Last updated 2026-07-09
TL;DR
An existing business relationship (EBR) under the TCPA gives you limited permission to call a consumer's residential line without prior express written consent. It does not cover cell phones reached with an autodialer or prerecorded voice. EBR lasts 18 months after a transaction or 3 months after an inquiry. A consumer's do-not-call request ends it instantly.
What is the TCPA existing business relationship exemption?
The TCPA existing business relationship (EBR) exemption lets telemarketers call a residential landline without the consumer's prior written consent, as long as a qualifying prior relationship exists. That is the entire scope of the protection. It does not apply to cell phones reached with an autodialer or prerecorded message, and it never has.
The Federal Communications Commission defined EBR in its 2003 Do-Not-Call Implementation Order and has reinforced the definition many times since. The FCC's rule, at 47 C.F.R. § 64.1200(f)(5), defines an existing business relationship as "a prior or existing relationship formed by a voluntary two-way communication between a person or entity and a residential subscriber with or without an exchange of consideration, on the basis of the subscriber's purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call or on the basis of the subscriber's inquiry or application regarding products or services offered by the entity within the three (3) months immediately preceding the date of the telephone call" [1].
Read that twice. Two thresholds, not one. A purchase or transaction gives you 18 months. An inquiry or application gives you only 3.
The statute text at 47 U.S.C. § 227 never uses the words "existing business relationship" for cell phones. Congress created the cell-phone autodialer restriction separately, and the EBR carve-out in the FCC's Do-Not-Call rules was written to apply to the residential-line DNC rules, full stop [2].
Does the EBR exemption apply to cell phones?
No. This is the single most dangerous misconception in outbound sales.
Calls or texts to cell phones using an autodialer or prerecorded voice need "prior express consent" of the called party under 47 U.S.C. § 227(b)(1)(A). The FCC's 2012 order raised that to prior express written consent for telemarketing calls and texts [3]. EBR is not listed as an exception to any of it.
The FCC said so plainly in its 2012 Report and Order (FCC 12-21): prior express written consent is required for autodialed or prerecorded telemarketing calls to cell phones, and an existing business relationship is not a substitute [3]. Courts have read it the same way. In Satterfield v. Simon & Schuster, 569 F.3d 946 (9th Cir. 2009), the Ninth Circuit held that consent given for one purpose does not automatically transfer to unrelated marketing, and later decisions used that logic to narrow what counts as consent inside an ongoing relationship [4].
So if your team dials cell phones with a predictive dialer and your lawyer says "we're fine, these are existing customers," the analysis is wrong. You need actual written consent on file, tied to the specific type of communication, for each cell number.
For how expensive that mistake gets, the UnitedHealthcare TCPA case followed exactly this pattern: calls to cell numbers where the company claimed a prior relationship but lacked adequate written consent.
How long does an existing business relationship last under the TCPA?
The clock is precise, and it runs from the last qualifying event, not from when the relationship started. Eighteen months for a transaction. Three months for an inquiry.
| Qualifying Event | EBR Duration |
|---|---|
| Purchase, transaction, or payment | 18 months from the date of transaction |
| Inquiry, application, or request about products/services | 3 months from the date of inquiry |
| Consumer registers on company's DNC list | Expires immediately, permanently |
| Consumer verbally revokes during a call | Expires immediately |
Some things do not reset the clock. Sending a newsletter. Opening a marketing email. A consumer visiting your website anonymously. The FCC's rule requires a "voluntary two-way communication," and passive behavior does not extend the window [1].
If a customer bought something 19 months ago and has gone quiet since, the EBR is gone. Call that residential number anyway and you are making a cold call, which means you check your internal DNC list and the National DNC Registry before you dial [5].
Here is a common mistake. Companies assume a renewal or auto-billing event resets the 18-month window. It probably does, but only if the payment is a genuine transaction rather than an automated charge the consumer never actively initiated. Nobody has clean case law on that exact edge, so document the triggering transaction clearly in your CRM.
Can a consumer kill the EBR by asking to stop calls?
