Last updated 2026-07-09
TL;DR
Under the TCPA, an established business relationship (EBR) gives you 18 months to call a customer after their last purchase, and 3 months after an inquiry or application. Once those windows close, or the person asks you to stop, the exemption is gone and you need prior express consent. The EBR does not protect autodialed or prerecorded calls to cell phones. Ever.
What is the established business relationship exception under the TCPA?
The established business relationship (EBR) exception is a narrow carve-out in federal telemarketing law. It lets you call certain people who never explicitly said you could. The logic is simple. If someone bought from you, or asked you about your product, they cracked the door open for a follow-up.
The legal home for this is the Telephone Consumer Protection Act, 47 U.S.C. § 227, and the FCC regulations at 47 C.F.R. § 64.1200. The FTC's Telemarketing Sales Rule (16 C.F.R. Part 310) has its own parallel EBR definition covering much of the same ground. But the TCPA and the TSR are separate laws with separate enforcers, the FCC and the FTC. When both apply, you satisfy both [1][2].
The EBR matters most against the National Do Not Call Registry. A residential landline on the DNC Registry is normally off-limits for telemarketers. The EBR is one of two ways to still call that number legally. The other is written consent.
Here is the catch everyone misses. The EBR only works for residential landline calls made without an autodialer and without a prerecorded message. Autodial a cell phone or play a recording to anyone, and you are in TCPA territory that demands prior express written consent. No EBR saves you there [3].
That one distinction has cost cold calling teams real money. They assume a purchase six months ago lets them robo-blast a customer's mobile number. It does not. That assumption is wrong and expensive.
How long does the established business relationship last under the TCPA?
The FCC set two windows, and you need to know both. Transaction EBRs run 18 months. Inquiry EBRs run 3 months.
For a transaction-based EBR, meaning the customer made a purchase, paid for a service, or entered a financial transaction with you, the window is 18 months from the date of the last transaction [1]. The clock resets with every new transaction, so an active customer relationship never really expires as long as purchases keep coming.
For an inquiry-based EBR, meaning the consumer called you, submitted a form, requested a quote, or asked about your products, the window is 3 months from the inquiry date [1]. Three months is short. Plenty of sales cycles run longer than that, which is why leaning on the inquiry EBR alone is a gamble.
These windows live in 47 C.F.R. § 64.1200(f)(5), which defines an established business relationship as "a prior or existing relationship formed by a voluntary two-way communication between a person or entity and a residential subscriber with or without an exchange of consideration, on the basis of the subscriber's purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call or on the basis of the subscriber's inquiry or application regarding products or services offered by the entity within the three (3) months immediately preceding the date of the telephone call" [1].
That language is quoted word for word because a lot of compliance guides paraphrase it and introduce errors. Read the original.
One more limit people forget. The EBR ends the second the consumer tells you to stop, no matter where you are in the 18-month or 3-month window. A do-not-call request kills the EBR for that consumer immediately and permanently [1][2]. Your team needs a real-time process to honor those requests before the next dialing session.
Does the EBR exception apply to cell phones?
No. This is the single boundary that matters most, so read it twice.
The EBR applies to calls to residential subscribers under the National Do Not Call Registry rules. It does not override the separate TCPA consent requirement for calls made with an automatic telephone dialing system (ATDS) or a prerecorded voice to any mobile number [3].
Section 227(b)(1)(A) of the TCPA bans any call using an ATDS or prerecorded voice to a wireless number without the called party's prior express consent. That section lists no EBR exception. The EBR lives in section 227(c), which governs the DNC rules, not the autodialer and wireless rules [3].
The FCC has been consistent about this split. Its 2003 Report and Order that built the national DNC Registry and set the EBR windows was explicit that it did not touch the section 227(b) consent requirements for wireless numbers [3]. Courts have followed that reading.
