TCPA existing business relationship: what it covers and what it doesn't

Last updated 2026-07-09

What is an existing business relationship under the TCPA?

An existing business relationship, usually shortened to EBR, is a legally defined exemption that lets a business contact someone who is on the Do Not Call registry without first collecting fresh written consent. The definition comes from FCC regulations implementing 47 U.S.C. § 227, and the agency has spelled it out across several orders. ^[1]

The FCC defines an EBR as "a prior or existing relationship formed by a voluntary two-way communication between a person or entity and a residential subscriber with or without an exchange of consideration, on the basis of the subscriber's purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call or on the basis of the subscriber's inquiry or application regarding products or services offered by the entity within the three (3) months immediately preceding the date of the telephone call." ^[2]

That quote matters. Read it twice. There are two clocks in there, not one. A purchase gives you 18 months. An inquiry, application, or quote request gives you 3 months. A lot of teams get this backward and assume any contact buys them a year and a half.

The EBR concept predates modern texting. It was written mainly with landline telemarketing in mind, and that history creates real gaps the moment you try to stretch it over cell phones and SMS campaigns.

Does the EBR exemption apply to cell phones and text messages?

Not reliably, and you should not build a program on it for cell phones. This is where companies wreck themselves.

The EBR defense was written mainly for calls to residential landlines on the National Do Not Call Registry. 47 U.S.C. § 227(a)(4) defines an EBR, but the statute's autodialer prohibition at § 227(b)(1)(A) requires "prior express consent" for calls to cell phones made with an autodialer or prerecorded voice. ^[3] The EBR is not on the list of exceptions to that rule.

The FCC has confirmed the distinction more than once. In its 2003 Report and Order (FCC 03-153), the agency explained that the EBR exemption in the do-not-call context applies to residential lines, and that calls to wireless numbers get a separate consent analysis. ^[4]

Here is the practical split. You can, in theory, use an EBR to justify calling a prior customer's home landline despite their DNC registration. You cannot use it as a standalone defense for a ringless voicemail or an autodialed text to that same customer's cell. Cell phones need prior express consent, and marketing texts need prior express written consent.

One narrow carve-out exists. If your agent manually dials a cell number, with no autodialer and no prerecorded message, the autodialer prohibition does not apply at all, and an EBR could factor into the DNC analysis for that call. Most outbound teams are not fully manual-dialing at scale, so this edge case rarely saves anyone.

For SMS compliance in detail, see text message marketing and text messaging marketing.

How long does an EBR last, exactly?

The windows are fixed by FCC rule. Transactions get 18 months. Inquiries get 3 months. A do-not-call request ends the EBR the second it happens.

Relationship type	EBR window
Purchase or financial transaction	18 months from the date of the last transaction
Inquiry, application, or quote request	3 months from the date of inquiry
Opt-out / do-not-call request	EBR terminates immediately; no further calls

The 18-month clock restarts every time the customer makes a new purchase or completes a new transaction. ^[2] A customer who buys from you every six months lives permanently inside the EBR window as long as they keep transacting.

The 3-month inquiry window is brutal for lead-gen. Someone fills out a form, asks about pricing, or requests a demo. You have 90 days to work that lead under the EBR before the exemption expires. After that, if you want to keep calling, you need separately documented consent.

One detail nobody talks about enough: the clock runs from the last transaction, not the first. A customer who bought in January 2024 and again in August 2024 keeps you inside the window until February 2026, not July 2025.

Even inside the window, a stated opt-out ends everything. The FCC is explicit that an EBR does not override a do-not-call request. ^[2] Keep calling after a consumer says stop, and you have lost the defense entirely. Full stop.

What counts as a "transaction" or "inquiry" for EBR purposes?

The FCC has not published an exhaustive list. The standard is whether there was a voluntary two-way communication the consumer started, with or without money changing hands. ^[2]

Things that usually qualify as transactions: completed purchases, paid subscriptions, signed service agreements, loan closings, insurance policy renewals, and account openings. Something of value changed hands, or a binding agreement got formed.

Things that usually qualify as inquiries: website contact forms, quote requests, demo sign-ups, free trial registrations, questions sent by email or phone, and applications of all kinds. The consumer reached out and asked about your products.

