a big piece of it back. Which piece survived and which piece died is the whole game.

Did the FCC eliminate the EBR defense entirely?

Not entirely, but the most commercially useful part is gone. In its 2003 Do Not Call Implementation Order (FCC 03-153), the FCC ruled that an EBR no longer excuses a call to a residential number that appears on the National Do Not Call Registry ^[2]. That rule took effect on October 1, 2003, and the registry opened for national enrollment the same year.

The practical reality is this. If you are calling a residential landline number that sits on the federal DNC list, EBR does not save you. It does not matter that the customer bought from you last month. The opt-out of the national registry overrides the EBR.

What does survive? Two specific places. First, the FCC kept a company-specific DNC exception: if a consumer is on your internal do-not-call list, nothing saves you, EBR included. But if the consumer is only on the national registry and you have a live EBR, you can still call a number that is NOT on the national registry without fresh consent. Second, for wireless numbers called manually without an autodialer or prerecorded message, neither the autodialer prohibition in 47 U.S.C. § 227(b) nor the DNC registry rules apply the same way, so EBR arguments can still get traction in that narrow lane.

For telemarketing calls to residential numbers, the FCC's 2003 ruling retired the EBR as a meaningful shield against DNC-registered numbers. Treat it as dead for that use case.

Where does the EBR defense still have legal teeth in 2024 and 2025?

Despite its gutting for DNC-listed residential numbers, EBR arguments still turn up in TCPA litigation in a few contexts where practitioners actually rely on them.

First, some callers invoke EBR when facing claims under the residential solicitation rules in 47 C.F.R. § 64.1200(c) and (d) for numbers that were never registered on the national DNC list. If the consumer never opted onto the DNC registry, and a live EBR exists, you can call without fresh consent for up to 18 months post-purchase or 3 months post-inquiry ^[1].

Second, EBR stays relevant in state-law DNC claims where the state has written EBR language into its own statute. Several states, including Texas (Bus. & Commerce Code § 304.002) and Florida (§ 501.059, Fla. Stat.), define exceptions that look like EBR. The timelines and requirements vary by state, so the federal definition is not automatically transplanted.

Third, in class action settlement talks and pre-litigation demand responses, an EBR argument can shift the risk math even when it would not win at trial. Plaintiffs' counsel pricing a demand letter often discount for a credible EBR defense. That is real, practical value.

Fourth, for non-telemarketing calls (informational calls, transactional calls, debt collection notifications made without an autodialer), EBR concepts show up in the analysis of whether the call is a telemarketing solicitation at all. If there is no solicitation, the consent rules change.

The TCPA is worth reading in full because many practitioners confuse the autodialer prohibition in § 227(b) with the telemarketing solicitation rules in § 227(c). They have different consent standards and different defenses.

What specific records do you need to make an EBR argument hold up in court?

An EBR argument without documentation is an invitation to lose. Courts and plaintiffs' lawyers will ask for contemporaneous business records that prove three things: that a qualifying transaction or inquiry happened, the exact date it happened, and that the called party is the person who made that transaction or inquiry.

Here is what that looks like in practice.

For a purchase-based EBR, you need a timestamped transaction record (order confirmation, payment record, CRM entry), the phone number tied to that record, and evidence the transaction fell within 18 months of the call. A screenshot of a dashboard entry made after the lawsuit is filed is worth almost nothing. Courts look at metadata.

For an inquiry-based EBR, you need a web form submission log with IP address and timestamp, a recorded inbound call, an email thread, or a chat transcript. The 3-month window is short, so timestamps carry real weight. If your CRM or marketing automation purges records after 90 days, you will not have what you need.

The consumer's phone number must match. Sloppy matching (appended phone numbers from a data vendor, not the number the consumer actually gave you) creates a real vulnerability. Courts have rejected EBR claims where the number was appended by a third party rather than provided directly by the consumer in the transaction ^[3].