So here is what it means in practice. If your sales reps work a list of prior customers and manually dial mobile numbers with no recorded content, the section 227(b) risk drops (though it is never zero, since ATDS definitions have been fought over hard since Facebook v. Duguid) [9]. But run any automated campaign to mobile numbers, and an EBR alone is not enough. You need documented prior express written consent for marketing calls, or prior express consent for informational calls [3].
The TCPA rules for cell phones are stricter than the rules for landlines. Full stop.
Does the EBR exception apply to text messages?
No. The FCC treats a text as a call under the TCPA. A text sent via ATDS to a mobile number needs the same prior express written consent as an autodialed voice call to that number [3].
The EBR does not substitute for that consent. There is no text-message version of the carve-out. Send an SMS marketing campaign to your customer list and you need opt-in records, more than proof that the recipients bought something in the last 18 months.
This blindsides small businesses constantly. They call customers under the EBR for years with no trouble. Then they fire off an SMS promotion to the same list and walk straight into TCPA exposure. The channel changes the rules.
Does the EBR protect you from the National Do Not Call Registry?
Yes, but only for residential landline calls, and only inside the time windows.
The FCC built the EBR as an exception to the duty to scrub against the national do not call list before calling. If a residential number is on the DNC Registry but the subscriber purchased from you within 18 months or inquired within 3 months, you may call them on a residential line without breaking the DNC rules [1][2].
The same logic reaches most state do-not-call lists, but state law varies. Some states write their own EBR definitions that differ from the federal one. Indiana has run a stricter DNC regime for years, so never assume the federal EBR clears every state's rules [12].
Your proof matters here. If a consumer disputes the call and you land in litigation or an FCC complaint, you need records showing the transaction or inquiry date. "They were once a customer" will not survive scrutiny. Keep timestamped CRM records. Both the courts and the FTC have said the company claiming the EBR carries the burden of proving it [2][10].
For how the DNC Registry works and how to reach it, the how do i get the do not call list guide walks through registration and access. If you work with outside lead sources, the do not call telemarketer list article breaks down the separate rules for sellers versus telemarketers.
What counts as a transaction for the 18-month EBR window?
The FCC reads it broadly: a purchase, payment, or financial transaction. That covers a completed sale, a paid subscription, a service contract, a paid invoice. It does not cover a failed transaction, an abandoned cart, a quote nobody accepted, or a free trial where no money moved.
A few gray areas come up again and again.
A subscription renewal counts as a new transaction and resets the 18-month clock. An auto-renewing subscription that charges every month keeps the EBR alive the whole time the customer stays enrolled.
A refunded transaction is murkier. The regulation says "purchase or transaction" without carving out refunds, but the FTC has signaled in guidance that a fully refunded transaction may not establish the relationship, since the consideration got reversed [10]. I would not hang my EBR on a refunded sale.
A contract signed but not yet invoiced is another gray zone. The safest move is to document the contract date, treat it as the transaction date, and get express written consent during the contracting process if you can. Consent plus EBR, belt and suspenders, is always the safer play.
For insurers, banks, and financial firms, ongoing account relationships (an active checking account, an in-force policy) are generally treated as a continuous transaction. The 18-month window rolls forward as long as the account stays open and active [3].
What counts as an inquiry for the 3-month EBR window?
An inquiry is a voluntary, consumer-initiated contact. The consumer called your company, filled out a web form, sent an email, walked into your store and asked questions, or submitted an application for your product or service [1].
The key word is voluntary. Someone who got your direct mail piece and did nothing has not inquired. Someone who clicked a retargeted ad and had their info scraped without any affirmative act almost certainly has not inquired in the legal sense. The contact has to be two-way and consumer-initiated.
The 3-month window runs on the calendar from the inquiry date. Quote requested March 1, window closes June 1. Your CRM timestamps carry the whole case. If you cannot prove the inquiry date, you cannot prove the EBR.