Things that probably do not qualify: visiting your site without filling out a form, clicking an ad, opening a marketing email, or getting referred by a third party without ever contacting you. Passive engagement creates no EBR.

That last point is a problem for companies buying leads. If a third-party generator gathered names and numbers and sold them to you, there is no EBR between you and those consumers unless they specifically inquired about your company's products. A shared or transferred EBR from one company to another is not a thing the FCC recognizes. ^[4]

Plenty of financial services companies have crashed into this wall. The UnitedHealthcare $2.5M settlement shows what happens when a company assumes inherited relationships equal call rights.

Can an EBR be transferred when a company is acquired?

Almost certainly not. This is a landmine for M&A activity.

The FCC has never ruled that a corporate successor inherits its predecessor's EBR with consumers. Courts and plaintiffs' attorneys treat the EBR as personal to the specific relationship between the consumer and the specific entity. When Company A buys Company B, Company A cannot assume it now holds an EBR with all of Company B's customers.

Acquisitions are not hopeless, though. If the successor gives actual notice to acquired customers, and those customers keep transacting (paying invoices, renewing subscriptions, logging in), that ongoing behavior can establish a fresh EBR with the new entity. You need a lawyer to structure that transition. A bulk import of the old CRM does not do it.

The same logic hits affiliate marketing and co-registration. A consumer who opted into Brand X's list does not have an EBR with Brand Y just because the two share a marketing arrangement. Courts have rejected the idea that consent or EBR status jumps sideways across corporate relationships. See how this played out in Truist Bank's TCPA settlement and the Albertsons/Safeway case for what happens when relationship assumptions collapse in litigation.

What does the EBR exemption actually protect you from?

The EBR covers one specific thing: it lets a business call a residential subscriber who is on the National Do Not Call Registry without breaking the DNC rules, as long as the EBR is valid and the consumer has not opted out. ^[5] That is the whole protection. It is narrower than people think.

It does not protect you from:

• Violating the autodialer prohibition for calls to cell phones (47 U.S.C. § 227(b))
• State do-not-call rules, which often have stricter EBR definitions or none at all
• TCPA claims based on prerecorded messages to residential lines where the consumer never transacted with you
• Calling numbers on your company's internal do-not-call list, which you must maintain separately
• Any call made after the consumer has clearly said they want the calls to stop

Some states, including Florida, California, and Indiana, have their own mini-TCPA statutes with EBR definitions that differ from the federal standard. Florida's Telephone Solicitation Act got tightened hard in 2021 and does not hand businesses the same EBR latitude that federal law does. ^[6] Sell into multiple states, and the federal analysis is never the only one that applies.

For ongoing regulatory changes, TCPA news is worth bookmarking.

How do courts actually evaluate EBR claims in TCPA lawsuits?

Courts look at documents: transaction records, CRM timestamps, inquiry logs, opt-out records. The burden of proving the EBR sits on the defendant, not the plaintiff. ^[7]

Your records are your defense. If you cannot produce a timestamped record showing when the consumer transacted or inquired, and showing the call landed inside the applicable window, you lose the defense in practice even if the EBR technically existed.

Courts get skeptical fast when defendants reconstruct EBR records from patchy CRM data or from lead vendors who cannot document their own sources. In class actions, the EBR defense often collapses at the certification stage because companies cannot show, class-wide, that every called consumer had a valid EBR. You end up in individualized inquiries that defeat commonality, and by then you have already burned real money on discovery.

The Credit One TCPA settlement and Joseph Snyder v. Credit One are instructive. A company claiming an EBR with customers it had called for years still faced enormous liability because the calls continued after opt-out requests, which kills the EBR defense no matter how long the relationship ran.

The TCPA's statutory damages tell you why this stays expensive: $500 per violation, rising to $1,500 for willful or knowing violations, with no cap on the number of calls in a class action. ^[12] The EBR defense did not save companies where the records were weak or the opt-out handling was sloppy.

What recordkeeping do you need to actually use the EBR defense?

If you cannot prove the EBR, you do not have the EBR. Let that sentence drive your data architecture.