A table of the minimum records you should preserve:

Record type	Minimum fields to retain	Retention window
Purchase transaction	Date, amount, customer ID, phone number provided	4 years from transaction
Inbound inquiry (web)	Form timestamp, IP, phone field, page URL	4 years from inquiry
Inbound inquiry (phone)	Call recording or log, caller ID, date	4 years from inquiry
Internal DNC scrub	Date of scrub, list version used	5 years (FCC rule requirement)
National DNC scrub	Date accessed, SAN number	5 years

Four years is a practical floor because the TCPA statute of limitations is 4 years under 28 U.S.C. § 1658. The FCC's internal DNC record-keeping requirement under 47 C.F.R. § 64.1200(d)(6) says companies must keep records of do-not-call requests for at least 5 years ^[4], so align your EBR records to that same horizon.

How do courts actually evaluate an EBR defense when it is raised?

When a defendant raises EBR in a TCPA case, courts generally run a three-part inquiry. Does a qualifying prior relationship exist? Is the call inside the applicable time window? And did the consumer later opt out in a way that killed the EBR?

On the first question, courts look hard at what kind of relationship existed. A one-sided marketing email you sent to a cold list is not an EBR. The relationship must be "a voluntary two-way communication" under the FCC regulation. The consumer has to have initiated or joined a genuine transaction or inquiry ^[1].

On timing, courts are strict. In Chyba v. First Federal Credit Control, Inc., the court examined whether the relationship fell within the applicable window and found the defendant had not produced adequate records to prove the dates ^[3]. The lesson there is plain: the burden of proving the EBR sits on the defendant, not the plaintiff.

On opt-out, this is where many EBR defenses collapse. If the consumer registers on the national DNC after the initial transaction and before the call, the EBR is extinguished for solicitation calls. If the consumer told a company representative verbally or in writing to stop calling, the company-specific DNC rule applies and EBR is gone immediately. The FCC made clear in 2003 that a consumer's affirmative opt-out choice overrides any EBR ^[2].

Settlement pressure is real. Even a strong EBR defense often gets tested inside TCPA class action settlements rather than at trial, because the cost of defense itself is punishing. Building your records before litigation is your only real advantage.

Does an EBR defense work for calls to cell phones?

This is where you have to be careful. The TCPA's autodialer prohibition at 47 U.S.C. § 227(b)(1)(A) covers calls to wireless numbers using an automatic telephone dialing system (ATDS) or prerecorded voice. The consent standard there is prior express consent (for informational calls) or prior express written consent (for telemarketing calls). EBR is not listed as a defense in § 227(b). It was an FCC-created exception that applied to the residential solicitation rules, not the autodialer prohibition.

So for a TCPA claim under § 227(b) involving an autodialed or prerecorded call to a cell phone, an EBR argument will almost certainly fail because it does not map to the right part of the statute. Courts have rejected § 227(b) claims where defendants tried to use EBR as a consent substitute ^[5].

For a manually dialed, live-voice call to a cell phone, the analysis changes. If there is no ATDS involved and no prerecorded message, § 227(b) does not apply the same way. The call may still be subject to telemarketing rules if it is a solicitation, but the EBR framework can matter in assessing whether the call fits the residential solicitation rules at § 227(c).

Here is the bottom line. EBR does not replace prior express written consent for autodialed or prerecorded cell phone calls. Ever. If you are calling cell phones with any form of automated technology, EBR is not your defense. Consent documentation is. See our cold calling guide for how those rules interact with live-voice outreach.

What is the difference between an EBR defense and an internal do-not-call exemption?

These two defenses get confused, and confusing them is expensive.

The EBR is about whether you need consent to call someone you previously did business with. The internal DNC exemption is about whether a prior relationship with your company lets you call someone even if they are on the national registry. They overlap, but they are not the same thing.