Lead generation is where this gets hard. Buy leads from an aggregator and the inquiry went to the aggregator, not to you. The FCC has never definitively ruled that a transferred lead satisfies the EBR for the company receiving it. Some courts and enforcement actions have treated shared leads with suspicion. If you rely on purchased leads, get explicit consent language on the lead form that names your company by name. Do not assume the aggregator's EBR passes to you.
The mobile phone do not call list article covers how DNC rules hit mobile numbers, which matters because an inquiry-based EBR still does not unlock autodialed mobile calls.
Can a customer revoke the EBR?
Yes. Immediately and permanently.
A consumer who asks you not to call them ends your EBR for that number, even if they bought from you yesterday [1]. The FCC's rules give you 30 days at the outside to honor a do-not-call request, but best practice is same-day suppression. Many courts have held that a clear verbal request during a call is enough notice, so your agents need training on how to handle those requests and your system needs to flag the number before the next dial.
A written do-not-call request (email, letter, text reply with STOP) never expires. Once made, it holds for the life of the relationship unless the consumer explicitly invites contact again.
This is where the Credit One TCPA settlement and Cash App TCPA class action cases teach a lesson. Both involved allegations that companies kept contacting people after stop requests. The EBR was no defense in either matter. Do-not-call requests override everything.
How does the EBR interact with the TCPA's written consent requirement?
They run on separate tracks and cover different things. The EBR handles the DNC Registry. Written consent handles the autodialer.
The EBR exempts you from the DNC Registry scrub for residential landline calls inside the time windows. Prior express written consent is what the TCPA demands for autodialed or prerecorded calls to any number, wireless or landline [3].
You can hold both at once. A customer who bought last month and signed up for your SMS list has given you an EBR (for DNC purposes) and prior express written consent (for autodialed or text campaigns). Losing one does not erase the other. The 18-month EBR clock can expire while your written consent record still holds, and the reverse can happen too.
For any modern outbound team using dialing software, written consent is the safer thing to build around. The EBR is a fine backstop for genuine relationship calls. Treating it as the primary strategy for a high-volume dialing operation is a bad bet. Courts and the FCC have narrowed EBR-adjacent interpretations steadily over the past decade [3][9].
LeadCompliant's free compliance kit includes a consent documentation checklist and a call disposition log template that track both EBR windows and consent records in one workflow.
What is the difference between the TCPA EBR and the FTC's Telemarketing Sales Rule EBR?
Both the FCC (enforcing the TCPA) and the FTC (enforcing the Telemarketing Sales Rule) have an EBR concept. They are close cousins, not twins.
The FTC's TSR EBR covers telemarketing calls generally. The FCC's TCPA EBR covers the National DNC Registry exemption. The time windows match: 18 months from a purchase, 3 months from an inquiry [1][2]. What each law regulates is where they split.
The TSR reaches sellers and telemarketers doing outbound telemarketing with an offer to sell goods or services in interstate commerce. The TCPA reaches any entity making calls with an ATDS or prerecorded voice, plus telemarketing calls to residential subscribers.
Use a third-party call center and both laws apply, both agencies can enforce. The FTC can seek civil penalties up to $53,088 per violation (inflation-adjusted) under the TSR [2]. The TCPA gives a private right of action at $500 per violation, or $1,500 for willful violations, with no cap per plaintiff class. That is what makes TCPA class actions so dangerous [3][6].
Satisfying one EBR does not satisfy the other. The safest practice is to document the relationship so it clears both standards at once.
How should you document the EBR to defend against a TCPA lawsuit?
Documentation is the line between winning and settling. Document as if a judge will read it, because one might.
For the transaction-based EBR, you need the consumer's name and number, the date and nature of the transaction, and ideally a transaction ID or invoice number. A timestamped CRM record works, as long as it is tamper-evident and your retention policy keeps it through the likely litigation window. Keep records at least 4 years, matching the general federal statute of limitations that many courts apply to TCPA claims [11].
