CAN-SPAM physical address: PO Box rules

Yes. U.S. commercial email generally must contain the sender’s valid physical postal address. That address may be the sender’s current street address, a Post Office box the sender has accurately registered with the U.S. Postal Service, or a private mailbox the sender has accurately registered with a commercial mail receiving agency established under USPS regulations.

A business owner therefore does not have to publish a home address merely because the business has no office. A properly registered USPS PO Box or qualifying private mailbox can provide a compliant alternative. A “virtual address,” coworking address, registered-agent address, or email service provider’s address is not automatically valid just because a vendor lets you print it.

What counts as a valid CAN-SPAM physical address?

ADDRESS TYPE                         STATUS             VERIFY
Current business street address       expressly listed   current address of sender
Current home street address           expressly listed   privacy and business policy
USPS Post Office box                  expressly listed   accurately registered to sender
Private mailbox at qualifying CMRA    expressly listed   registered + USPS-compliant format
Virtual mailbox                       depends             is it a registered CMRA mailbox?
Coworking or virtual office address   depends             is it sender's current address?
Registered-agent address              not automatic       does it independently qualify?
ESP or marketing agency address       usually wrong party which business is the sender?
Friend's or unrelated address         unsupported         do not use merely for concealment
Fake, stale, or mail-drop-only text    no                  validity and sender connection fail

The precise definition appears at 16 CFR 316.2(p). The word accurately matters. Renting a box under a different person, copying an address from a website, continuing to print an expired mailbox, or using a provider’s location without a valid sender relationship does not become compliant because the text resembles a postal address.

Can you use a PO Box for CAN-SPAM?

Yes. The FTC’s business guide says a commercial message may use a Post Office box registered with the U.S. Postal Service. The regulation says it must be a box the sender has accurately registered. Use the business or sender name associated with the registration, the complete PO Box number, city, state, and ZIP Code, and keep the rental active while the address appears in messages.

Northstar Goods LLC
PO Box 1842
Portland, OR 97208

Why you received this: product news requested at northstargoods.example
Manage preferences · Unsubscribe

• Confirm the legal or operating sender can receive mail at the box; do not use a contractor’s personal box by default.
• Preserve the current registration, payment, renewal date, authorized recipient, and access owner in the compliance record.
• Update every active template and automation before closing or changing the box.
• Send a physical test letter periodically and investigate returns or access failures.
• Do not label a private commercial mailbox as “PO Box”; USPS reserves that terminology for Postal Service boxes.

Can you use a private mailbox or UPS Store address?

A private mailbox can qualify when the sender accurately registers it with a commercial mail receiving agency, or CMRA, established under USPS regulations. Many mailbox stores and virtual-mail providers operate as CMRAs, but the brand name alone does not establish that a specific product, location, registration, or customer address qualifies. Ask the provider and verify the actual registration process.

USPS Publication 28 says private mailbox addresses must include either the PMB identifier or a # sign followed by the mailbox number. It also says a private mailbox must not be represented as a USPS PO Box. If the CMRA street address already contains a secondary unit such as Suite, use the provider’s exact USPS-compliant format rather than combining numbers creatively.

Northstar Goods LLC
123 Market Street PMB 418
Portland, OR 97205

OR, where the CMRA supplies this exact format:

Northstar Goods LLC
123 Market Street #418
Portland, OR 97205

Use the registered address supplied by the CMRA. Do not rename a PMB as a suite
or PO Box to make the business appear to occupy an office it does not occupy.

Does a virtual business address qualify?

“Virtual address” is a product description, not a category in the CAN-SPAM Rule. The service may provide a properly registered private mailbox at a CMRA, a real office the business actually uses, simple mail forwarding, a registered-agent location, or only permission to display an address. Those arrangements are not interchangeable.