Under 47 C.F.R. § 64.1200(f)(5), an EBR provides an exemption from the ban on calling numbers on the national DNC registry, but only as long as the consumer has not asked your company to stop calling ^[1]. The moment someone on your customer list says "take me off your list," EBR ends. You add them to your internal DNC list and never call them for solicitation purposes again.

The internal DNC exemption (under § 64.1200(d)) runs separately. Even with no EBR at all, you need an internal DNC list. Every company that makes telemarketing calls must keep one, must scrub against it before each call campaign, and must honor requests within 30 days. The FCC requires those records kept for 5 years ^[4].

A practical trap: sales reps sometimes think a recent purchase resets the EBR clock and cancels a prior do-not-call request. It does not. A do-not-call request persists even if the consumer buys from you again later, unless the consumer affirmatively consents in writing to receive future calls. Do not let your CRM auto-reactivate contacts after a new order without a separate consent capture.

How do you actually plead an EBR defense in a TCPA lawsuit?

If you are served with a TCPA complaint, EBR is an affirmative defense, which means you must raise it in your answer or you risk waiving it. Your answer should include something like this: "Defendant affirmatively states that any call at issue was made to a residential telephone subscriber with whom Defendant had an established business relationship, as defined by 47 C.F.R. § 64.1200(f)(5), within the applicable time periods set forth therein, and that the applicable exemption from 47 C.F.R. § 64.1200(c) applies."

Be specific about the factual basis. Boilerplate affirmative defenses with no facts behind them draw Rule 12(f) motions to strike.

In discovery, expect the plaintiff to request all CRM records for the consumer, all call logs, your national DNC scrub records, your internal DNC list, any opt-out requests you received, and the transaction or inquiry records you are relying on for the EBR. Have those records organized before litigation starts. If you are scrambling to reconstruct records after a complaint is filed, you are already behind.

A strong EBR defense can support a motion for summary judgment. The defendant in Toney v. Quality Resources, Inc. moved successfully for summary judgment in part on an EBR theory, though the court's analysis was specific to the facts of that relationship and the call content ^[6]. A summary judgment win on EBR is possible, but it takes clean records and a relationship that unambiguously fits the regulatory definition.

For small teams building their compliance posture before a lawsuit arrives, LeadCompliant's compliance kit includes an EBR documentation checklist and internal DNC policy template that map directly to these regulatory requirements.

How long does an EBR last and what restarts the clock?

The FCC regulation gives two windows: 18 months from a purchase or transaction, and 3 months from an inquiry ^[1]. Those run from the most recent qualifying event, not the first one.

A new purchase restarts the 18-month clock. A new inquiry restarts the 3-month clock. This matters for subscription businesses and repeat buyers. If a customer makes a purchase every 15 months, the EBR never lapses for as long as the pattern holds.

What counts as a qualifying transaction? The FCC's intent is a real commercial exchange: a sale, a service contract, a loan origination, a policy purchase. It has to be a genuine transaction, not a manufactured one designed to generate an EBR. Courts would see through a scheme where a company charges $1 to a consumer's card just to create an EBR for calling purposes.

What counts as an inquiry? The consumer must affirmatively contact you or submit their information in response to your offer. A consumer opening a marketing email is almost certainly not an inquiry. A consumer filling out a quote request form, calling an inbound line to ask about pricing, or submitting a loan application clearly is. The middle ground, like a consumer clicking through to a landing page but not submitting a form, is murky, and you should not rely on it.

One more thing resets the clock in the wrong direction. A do-not-call request by the consumer permanently ends the EBR for solicitation calls, and a new purchase does not undo it without separate affirmative consent in writing.

What are the biggest mistakes companies make when relying on EBR?

First mistake: assuming EBR covers cell phones called with an autodialer. It does not. See the § 227(b) analysis above. This is the most expensive error, and it happens constantly.

Second mistake: relying on data-appended phone numbers. If the phone number you are calling was not directly provided by the consumer in the transaction or inquiry, you have a problem. Many sales teams append cell numbers from data vendors to CRM records. That appended number was never part of the EBR transaction.