Yes, and immediately. The moment a residential subscriber asks to be on your internal do-not-call list, the EBR exemption stops applying to that person, no matter how recent the transaction was [1]. You honor the request within 30 days and keep the suppression for at least 10 years [5].
The FCC's rules give residential subscribers the right to place themselves on a company's internal do-not-call list at any time.
The same rule works mid-call. If a consumer says "stop calling me" or "put me on your do-not-call list," that verbal revocation ends the EBR right then. Your agents need training to catch these statements, log them fast, and route the number to suppression before the next dialing session.
Revocation by text is valid too. The FCC's 2024 one-to-one consent order reinforced that consumers may revoke consent, and by extension EBR-based calling rights, through any reasonable means [6]. A "STOP" reply to an SMS, a web form, or a voicemail all count.
For high-volume outbound, the hard part is operational: a revocation captured in one channel (say, customer service) has to suppress the number across every dialer the same day. That is a process problem more than a legal one, and it is where lawsuits actually start.
What qualifies as a transaction for the 18-month EBR window?
A transaction means a completed purchase, payment, or exchange of consideration. A quote or estimate alone does not count. A completed credit application probably does, because the FCC's rule lists "application" separately under the 3-month inquiry window.
The FCC's definition covers transactions with the entity itself. That matters for affiliated companies. If a consumer bought homeowner's insurance from Company A, and Company B is a separate legal entity even inside the same corporate family, Company B generally cannot borrow Company A's transaction to claim an EBR for its own calls [1]. Some courts have asked whether the consumer would reasonably expect contact from affiliates, but the safer move is to treat each legal entity on its own.
Charitable donations count as transactions, which is why nonprofit fundraising calls to past donors are often shielded. Political calls run under a different exemption structure. For commercial telemarketers, "transaction" basically means money changed hands or a formal application went in.
Keep records. If you cannot show the date of the qualifying transaction and the phone number tied to it, you cannot prove EBR in court. A bare CRM entry that just says "customer" with no timestamp does not survive discovery.
Does the EBR exemption apply to the National Do Not Call Registry?
Yes. For residential lines, the EBR is a recognized exemption to the National DNC Registry rules. Under the FTC's Telemarketing Sales Rule at 16 C.F.R. § 310.4(b)(1)(iii)(B), and mirrored in FCC rules at 47 C.F.R. § 64.1200(f)(5), a company may call a registered number if it has an EBR with that consumer [5].
But only if the consumer has not also put themselves on your internal DNC list. National Registry plus an internal DNC request equals no call, full stop, even with a fresh EBR.
The FTC and FCC split enforcement of the DNC rules. The FTC handles most DNC Registry enforcement against commercial telemarketers under the Telemarketing Sales Rule (TSR). The FCC enforces the broader TCPA autodialer and prerecorded-voice rules [7]. A live agent calling a landline mostly raises FTC TSR exposure for DNC violations. A dialer hitting a cell phone makes the TCPA claim the main event.
Practically, checking numbers against the National DNC Registry before each campaign is the baseline even when you think EBR covers you. A scrub costs almost nothing next to the cost of getting it wrong.
How does the EBR exemption interact with written consent requirements for text messages?
It does not. EBR has no role in SMS compliance for autodialed or prerecorded texts to cell phones.
Texts to cell phones fall under 47 U.S.C. § 227(b)(1)(A)(iii) when sent with an autodialer. Marketing texts need prior express written consent, and there is no statutory or FCC-created EBR carve-out for this category [3].
This surprises a lot of companies that have been texting their customer base on the theory that the relationship covers them. It does not. Even a customer who bought from you yesterday needs to have given you prior express written consent to get marketing texts on their mobile number.
The written consent has to be signed (an electronic signature counts under E-SIGN), has to clearly authorize texts from your company specifically, has to describe what the texts are for, and has to include a notice that consent is not a condition of purchase [3]. A checkout checkbox saying "I agree to the terms of service" is not enough unless those terms clearly and conspicuously describe the text program.