For the inquiry-based EBR, you need the date and time of the inquiry, the channel (call, web form, in-person), and the content. A web form log with IP address and timestamp is strong evidence. A CRM note reading "customer called" with no timestamp is nearly worthless.
For do-not-call requests, keep a suppression list updated before every dialing session, logging the date the request came in and the agent or system that took it.
Some teams run a pre-dial check through a tool like LeadCompliant's free TCPA checker to cross-reference active EBR windows against DNC status. That audit creates a contemporaneous record that you made a good-faith compliance check, which matters if you ever have to argue against a willful-violation finding.
If a complaint or lawsuit comes, the burden of proving the EBR existed sits on you, not the plaintiff [2][10].
What are the penalties if you call someone after the EBR expires?
The TCPA's private right of action is $500 per call for negligent violations and $1,500 per call for knowing or willful violations [3][6]. Courts can treble damages on willful violations. There is no cap in a class action, so a campaign of 100,000 calls can carry statutory exposure of $50 million to $150 million before attorneys' fees.
The FCC can also bring its own enforcement actions with penalties up to $25,074 per violation under recent inflation adjustments [8]. State attorneys general can enforce the TCPA and add their own state law claims on top.
Here is the concrete mapping. Calling a DNC-listed residential number after the EBR window closes violates 47 C.F.R. § 64.1200(c)(2). Autodialing a cell phone without consent violates 47 U.S.C. § 227(b)(1)(A)(iii). The second one usually costs more to defend, because the per-call damages are the same but mobile campaigns sweep far more people into a class.
The cold call article has more on structuring your outbound program to cut TCPA exposure from day one, rather than leaning on exceptions like the EBR as your main defense.
Frequently asked questions
Does the established business relationship exception allow you to call cell phones?
No. The EBR applies to the National Do Not Call Registry rules for residential landline calls. The separate TCPA rule banning autodialed or prerecorded calls to wireless numbers (47 U.S.C. § 227(b)(1)(A)) has no EBR exception. You need prior express consent to autodial or send prerecorded messages to a cell phone, regardless of any prior purchase or inquiry.
Does the 18-month EBR clock reset with every purchase?
Yes. Each new transaction resets the clock from that transaction date. An active customer who buys monthly stays inside the 18-month window continuously. The practical effect: your most engaged customers are always covered, while lapsed customers drop out of coverage 18 months after their last purchase.
Can you rely on an EBR if you bought the customer list from another company?
Generally no. The EBR has to be a direct relationship between your company and the consumer. A transaction the consumer had with a list broker or lead aggregator does not transfer to you. Get explicit, company-specific consent language on any lead form if you plan to call leads generated by third parties.
Does the EBR apply to business-to-business calls?
The TCPA's DNC Registry rules and the EBR exception mainly protect residential subscribers. B2B calls sit largely outside the DNC Registry's reach. But the TCPA's section 227(b) autodialer rules still apply to calls to mobile phones regardless of business or personal purpose. Some states have their own B2B DNC protections too.
How long do you have to honor a do-not-call request under the TCPA?
The FCC requires you to honor a do-not-call request within 30 days of receipt. Best practice is to add the number to your suppression list before the next dialing session, often the same day. A verbal request during a call counts as valid notice, so agents must be trained to flag and log those requests immediately.
Is the EBR exception the same under the FTC's Telemarketing Sales Rule and the TCPA?
The time windows match: 18 months from a transaction, 3 months from an inquiry. But the two rules cover slightly different activities and are enforced by different agencies, the FTC and the FCC. Complying with one does not guarantee complying with the other. High-volume outbound telemarketers need to satisfy both standards at the same time.
What records do you need to prove an established business relationship in court?
You need timestamped records of either the transaction (date, nature, transaction ID) or the inquiry (date, channel, content). CRM records with tamper-evident timestamps work. A vague claim that someone was a customer is not enough. Courts put the burden of proving the EBR on the company claiming it. Retain records at least 4 years to cover the statute of limitations.