Third mistake: not scrubbing the national DNC list even when you believe you have an EBR. The correct process is to identify customers with a live EBR, scrub against the national registry anyway, and for those on the registry, decide whether to call (risky) or skip (safe). The EBR exemption from the DNC registry is not absolute in every circuit, and plaintiffs will argue you needed to scrub. Get a do not call list subscription and scrub every campaign, even EBR-based ones.

Fourth mistake: not honoring oral do-not-call requests from customers. Your frontline reps need training to flag and record every "take me off your list" statement. Calling back a customer who verbally opted out, even hours later, blows up your EBR defense entirely.

Fifth mistake: missing the 18-month or 3-month window because your CRM did not flag the date. Automate a date-based suppression rule: 17 months after last transaction, flag the record for human review or EBR expiration suppression. Do not rely on salespeople to calculate this by hand.

How does the EBR defense interact with state DNC laws?

State laws add another layer, and they do not all follow the federal EBR definition. A handful of states are especially aggressive.

Florida's Mini-TCPA (Fla. Stat. § 501.059) does not include a broad EBR exemption equivalent to the federal rule, and the 2021 amendments sharply tightened consent requirements for calls and texts to Florida residents ^[11]. An EBR argument that would work under federal law may not protect you against a Florida state claim.

Texas Business & Commerce Code Chapter 304 has its own established business relationship exception but defines it somewhat differently than the FCC ^[12]. The Texas DNC list also requires separate registration from the federal list.

California's Business & Professions Code §§ 17590-17594 governs telephone solicitations with its own exemption framework. California adds more complexity through the Consumer Legal Remedies Act and, for text messages, the way courts apply consumer privacy statutes.

The safest posture: treat the federal EBR as a floor, not a ceiling. If a state where your called party is located has stricter rules, follow those. Check state-specific rules before running any campaign that relies on EBR, not after. For questions about how the do not call telemarketer list interacts with state registries, that is a separate analysis from EBR.

For multi-state calling campaigns, you basically need a state-by-state matrix covering three things: whether an EBR analog exists under state law, what the time windows are, and whether a state DNC registration overrides the EBR the way the federal DNC does. Nobody has built a clean public reference for all 50 states on this specific question. Consult a TCPA attorney for any campaign touching Florida, Texas, California, or Indiana, which all carry notably different rules.

What should you do right now to protect your EBR defense before a claim arises?

The time to build your EBR file is before the complaint arrives, not after. Here is a practical checklist.

First, audit your CRM to confirm that transaction and inquiry dates are being captured and stored. If your CRM does not record when a customer first purchased or first submitted an inquiry, fix that before the next campaign.

Second, build date-based suppression rules. Contacts whose last qualifying event was more than 18 months ago (purchases) or 3 months ago (inquiries) should not be treated as EBR-eligible without fresh consent. Automate this.

Third, document your DNC scrub cadence. You should be scrubbing the national DNC registry at least every 31 days before any campaign. Keep logs showing the date of each scrub, the subscription access number (SAN), and the campaign it covered ^[9].

Fourth, train your reps on opt-out capture. Every "please stop calling" or "remove me from your list" must land in your internal DNC database within 24 hours, and definitely within the FCC's required 30-day window.

Fifth, preserve records. Set your CRM, call logging software, and marketing automation to retain transaction, inquiry, and opt-out records for at least 5 years.

For teams that want a structured starting point, LeadCompliant's one-time compliance kit covers internal DNC policy templates, EBR documentation checklists, and scrub log templates built to these FCC requirements.

The TCPA does not reward improvised defenses. The companies that survive claims are the ones whose records were already clean when the plaintiff's lawyer sent the first demand letter. Check what numbers you are calling against the mobile phone do not call list and the national registry before every single campaign.

Frequently asked questions

Does an established business relationship let me call someone on the national DNC list?