At minimum, you need:

Transaction records: A database entry with the consumer's phone number, the transaction date, and the nature of the transaction, tied to the specific number you later called. If the consumer checked out with a different number than the one in your marketing CRM, you have a gap.

Inquiry records: A timestamped log of when the consumer submitted a form, requested a callback, or made an inquiry. Screenshots and web analytics rarely hold up alone. You want structured data in a system that is hard to alter after the fact.

Opt-out records: A log of every do-not-call request, the method (verbal, written, text reply), the date, and confirmation the number got suppressed within a reasonable time. The FTC's rule requires honoring do-not-call requests within 30 days, and most careful shops move faster, inside 10 business days. ^[5]

Calling records: A log of every call or text, the number dialed, the timestamp, and the system used. If you used an autodialer, that fact belongs in the record, because it changes which legal test applies.

LeadCompliant's free TCPA compliance kit includes a recordkeeping template built around these four categories. It is a decent starting point if you are building from scratch.

Retention: keep these records at least 4 years, which mirrors the statute of limitations federal courts most often apply to TCPA claims. Some attorneys say 5 years to cover state claims with longer limitations periods. ^[9]

How does the EBR interact with the National Do Not Call Registry?

The DNC registry is where the EBR does its most useful work. Under the FTC's Telemarketing Sales Rule at 16 C.F.R. § 310.4(b)(1)(iii)(B), which runs parallel to the FCC's TCPA rules, a seller or telemarketer may call a DNC-registered number if there is an EBR with that consumer. ^[10]

So if a former customer registers their home phone on the DNC list, you can still call that landline inside the 18-month transaction window. Once the window closes, or once they tell you directly to stop, you must stop.

This does not carry over to your internal do-not-call list. The TCPA and TSR both require companies to keep their own suppression list, separate from the national registry. ^[5] If a consumer asks you specifically not to call, they go on your internal list permanently. The EBR window closing does not reopen the door. They stay suppressed indefinitely unless they come back and start a new relationship themselves.

For high-volume outbound, the workflow is simple to state and easy to skip. Before each dial session, scrub against the national DNC registry, your internal do-not-call list, your EBR expiration dates, and your wireless number flags. Miss any one layer, and you are in class action territory. See how to stop robocalls for the consumer-side view that explains why enforcement pressure stays high.

What are the biggest mistakes companies make with the EBR defense?

A handful of failure patterns show up again and again in TCPA litigation.

Mistake 1: Assuming the EBR covers cell phones. It does not touch the autodialer prohibition. Build your program on EBR, then autodial or text cell phones, and you have no defense for those contacts.

Mistake 2: Treating a third-party lead's EBR as your own. Buy a lead list, and you inherit nothing. The consumer inquired about someone else's company. Courts have rejected this argument over and over.

Mistake 3: Not logging opt-outs in real time. A rep who scribbles an opt-out in a personal spreadsheet, or forgets to log it, sets up the next dial session to call a number that should be dead. At that point the EBR is gone and the call is indefensible.

Mistake 4: Applying one window to every relationship type. The 18-month and 3-month windows are different. Apply 18 months to inquiry-only leads, and you are operating outside the EBR for the last 15 months of that made-up window.

Mistake 5: Ignoring state law. Florida, California, Indiana, and others run rules stricter than the federal EBR standard. A valid federal EBR does not immunize you from a state TCPA claim. ^[6]

The Cash App TCPA class action and the Kaiser TCPA settlement both show large organizations with real customer relationships still eating massive liability because their process controls failed at the operational level.

Should you rely on the EBR exemption, or get fresh consent instead?

Get fresh consent whenever you can. The EBR is a fallback, not a strategy.

The EBR is time-limited, hard to prove in court, useless against cell phone autodialing, subject to state variation, and destroyed the moment you miss an opt-out. Properly documented written consent is durable, auditable, and works for every channel including SMS.

Getting consent costs less than most teams think. A well-placed checkbox on a purchase confirmation page, a short consent block on a lead form, or an SMS opt-in confirmation can establish documented consent for the whole future relationship. Do it once, store it with a timestamp and the exact language shown, and you have something you can hand a judge.