Does the EBR exception apply to prerecorded messages?
No. Prerecorded messages fall under 47 U.S.C. § 227(b), which requires prior express written consent for marketing prerecorded calls to both residential and wireless numbers. The EBR lives in section 227(c) and does not override that consent requirement. Using a prerecorded voice to call a prior customer without written consent is still a TCPA violation.
Can a consumer who opted out of marketing still be called under the EBR?
No. A specific do-not-call request from the consumer terminates the EBR for that number permanently, no matter where you are in the 18-month or 3-month window. The FCC's rules are clear that a stop request overrides the EBR. You must suppress the number, and a later purchase cannot revive calling rights without fresh consent.
Does the 3-month inquiry window apply to web form submissions?
Yes. A voluntary web form submission asking about your products or services qualifies as an inquiry under the EBR definition. The submission date starts the 3-month window. Log the submission date, IP address, and form content. Without that record you cannot prove the inquiry existed if someone disputes the call.
What is the TCPA statute of limitations for EBR-related violations?
The TCPA generally runs on a 4-year statute of limitations under 28 U.S.C. § 1658, the default federal civil limitations period. Some courts apply a 2-year period based on 47 U.S.C. § 227(c)(5). The law is split. Keep your EBR and consent records at least 4 years to be safe.
Does a free trial or free consultation create an EBR?
It depends on whether any exchange of consideration happened. A paid trial creates a transaction. A free trial with no payment may not. The FCC's definition references "purchase or transaction," and some readings require a financial exchange. An inquiry EBR is the safer characterization for a free consultation, giving you a 3-month window from the consultation date.
If a customer calls to complain, does that reset the inquiry-based EBR?
A complaint call is a voluntary consumer-initiated contact, which technically fits the inquiry definition. But relying on a complaint call as your EBR basis is legally and ethically shaky. The FCC meant the inquiry EBR to cover genuine buying interest. Stretching a complaint into extended calling rights would likely not survive regulatory scrutiny.
Are there states with shorter EBR windows than the federal 18-month rule?
Yes. A few states write their own DNC rules with different EBR definitions. Indiana's DNC law has run stricter than the federal standard for years. Always check the specific state's telemarketing statute before assuming the federal 18-month and 3-month windows apply. The federal EBR sets a floor, not a ceiling, for state consumer protection laws.
Sources
- FCC, 47 C.F.R. § 64.1200 (TCPA implementing regulations, definition of established business relationship at subsection (f)(5)): EBR lasts 18 months from last transaction and 3 months from last inquiry; do-not-call request from consumer terminates EBR
- FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: FTC TSR EBR definition mirrors TCPA windows; company bears burden of proving EBR applies; TSR civil penalty adjusted to $53,088 per violation
- U.S. Code, 47 U.S.C. § 227, Telephone Consumer Protection Act: Section 227(b)(1)(A) prohibits autodialed or prerecorded calls to wireless numbers without prior express consent; section 227(c) governs DNC rules including EBR; FCC 2003 Report and Order left 227(b) consent requirements intact
- U.S. Code, 47 U.S.C. § 227(c)(5), TCPA private right of action: TCPA private right of action allows $500 per violation or $1,500 for willful violations with no class action cap
- FTC, National Do Not Call Registry: Businesses must honor do-not-call requests within 30 days; EBR exempts DNC-listed numbers from the no-call obligation within applicable time windows
- Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), Supreme Court: Supreme Court narrowed the ATDS definition, but the ruling did not create or expand EBR rights for wireless number calls
- FTC, Complying with the Telemarketing Sales Rule (business guidance): FTC guidance confirms EBR requires voluntary two-way communication and company must be able to prove the relationship with records
- U.S. Code, 28 U.S.C. § 1658, general federal 4-year civil statute of limitations: General federal 4-year statute of limitations used by some courts for TCPA claims
- Indiana Attorney General, Do Not Call program: Indiana operates a stricter state do-not-call regime than the federal standard