1. Is this location a USPS-recognized commercial mail receiving agency?
2. Will the sender be registered as an addressee for this exact mailbox?
3. Which customer and identity forms are required?
4. What exact address and PMB/# format must appear on mail?
5. Can the business receive ordinary and accountable mail there?
6. How are scanned mail, forwarding, retention, and former-customer mail handled?
7. What happens to the address when billing fails or the location closes?
8. Can the provider document the active mailbox relationship?

Have counsel review any arrangement that does not fit the street, USPS PO Box,
or registered CMRA private-mailbox categories cleanly.

A coworking address may independently be the sender’s current street address when the business genuinely operates and receives mail there under its agreement. A registered-agent address exists primarily for legal service and filing obligations; do not assume permission to receive legal documents makes it the sender’s current street address or registered private mailbox for CAN-SPAM. Verify the facts and contract rather than relying on the label.

Whose address belongs in the email?

Use the valid address of the CAN-SPAM sender, not automatically the software platform, agency, affiliate, printer, or freelance operator that assembled the campaign. The statutory sender is tied to the person whose commercial product, service, or website is promoted and who initiates the message. When several marketers are promoted, the FTC describes conditions for designating one of them as the sender.

Does every email need a physical address?

The address requirement applies to commercial electronic mail messages covered by CAN-SPAM, not literally every email a system sends. A message containing only transactional or relationship content is generally exempt from most commercial-message provisions, although it still may not contain materially false or misleading routing information. Mixed messages require a primary-purpose analysis based on the subject and how commercial content appears in the body.

MESSAGE                               LIKELY STARTING CLASSIFICATION
Permission-based product newsletter   commercial; address requirement applies
Sale, launch, coupon, or promotion     commercial; address requirement applies
Browse or cart marketing reminder      commercial in ordinary use; review facts
Password reset only                    transactional/relationship
Purchase receipt only                  transactional/relationship
Security alert only                    transactional/relationship
Receipt led by a large unrelated sale  mixed purpose; review subject and body

An internal template name is not the legal classification. Analyze the message
recipients actually receive, including subject, hierarchy, graphics, and links.

Many platforms add a consistent compliance footer to all external email because it simplifies operations and causes little harm, even where a pure transactional message may not require it under CAN-SPAM. That is an architectural choice, not proof that every message has the same legal purpose.

Consent does not remove the address requirement

Prior affirmative consent can affect CAN-SPAM’s requirement to identify a commercial message as an advertisement or solicitation. It does not remove the separate requirements for a valid physical postal address and an opt-out mechanism. A double-opted-in subscriber should still receive the sender’s qualifying address in covered commercial email.

Where should the physical address appear?

CAN-SPAM requires the message to contain the address but does not prescribe one universal visual footer layout. The footer is the conventional location because it keeps sender identity, address, preference information, and unsubscribe controls together. Place the complete address directly in readable message text. A contact-page link alone does not put the address in the message and should not be treated as an equivalent substitute without legal review.

• Include the sender’s recognizable business or operating name with the address.
• Use complete street or box information, locality, region, postal code, and country where appropriate.
• Render it as live text in HTML and in the plain-text alternative; do not hide it inside an image.
• Keep type readable and contrast sufficient; do not camouflage required information against the background.
• Pair the address with the correct preference and unsubscribe routes, but do not imply the address itself is an opt-out method.
• Inspect the final compiled email after templates, providers, link rewriting, and localization—not only the editor preview.

A complete commercial-email footer

You are receiving Northstar product updates because you subscribed on
August 3, 2026 at northstargoods.example.

Northstar Goods LLC
123 Market Street PMB 418
Portland, OR 97205
United States

Manage preferences · Unsubscribe

This inbox is monitored. You can also reply with questions.

Replace every field with verified sender data. The subscription explanation and
reply language are useful trust elements, not substitutes for legal requirements.

The address is only one CAN-SPAM requirement

A valid address does not make an otherwise unlawful or deceptive campaign compliant. The FTC’s current business guide also emphasizes accurate header and routing information, a non-deceptive subject, advertisement identification where required, a clear opt-out method, prompt suppression, and oversight of vendors and promoted businesses.