For building a compliant SMS program from scratch, the text message marketing guide covers consent capture in detail.
The FCC's 2024 one-to-one consent rule (effective January 27, 2025) stacked on another layer: one consent cannot cover multiple unrelated sellers [6]. If you are a lead generator passing leads to third-party buyers, the EBR argument is doubly beside the point. You now need individual written consent naming each buyer.
What are the real-world consequences of misreading the EBR exemption?
Statutory damages under 47 U.S.C. § 227(b)(3) are $500 per violation for negligent violations and $1,500 for willful or knowing ones. Each call or text is a separate violation. A modest campaign of 10,000 texts to existing customers without proper written consent is $5 million to $15 million of exposure before you even reach class certification [2].
Classes get certified in these cases. Courts have found TCPA claims well-suited to class treatment because the core question, did the defendant have consent, is common to every class member and answerable from company records.
Big settlements reflect that math. The Credit One Bank TCPA settlement reached $12.5 million. The Truist Bank TCPA settlement closed at $8.7 million. The Cash App TCPA class action and the Albertsons/Safeway case both grew out of consumer-company settings where the defendant presumably thought it had some form of prior relationship.
None of that saves you if the relationship missed the EBR definition, if calls went to cell phones by autodialer, or if the company lacked the documentation to prove the exemption applied.
For smaller outbound teams, the real risk is not always a class action. A single plaintiff can collect $500 to $1,500 per call without proving any actual damages, which is why TCPA suits are popular with contingency-fee attorneys. One serial plaintiff who fields 20 unwanted calls can sue for $30,000, and from their seat that is well worth the filing fee.
How should you document an EBR to defend against a TCPA claim?
Documentation is your entire defense. If you cannot prove the EBR at the moment of the call, you cannot use the exemption.
At a minimum, your CRM or telephony records should capture the consumer's phone number, the type of qualifying event (transaction or inquiry), the exact date of that event, and proof that no internal DNC request was on file for that number when the call went out.
For transactions, keep purchase confirmations, payment timestamps, and order IDs. For inquiries, keep form submissions, call recordings, or chat transcripts showing the consumer asked about your products first. "We sent them an email and they opened it" is not an inquiry. "They submitted a quote request form" is.
Date your suppression entries too. If a consumer asked for no more calls, you need to show when the request came in and that nothing went out after it was logged. A clean gap in call records after a DNC request is good. A dial attempt two days after the request is very bad.
LeadCompliant's free TCPA compliance kit includes a consent and EBR documentation template that small outbound teams can adapt to their CRM. It is not a legal opinion and does not replace one, but it gives you a starting structure.
For high call volumes, a real-time DNC scrubbing integration between your CRM and your dialer is the only reliable way to stop calls after revocation. Manual export and import processes have timing gaps, and timing gaps are liability.
Does the EBR exemption help with calls made by third-party lead generators or intermediaries?
Rarely, and you should not count on it. When a lead generator collects an inquiry, the 3-month EBR clock starts for the lead generator, not for the company that buys the lead. The downstream buyer does not inherit the EBR because a third party once had a relationship with the consumer.
The FCC has held consistently that companies can be vicariously liable for calls made by third-party lead generators on their behalf when the company had actual or apparent authority over the caller or ratified the calling conduct [8]. Courts have found brand and retailer liability under this theory even when the brand had no contact with the consumer until after the call.
Some lead-gen agreements try to pass EBR or consent along by contract. That helps if the underlying consent is real and transferable. But EBR is not consent. It is an exemption tied to the specific relationship between one consumer and one entity, and it does not transfer by contract.
For text messaging marketing programs that run on purchased leads, the only safe path is prior express written consent that names your company as the sender, captured before any texts go out. The FCC's 2024 one-to-one consent rule made that explicit for lead generation [6].
What should outbound teams actually do right now?
Start with an honest audit of every number you are calling and the legal basis you are relying on for each one.
For residential landlines, confirm the EBR timestamps in your CRM sit inside the window (18 months for transactions, 3 months for inquiries) and that no internal DNC request exists. Scrub all of those numbers against the National DNC Registry before each campaign [5].