Since 2003, no, for residential telemarketing calls. The FCC's 2003 Do Not Call Implementation Order (FCC 03-153) eliminated the EBR as a defense against calling numbers on the National DNC Registry for residential solicitation calls. If a number is on the federal registry, a prior relationship with that consumer does not let you call for marketing purposes. The only exceptions involve non-solicitation calls or manually dialed, live-voice calls that fall outside the autodialer prohibition.

How long is an established business relationship good for under the TCPA?

Under 47 C.F.R. § 64.1200(f)(5), an EBR based on a purchase or transaction lasts 18 months from the most recent purchase date. An EBR based on an inquiry (quote request, application, inbound question about services) lasts 3 months from the most recent inquiry date. A new qualifying event restarts the clock. A do-not-call request from the consumer ends the EBR permanently for solicitation calls.

Can I use an EBR defense for autodialed calls to cell phones?

No. The EBR exemption applies to the residential solicitation rules under 47 U.S.C. § 227(c), not to the autodialer prohibition under § 227(b). Autodialed or prerecorded calls to cell phones require prior express consent (informational) or prior express written consent (telemarketing), regardless of any prior business relationship. EBR does not substitute for consent in the § 227(b) context. Courts have consistently rejected that argument.

What records do I need to prove an established business relationship in court?

At minimum: a timestamped transaction or inquiry record with the consumer's phone number as they provided it, proof the event falls within the 18-month or 3-month window, evidence the phone number was given directly by the consumer (not appended), and documentation that no opt-out request arrived before the call. Metadata on when records were created matters. Records reconstructed after a lawsuit is filed carry little weight. Retain records for at least 5 years to match FCC DNC record-keeping requirements.

Does a customer making a new purchase reset the do-not-call request they already made?

No. A do-not-call request from a consumer persists even if they later purchase from you again. The only way to resume solicitation calls to a consumer who has opted out is to obtain their separate, affirmative, written consent to receive future marketing calls after the opt-out request was recorded. A new transaction does not automatically revive calling rights. Your CRM should be configured so that a new order does not clear a prior DNC flag.

Is an EBR defense different under state law than federal law?

Often yes. States like Florida, Texas, and California have their own telemarketing statutes that define or limit business relationship exemptions differently from the FCC's federal rule. Florida's 2021 amendments, for example, sharply tightened consent requirements and do not mirror the federal 18-month window cleanly. Always check the state law for the jurisdiction where your called party is located, more than federal law, before relying on an EBR argument for a multi-state campaign.

What is the difference between an EBR defense and a consent defense under TCPA?

Consent means the consumer gave you affirmative permission, in advance, to call them. EBR is a regulatory exception that says a prior commercial relationship substitutes for fresh consent within specific time windows. Consent is stronger and broader. EBR is narrower, time-limited, and has been eliminated for DNC-listed residential numbers in solicitation contexts. For cell phone calls using any automated technology, you need actual consent. EBR does not replace it.

Can a plaintiff defeat my EBR defense by showing I used a data vendor to find their number?

Yes, very likely. Courts have rejected EBR defenses where the phone number was appended by a third-party data vendor rather than provided directly by the consumer during the qualifying transaction or inquiry. An EBR requires a voluntary two-way communication between your company and the consumer. If the consumer never gave you that specific phone number, the required nexus between the relationship and the call breaks down.

How does TCPA treat informational calls versus telemarketing calls for EBR purposes?

EBR primarily applies to the telemarketing solicitation rules. Calls that are purely informational (appointment reminders, order status updates, fraud alerts) are not solicitations and have different consent standards under the TCPA. They still cannot use an autodialer to call cell phones without at least prior express consent, but EBR is less directly relevant. The call content determines whether it is a solicitation, and courts look at whether any part of the call includes an offer or inducement to purchase.

What happens if I keep calling a customer after their EBR window expires?