The EBR earns its keep in two spots: contacting recent customers about a real business matter before you have collected new consent under post-2013 standards, and calling a DNC-registered residential landline for a customer who recently transacted and has not opted out.

Outside those two spots, an outbound program built on EBR alone is built on sand. Treat it as insurance, not infrastructure.

LeadCompliant's compliance kit includes consent language templates and a free TCPA consent checker you can run against your existing lead records before the next dial session.

What does the FCC's 2024 one-to-one consent rule mean for EBR?

The FCC issued a Report and Order in December 2023 requiring prior express written consent to be obtained one-to-one, meaning a consumer who consents on a comparison shopping site cannot have that consent shared with a stack of sellers at once. ^[11] The lead generation piece was set to take effect in early 2025 before further litigation and FCC action changed the timeline.

The rule tightened the consent landscape hard for lead-gen. It does not directly eliminate the EBR for residential DNC calls, but it makes the EBR more important for companies that leaned on shared-consent lead buys. Those shared consents, to the extent they ever worked, do not satisfy the prior express written consent requirement for cell phone autodialing.

The practical effect: companies already treating EBR as a backup for purchased leads are now in a weaker spot. The consent chain they thought they had is legally thin, and the EBR they thought they inherited from a third party was never valid to begin with.

If your lead acquisition depended on co-registration or aggregator consent, this changes your business model. You either collect consent directly from each consumer with your company specifically named, or you find a different way to go to market. The EBR will not fill that gap.

Frequently asked questions

Does an existing business relationship let me ignore a do-not-call request?

No. The FCC is unambiguous that a consumer's do-not-call request overrides any existing business relationship. The moment a consumer asks you not to call, you must add them to your internal suppression list and honor that request permanently. Continuing to call after an opt-out destroys the EBR defense entirely and exposes you to per-call TCPA liability.

How long does the EBR last after a customer makes a purchase?

18 months from the date of the last transaction. The clock restarts with each new purchase. An inquiry or application only creates a 3-month window, not 18 months. This distinction matters enormously for lead-gen pipelines where prospects ask for quotes but never buy.

Can I text a former customer under the EBR exemption?

Not safely, if you are using an autodialer or mass-texting platform. The EBR exemption covers the do-not-call residential landline rules. For autodialed or prerecorded texts to cell phones, the TCPA requires prior express written consent under 47 U.S.C. § 227(b), and the EBR is not a listed exception to that requirement.

Does buying a lead list create an EBR with those consumers?

No. The consumer did not inquire about your company; they inquired about whoever generated the lead. Courts have consistently rejected the idea that an EBR transfers from a lead seller to a lead buyer. If you want call rights with purchased leads, you need to collect consent directly, with your company specifically identified, before you dial.

What happens to the EBR if a company is acquired or merges with another?

The EBR almost certainly does not transfer automatically. The relationship is between the consumer and the specific entity they transacted with. An acquiring company should assume it has no EBR with the target's customers and either collect fresh consent or allow new transactions to establish a fresh EBR under the new corporate identity. Get legal advice before assuming otherwise.

Is the EBR definition the same under federal law and state law?

No, and this is a common trap. Several states have their own telemarketing laws with EBR definitions that are stricter than the federal standard, or that have no EBR exemption at all. Florida's Telephone Solicitation Act tightened its rules significantly in 2021. A valid federal EBR does not immunize you from state-law claims. You need to check every state where your targets reside.

What records do I need to prove an EBR in court?

You need timestamped transaction or inquiry records tied to the specific phone number you called, opt-out logs showing you suppressed do-not-call requests, and call logs showing the timing of each contact relative to the EBR window. Reconstructed or incomplete CRM records rarely hold up in litigation. Courts put the burden of proving the EBR on the company making the calls.

Can a consumer reinstate an EBR after opting out?

Yes, if the consumer affirmatively re-initiates contact and completes a new transaction or inquiry after the opt-out. The prior opt-out does not permanently bar them from doing business with you; it just means you cannot call them until they come back on their own. Do not interpret any inbound contact as automatic EBR reinstatement without a clear transaction or inquiry.