For cell phones, stop relying on EBR. You need prior express written consent on file for each number you call with an autodialer or prerecorded message, and for each marketing text you send. Go back and check how that consent was captured. A verbal statement on a call recording is arguably fine for calls (though written consent is the safer standard for all marketing now). It is not enough for texts.
Audit your suppression process. List every channel a consumer can use to ask for no more calls (customer service calls, inbound texts, web forms, emails) and confirm all of them feed one suppression database your dialers check before each campaign.
Working with lead generators or affiliates? Demand to see the exact consent language the consumer saw and agreed to. If they cannot produce it, do not make the calls.
TCPA cases turn on facts. Good documentation saves you. Bad documentation sinks you. Build the documentation system before the demand letter shows up, not after.
For ongoing enforcement trends, the TCPA news section tracks new FCC orders, notable settlements, and circuit court decisions as they land.
Frequently asked questions
Does an existing business relationship let you call cell phones under the TCPA?
No. The EBR exemption applies only to calls to residential landlines under the FCC's Do-Not-Call rules. Calls to cell phones using an autodialer or prerecorded voice require prior express written consent under 47 U.S.C. § 227(b)(1)(A). The FCC explicitly rejected EBR as a substitute in its 2012 Report and Order (FCC 12-21). Using EBR to justify cell-phone autodialed calls is the most common and most expensive TCPA mistake.
How long does the TCPA existing business relationship last?
Eighteen months from the date of a purchase or completed transaction, or three months from the date of a consumer inquiry or application about your products or services. The clock resets with each new qualifying event. If a consumer places themselves on your internal do-not-call list, the EBR ends immediately, no matter how recent the transaction. See 47 C.F.R. § 64.1200(f)(5).
What counts as a transaction for TCPA EBR purposes?
A completed purchase, payment, or exchange of consideration between the consumer and your company. A quote, estimate, or unaccepted proposal is not enough. A completed credit application is arguably a transaction, or at minimum a 3-month inquiry. Passive actions like opening an email or visiting your website do not qualify. Document the date and nature of each transaction in your CRM, because that timestamp is your defense in litigation.
If a customer opted into texts two years ago, is that still valid consent?
Yes, if the consent met TCPA written-consent standards and the consumer has not revoked it. But the FCC's 2024 one-to-one consent rule (effective January 27, 2025) requires consent that is specific to your company and not bundled with consents to other unrelated sellers. If your two-year-old consent was a blanket form covering multiple companies, it may no longer meet the current standard. Review your consent language against the new rule.
Can a company use the EBR exemption for prerecorded calls to existing customers?
Only for calls to residential landlines, only if the consumer has not revoked, and only inside the open EBR window. Prerecorded telemarketing calls to cell phones require prior express written consent regardless of any relationship. Prerecorded calls to residential lines also have to include an automated opt-out mechanism, per 47 C.F.R. § 64.1200(b). Skipping that mechanism is a separate TCPA violation on top of any consent problem.
Does the TCPA EBR exemption apply to text messages?
No. EBR is not a recognized basis for sending marketing texts via autodialer to cell phones. Marketing texts require prior express written consent under 47 U.S.C. § 227(b)(1)(A) and the FCC's 2012 TCPA order. An existing customer relationship, however genuine and recent, does not satisfy that requirement. Many class actions against retailers and financial services companies turned on exactly this misunderstanding.
What happens if you call someone on the National Do Not Call Registry using the EBR defense?
If the EBR is valid (residential line, inside the time window, no internal DNC request), the call is permitted despite the number being registered. If any element fails, including a lapsed window or a prior internal DNC request, the registration creates separate liability. The FTC and FCC both enforce DNC violations, and penalties run up to $51,744 per violation under the Telemarketing Sales Rule.
Can a consumer revoke EBR protection mid-call?