Once the 18-month post-purchase or 3-month post-inquiry window closes, you no longer have an EBR defense. Any residential solicitation call to a number on the national DNC registry after that window closes is potentially a TCPA violation carrying statutory damages of $500 to $1,500 per call. The risk multiplies in class actions. Automate suppression of EBR-expired contacts and capture fresh consent before the window closes if you want to keep calling.

Do I still need to scrub the DNC registry if I have an established business relationship?

Yes, you should still scrub, and here is why. First, even if you believe you have a valid EBR, your records may be challenged. Scrubbing tells you where your legal risk is concentrated. Second, some circuits and states are skeptical of EBR arguments for DNC-listed numbers regardless of the FCC's 2003 rule. Third, if your EBR defense fails for any reason, a call to a DNC-listed number with no scrub shows willfulness, which converts a $500 violation to $1,500 per call.

Can an EBR defense work if the business relationship was with a different company I acquired?

This is legally contested territory. If your company acquired another company and its customer list, courts and the FCC have not given a clean answer on whether the acquiring entity inherits the EBR. The consumer's relationship was with the acquired entity. The safer approach is to treat acquired customers as requiring fresh consent for solicitation calls rather than relying on a transferred EBR. The risk of getting this wrong in a class action context is severe.

How much does a TCPA violation cost if my EBR defense fails?

The TCPA provides statutory damages of $500 per violation and up to $1,500 per willful violation, with no proof of actual damages required. In class actions involving hundreds or thousands of calls, exposure stacks fast. The Credit One Bank TCPA settlement reached $12.5 million. The Cash App TCPA class action settlement was $18 million. These figures reflect why having defensible EBR records before any campaign matters more than building them after a complaint arrives.

Sources

1. FCC, 47 C.F.R. § 64.1200 (Code of Federal Regulations, Telephone Solicitation rules): Definition of established business relationship under § 64.1200(f)(5): 18-month window post-purchase, 3-month window post-inquiry, voluntary two-way communication requirement
2. Chyba v. First Federal Credit Control, Inc., N.D. Cal., defendant failed to produce adequate date records to prove EBR: Burden of proving EBR is on the defendant; inadequate records doomed the defense; courts scrutinize whether the phone number was directly provided by the consumer
3. FCC, 47 C.F.R. § 64.1200(d)(6), internal do-not-call list record-keeping requirements: FCC requires companies to retain do-not-call records for at least 5 years
4. 47 U.S.C. § 227(b)(1)(A), Telephone Consumer Protection Act, autodialer prohibition for wireless numbers: EBR is not listed as a defense under § 227(b); the autodialer prohibition for wireless numbers requires prior express consent, not merely a prior business relationship
5. Toney v. Quality Resources, Inc., N.D. Ill., summary judgment analysis of EBR defense: Summary judgment on an EBR theory is possible when records cleanly prove a qualifying relationship and the call content fits the exemption
6. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310, established business relationship definition: FTC's TSR also contains an EBR definition paralleling the FCC's, relevant for outbound telemarketing covered by both agencies
7. FTC, National Do Not Call Registry, business compliance center (donotcall.gov): Business subscription access, SAN requirements, and 31-day scrub cycle guidance
8. 47 U.S.C. § 227(c), TCPA residential telephone subscriber protections: Section 227(c) authorizes the FCC to create regulations protecting residential subscribers from unwanted telemarketing, including the DNC registry and EBR framework
9. Florida Legislature, Fla. Stat. § 501.059, Florida Telephone Solicitation Act: Florida's 2021 amendments tightened consent requirements for calls and texts and do not include a broad EBR exemption equivalent to the FCC's federal rule
10. Texas Legislature, Bus. & Commerce Code § 304.002, Texas No-Call List exceptions: Texas defines its own established business relationship exception under state no-call law, with requirements that differ from the FCC's federal definition
11. 28 U.S.C. § 1658, four-year federal statute of limitations: TCPA claims are subject to the general 4-year federal statute of limitations, establishing the minimum record retention floor for EBR and DNC documentation