How does the FCC's 2024 one-to-one consent rule affect companies relying on EBR?

The rule requires prior express written consent to be one-to-one: the consumer must consent to your specific company, not a broad category of sellers. This does not eliminate the EBR for DNC landline calls, but it closes off shared-consent lead buys as a path to cell phone call rights. Companies that relied on aggregator consent now have less of a fallback and need to collect direct consent.

What is the TCPA penalty if I call outside the EBR window?

The baseline TCPA penalty is $500 per violation, which means per call or text. If a court finds the violation was willful or knowing, that rises to $1,500 per violation. There is no statutory cap on the number of violations in a class action. Settlements in large cases have reached into the tens of millions of dollars, which is why recordkeeping around EBR windows is worth taking seriously.

Does a free trial or free account registration create an EBR?

Probably yes, if the consumer voluntarily registered and there was a two-way communication. A free trial sign-up is generally treated as an inquiry, which gives you the 3-month window. If the consumer upgrades to a paid account, that transaction resets the clock to the 18-month window. Keep the registration timestamp and link it to any phone number collected at sign-up.

Can I use EBR to call numbers on the national DNC registry?

Yes, that is precisely what the EBR exemption is designed for in the DNC context. If a consumer is on the national DNC registry but has a valid EBR with your company (purchase within 18 months or inquiry within 3 months, no opt-out request), you may call their registered residential number. The exemption does not apply to your internal do-not-call list or to cell phone autodialer rules.

How often should I audit my EBR records?

At minimum, before every outbound campaign. Run your dial list against transaction and inquiry timestamps to flag anyone whose EBR window has closed. Many compliance teams do this with an automated query at the CRM level so no stale records slip through. Quarterly audits of the overall record structure, to ensure timestamps and opt-out logs are being captured correctly, are also worth building into your calendar.

Sources

1. Legal Information Institute, Telephone Consumer Protection Act, 47 U.S.C. § 227: The TCPA is implemented under 47 U.S.C. § 227, and the FCC issues regulations and orders under that statute governing telemarketing calls and texts.
2. Legal Information Institute, 47 C.F.R. § 64.1200 (FCC EBR definition, codifying FCC 03-153): The FCC defined EBR as a prior or existing relationship formed by voluntary two-way communication, with an 18-month window for transactions and a 3-month window for inquiries, and specified that a do-not-call request terminates the EBR.
3. Legal Information Institute, 47 U.S.C. § 227(b)(1)(A): 47 U.S.C. § 227(b)(1)(A) prohibits autodialed or prerecorded calls to cell phones without prior express consent; the EBR is not listed as an exception to this prohibition.
4. FTC, Complying with the Telemarketing Sales Rule: Sellers must maintain an internal do-not-call list, honor do-not-call requests within 30 days, and suppress those numbers regardless of any EBR.
5. Florida Legislature, Florida Telephone Solicitation Act, Fla. Stat. § 501.059: Florida's Telephone Solicitation Act was significantly tightened in 2021 and contains EBR provisions that differ from and are stricter than the federal TCPA standard.
6. FTC, National Do Not Call Registry Data Book: The FTC's DNC Data Book documents enforcement actions and complaint volumes related to telemarketing violations, providing context for the scale of DNC enforcement.
7. FTC, Telemarketing Sales Rule, 16 C.F.R. § 310.4(b)(1)(iii)(B): Under 16 C.F.R. § 310.4(b)(1)(iii)(B), a seller or telemarketer may call a DNC-registered number if there is an established business relationship with that consumer.
8. Legal Information Institute, 28 U.S.C. § 1658: Federal courts commonly apply a 4-year statute of limitations to TCPA claims under 28 U.S.C. § 1658, supporting the recommendation to retain compliance records for at least 4 years.
9. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: The TSR at 16 C.F.R. § 310.4(b)(1)(iii)(B) provides the EBR exemption allowing calls to DNC-registered residential numbers where an established business relationship exists.
10. Legal Information Institute, 47 U.S.C. § 227(b)(3): The TCPA provides statutory damages of $500 per violation, rising to $1,500 per willful or knowing violation, with no statutory cap on the number of violations.