Yes. A verbal request to stop calling, to go on the do-not-call list, or any clear revocation during a call ends the company's EBR-based calling right immediately. The company has to honor the request within 30 days and keep the suppression for at least 10 years. Training agents to catch and immediately log these statements is not optional. It is a core compliance control.
Does purchasing a company or customer list transfer the EBR to the buyer?
Generally no. EBR is tied to the prior relationship between the consumer and a specific entity. A company that acquires another's customer database does not automatically inherit that company's EBR. In a true merger where the legal entity continues, there is a stronger argument the EBR survives. Asset purchases are riskier. Get a written legal opinion before treating an acquired list as EBR-covered.
Is EBR the same as implied consent under the TCPA?
Related but different. EBR is a defined regulatory exemption from certain DNC-list obligations for residential lines. Implied consent is a judicial doctrine some courts used to find that a consumer who gave their number in a business context implicitly consented to related calls. Courts have narrowed implied consent since FCC clarifications in 2012 and 2015. Neither concept protects autodialed marketing calls to cell phones without written consent.
How do courts determine whether an EBR was valid at the time of a TCPA call?
Courts look at company records: the CRM entry showing the qualifying transaction or inquiry, the timestamp, the phone number on file, and any suppression-list records. If the company cannot produce these records in discovery, it loses the exemption. Courts have also examined whether the transaction was genuine and voluntary, not a manufactured or incidental event designed to create a calling window.
What TCPA settlements show the cost of getting EBR wrong?
Several large class actions settled in the range of $8 million to $12.5 million against financial services and retail companies that called or texted existing customers without adequate written consent, mistakenly relying on the prior relationship. The Credit One Bank case settled for $12.5 million and the Truist Bank case for $8.7 million. Statutory damages of $500 to $1,500 per call, combined with class certification, build these ranges fast.
Does the EBR exemption cover calls made by a third-party collection agency on behalf of a creditor?
This is contested. Debt collectors calling for creditors have argued the creditor's EBR with the debtor extends to the collector's calls. Some courts accepted agency-theory arguments; others did not. The CFPB's Regulation F and the FDCPA add more layers for collection calls. Do not treat a creditor's EBR as automatically transferable to the collector without specific legal review of your state's case law and the agency relationship.
If a customer inquired but never bought, does the 3-month EBR window apply?
Yes. An inquiry or application about your products or services opens a 3-month EBR window for residential-line calls. That covers a quote request, a demo request, or a submitted loan application. It does not cover passive activity like visiting your website without a form submission. After 3 months, or immediately upon a DNC request, the window closes and the number becomes a cold contact.
Sources
- FCC, 47 C.F.R. § 64.1200(f)(5) - Existing Business Relationship Definition (eCFR): EBR defined as a prior relationship within 18 months of a transaction or 3 months of an inquiry; consumer DNC request terminates EBR immediately
- U.S. Congress, 47 U.S.C. § 227 - Telephone Consumer Protection Act text (govinfo): Statutory damages of $500 per violation, trebled to $1,500 for willful violations; autodialer and prerecorded-voice restrictions on cell phones
- Satterfield v. Simon & Schuster, 569 F.3d 946 (9th Cir. 2009): Ninth Circuit held consent for one purpose does not automatically extend to unrelated marketing communications
- FTC, Telemarketing Sales Rule 16 C.F.R. § 310 - Do Not Call Registry provisions: EBR is a recognized exemption to National DNC Registry obligations; companies must honor internal DNC requests within 30 days and maintain suppression for 10 years
- FTC, National Do Not Call Registry, Federal Trade Commission: FTC and FCC share DNC enforcement; FTC penalties up to $51,744 per TSR violation
- Federal Court Dockets, Credit One Bank TCPA Settlement (N.D. Ill.): Credit One Bank TCPA class action settled for $12.5 million
- Federal Court Dockets, Truist Bank TCPA Settlement: Truist Bank TCPA class action settled for $8.7 million
- FCC, 47 C.F.R. § 64.1200(b) - Prerecorded Call Requirements (eCFR): Prerecorded telemarketing calls to residential lines must include an automated interactive opt-out mechanism