IDENTITY       From, To, Reply-To, domains, and routing are accurate
SUBJECT        accurately reflects the complete message
AD DISCLOSURE  clear and conspicuous where the consent exception does not apply
ADDRESS        valid physical postal address of the sender appears in message
OPT OUT        clear notice and functioning reply or single-page mechanism
AVAILABILITY   opt-out works for at least 30 days after transmission
SUPPRESSION    covered requests honored within 10 business days
DATA USE       opted-out address protected from prohibited sale or transfer
VENDORS        sender, agency, affiliate, and ESP responsibilities monitored
PURPOSE        transactional labels do not conceal commercial primary purpose

CAN-SPAM is also not the only rule. Other countries and U.S. state or sector laws can impose consent, notice, privacy, data-rights, profiling, or recordkeeping duties. Mailbox rules, corporate-registration rules, provider terms, and consumer-protection law can apply separately. Treat the footer as one control in a reviewed program, not a universal compliance certificate.

Address operations checklist

• Name the legal or operating sender for each project, brand, and message purpose.
• Select a current street address, accurately registered USPS PO Box, or accurately registered CMRA private mailbox.
• Keep the lease, registration, CMRA agreement, exact address format, renewal date, and access owner.
• Verify the company or sender name under which mail will be accepted.
• Set one source-of-truth address record rather than editing every template manually.
• Render the address into HTML and plain text at send time.
• Test marketing, automation, localized, API, and fallback templates for the same current value.
• Alert before box, office, or mailbox-service renewal and assign an offboarding owner.
• Send periodic test mail and document returned, refused, or inaccessible items.
• Pause affected campaigns if the address becomes invalid; do not leave stale footers running during migration.

Frequently asked questions

Can I use a PO Box for CAN-SPAM?

Yes. The current rule expressly permits a Post Office box the sender has accurately registered with the U.S. Postal Service. Keep it active and print the complete registered address in covered commercial messages.

Can I use a UPS Store or other private mailbox?

A private mailbox can qualify when the sender accurately registers it with a commercial mail receiving agency established under USPS regulations. Verify the specific location and service, complete the required registration, and use the provider’s exact PMB or # address format. Do not call it a PO Box.

Can I use a virtual office address?

Not automatically. Determine whether it is genuinely the sender’s current street address or an accurately registered private mailbox at a qualifying CMRA. Permission to display a prestigious address or receive occasional forwarded mail does not by itself establish either category.

Can I use my registered agent’s address?

Do not assume so. A registered agent’s authority to receive legal process is different from being the sender’s current street address or a mailbox the sender registered under the CAN-SPAM Rule. Review the service contract, actual mail relationship, sender identity, and rule with counsel.

Can I use my home address?

A current home street address can fit the rule’s street-address category when it is genuinely the sender’s address, but publishing it creates privacy and safety concerns. A registered USPS PO Box or qualifying CMRA private mailbox is often a better operational choice for a home-based business.

Do opted-in subscribers still need to see the address?

Yes, for covered commercial email. Prior affirmative consent affects the advertisement-identification provision, not the separate valid-address and opt-out provisions. Permission to send does not erase the sender-location requirement.

Are B2B emails exempt from CAN-SPAM?

No general B2B exception appears in the FTC’s guidance. CAN-SPAM applies to commercial messages, including email promoting products or services to other businesses. Analyze the message purpose and recipient context rather than assuming a corporate domain is exempt.

Can I use my email platform’s postal address?

Usually not merely because the platform transmitted the email. The message needs the valid address of the CAN-SPAM sender identified under the facts and any valid multi-marketer designation. Configure the customer or promoted business correctly instead of borrowing the ESP’s office address.

Does the address have to be in the footer?

The rule requires the message to contain the address but does not prescribe one universal footer design. A readable text footer is the established pattern because recipients can find sender identity, postal address, preferences, and opt-out controls together. Include it in both HTML and plain text.