Any organization that runs automated phone outreach faces the same compliance risk: calling someone you have a history with, but without the legal proof to back it up. That proof is called an Established Business Relationship (EBR). It is a narrow, time-limited protection.
Organizations that treat it as a broad pass expose themselves to violations the moment they skip proper documentation.
This guide covers what EBR is, where it applies, what voids it, and how to run compliant outreach within it.
What is an Established Business Relationship (EBR)?
An Established Business Relationship (EBR) is a legal exemption that allows organizations to contact people on the National Do Not Call Registry without additional consent, provided a qualifying transaction or inquiry occurred within a specified time window.
| NOTE: EBR applies only to automated prerecorded voice calls to residential landlines, not to cell phones or live manual calls. As per the FCC’s Report, the EBR exemption was established specifically for prerecorded or artificial voice telemarketing calls to residential lines. |
EBR comes in two forms. Each has its own time window and its own definition of what qualifies.
| EBR type | Definition | What qualifies | Window | Applies to |
| Transaction EBR | A contact completed a financial transaction or made a purchase from your organization. | Purchase, payment, donation, dues | 18 months | Prerecorded calls to residential landlines |
| Inquiry EBR | A contact submitted an inquiry to your organization. The window opens the moment the inquiry is made. | Information request, application | 90 days | Prerecorded calls to residential landlines |
Established Business Relationship (EBR) applies in two distinct legal contexts
Most compliance mistakes happen because teams treat EBR as a single rule. It is not. It operates in two separate legal frameworks, and confusing them is the most common source of exposure.
- EBR as a DNC exemption
The National Do Not Call Registry prohibits unsolicited calls to registered numbers. EBR creates an exception. If a contact made a purchase or donation within the last 18 months, or submitted an inquiry within the last 90 days, you may call that number even if it appears on the DNC list.
Where it applies to: This applies to all call types, including manual, autodialed, and prerecorded, as long as the other legal requirements for that call type are met.
- EBR as a TCPA prerecorded call exemption
The TCPA requires prior express written consent before placing prerecorded or artificial voice telemarketing calls. EBR provides a narrow exemption to this rule, but only for prerecorded calls to residential landlines.
Where it applies: It does not apply to mobile phones, and it does not substitute for consent for autodialed calls to any number.
What this means in practice fro businesses?
This table will help you understand when you are allowed to call using EBR for DNC and TCPA
| Scenario | DNC EBR applies? | Yes, within the window |
| Manual call to DNC-listed landline | Yes, within the window | Not relevant |
| Manual call to DNC-listed mobile | Yes, within the window | Not relevant |
| Prerecorded call to residential landline | Yes, within the window | Yes, within window |
| Prerecorded call to mobile | Yes, within the window | No — written consent required |
| Autodialed call to mobile | DOES TCPA EBR apply? | No — written consent required |
The practical rule: EBR gets you past the DNC list in most scenarios. It does not get you past the TCPA consent requirement for mobile phones.
Established Business Relationship (EBR) vs. consent: What is the difference?
EBR and consent are both legal bases for contact. They are not the same thing, and conflating them is one of the most common TCPA compliance mistakes outreach teams make.
| Category | EBR | Consent |
| Source | Post transaction or inquiry | Explicit agreement from the contact |
| Duration | 18 months (transaction) / 90 days (inquiry) | Until revoked |
| Form | Documented through organization records | Written, verbal, or electronic |
| Scope | Outreach is limited to the existing relationship | Broader outreach, if properly documented |
| Autodialer / ATDS | Does NOT cover automated calls to cell phones. Only covers voice broadcast/robocalls. | Covers automated calls with prior express written consent |
Remember: A contact who has given consent can be reached by an autodialer on a mobile device. A contact covered only by EBR cannot.
| The rule is simple: EBR and consent are two separate lanes. Know which lane each contact is in before the campaign goes out. |
Why outreach platforms need EBR (and what that means for your campaigns)
Federal law prohibits automated voice calls with business or promotional content unless the caller has prior express written consent or a verified EBR. This is not a platform policy. It is a TCPA requirement.
Why do platforms need to verify EBR before campaigns go live?
- A single non-compliant campaign exposes the platform and every user on it to legal liability.
- TCPA fines range from $500 to $1,500 per call. Campaigns routinely reach tens of thousands of contacts
- The law requires proof of the EBR before the first call is placed, not after
What do you need to do?
Two things are required before your campaign can go live:
- Complete STIR/SHAKEN verification
STIR/SHAKEN is a carrier-level authentication framework that verifies your caller ID. Without it, calls risk being flagged as spam or blocked, regardless of EBR status.
- Sign an attestation document
You will need to fill out and prepare this attestation document. In this document, you confirm that the recipients are existing customers or have recently interacted with your business or organization.
Here is the document attached:
These compliance measures are mandatory under federal telecom law and carrier policies. They help ensure your campaigns are:
- Legally compliant: You have a documented legal basis before the first call is placed
- Deliverable: Verified campaigns are not flagged or filtered by carriers
- Protected from carrier blocking: STIR/SHAKEN authentication is completed during the process.
| CallHub’s Support and Compliance Team will help you verify your campaign classification, complete the STIR/SHAKEN registration, and sign and submit the attestation documents. |
How to document EBR correctly (and why it is your only defense)
Every TCPA dispute lives or dies on what the organization can prove. EBR is not self-enforcing. No record means no exemption. To use EBR as a defense, your recordkeeping needs to be impeccable and always up to date. Here is the EBR documentation checklist to follow:
Every EBR contact record needs these six fields:
| Field | What to record |
| Type of EBR | Transaction or inquiry |
| Date established | Date of the qualifying transaction or inquiry |
| Expiry date | 18 months (transaction) or 90 days (inquiry) from that date |
| Phone type | Landline or mobile |
| Channel | Any marketing channel through which this contact reached or made a transaction |
| Opt-out status | Has this contact asked to stop receiving calls? |
Check state law before you dial.
Federal EBR rules are the floor, not the ceiling. Several states go further, like:
- Indiana, New Jersey, and Wisconsin do not recognize that transaction EBR consent is required
- Louisiana, which has a window of 6 to 12 months
- California and Colorado only allow a 1-month exemption for inquiry cases
State law follows the contact’s location, not your organization’s. Check each state before you run.
Established Business Relationship (EBR) is not a loophole. It is a protocol to be followed.
Organizations that document EBR correctly and treat it as the narrow, time-bound protection runs:
- Cleaner campaigns
- Avoid enforcement, and
- Keep access to the contacts that matter most.
The ones that do not find out at the worst possible time in terms of fines.
FAQs on EBR (Established Business Relationship)
1. What does EBR stand for?
EBR stands for Established Business Relationship, also known as an Existing Business Relationship. Both terms refer to the same legal concept under FCC rules.
2. What is an EBR in business?
EBR is a documented prior relationship: a purchase, donation, or inquiry that gives your organization two distinct legal protections: the right to call a DNC-registered number, and the right to place prerecorded calls to residential landlines without new written consent. Both protections are time-limited and require records to enforce
3. What is the acronym EBR?
EBR is short for Established Business Relationship. Under 47 CFR 64.1200(f)(5), it defines the prior contact history that qualifies an organization to call a registered number without new consent.
