My list is small and I only email people who signed up. Do I still need an address?

Yes. The requirement in 15 U.S.C. 7704(a)(5) is tied to the message being commercial, meaning its primary purpose is to advertise or promote something. It is not tied to list size or to whether the recipient opted in. The address requirement applies to commercial email as a category.

Does a UPS Store or other mailbox store box count?

It counts as the third category, a private mailbox at a commercial mail receiving agency, as long as you completed PS Form 1583 with the store and the form is accurately on file. Write it the way USPS requires: 'PMB' or '#' with your box number, either on its own line above the store's street address or on the same line as the street. USPS says not to write it as a suite number combined with the store's own suite.

Does a virtual office address satisfy CAN-SPAM?

If the location is registered with USPS as a CMRA, the address is a private mailbox at a CMRA and fits the third category once your Form 1583 is on file. If the location is an office building that receives your mail without a CMRA registration, the address is a street address. The rule does not define the phrase 'the sender's current street address' beyond those words, so for an unusual setup confirm with counsel. In both cases the address should be one where mail addressed to you is actually received.

CAN-SPAM Physical Address Requirement: The Rule Accepts Three Kinds of Address, and Your Home Is Only One of Them

Q: Can I use a PO box instead of my home address?

Yes. A Post Office box you have accurately registered with USPS is the second of the three categories in 16 CFR 316.2(p). The FTC kept it in the 2008 definition, and its rulemaking notice quoted small businesses and independent contractors who supported the definition for exactly that privacy reason. The condition is accurate registration: your name on the postal form, with the identification the form requires.

Short answer

The CAN-SPAM Act requires each commercial email to carry a valid physical postal address of the sender, and the Federal Trade Commission (FTC) compliance guide puts the penalty at up to $53,088 per email. The FTC rule (16 CFR 316.2(p)) defines that address as one of three things: your current street address, a Post Office box you have accurately registered with the Postal Service, or a private mailbox you have accurately registered with a commercial mail receiving agency (CMRA). When the FTC finalized that definition in 2008, its rulemaking notice quoted small businesses and independent contractors who backed the definition, with its two box options, because of the privacy concerns of people who work from home. A borrowed address at a friend's shop is not your own street address, and you are not the registrant of any box there. A CMRA box has to be written as PMB or # under United States Postal Service (USPS) rules.

Get your US address →

Key takeaways

The address requirement is federal law (15 U.S.C. 7704(a)(5)(A)(iii)), in force since January 1, 2004. It applies to commercial email regardless of list size, and the FTC guide says there is no exception for business-to-business email.
The FTC rule lists three valid addresses: your current street address, a USPS-registered PO box, or a private mailbox registered with a CMRA. The word 'accurately' is in the rule on purpose: a box that is not registered in your name is not a valid address.
The FTC finalized the PO box and private mailbox options after commenters, including small businesses and independent contractors, described the privacy concerns of people who work from home. Agencies can still obtain the registrant's identity from USPS records, which is why the FTC accepted the trade.
Two of the five platforms we read, Mailchimp and Kit, suggest a borrowed business address. Kit also offers its own PMB and describes a UPS Store box as a 'suite #'. The rule's first category is the sender's own address, the box categories require the sender's own registration, and USPS writes a CMRA box as 'PMB 123' or '#123'.

You set up your first newsletter and reach a field your email platform will not let you skip: a physical mailing address. You type the only one you have, where you live, and it prints at the bottom of every message from then on.

A thread on r/selfpublish opened with the reaction you may be having right now: wait, you have to use a real address for your newsletter? Yes. It is federal law, and it has been since January 1, 2004. The good news is one layer down. The Federal Trade Commission (FTC) rule that defines the address lists three kinds, and the agency's 2008 rule notice records that two of the three were supported with people in exactly your position in mind.

What the law requires, in its own words

The CAN-SPAM Act says it is unlawful to send a commercial email unless the message provides 'a valid physical postal address of the sender.' That is 15 U.S.C. 7704(a)(5)(A)(iii). The same subsection requires a clear opt-out notice and an identification that the message is an advertisement.

The FTC compliance guide explains who this covers. Commercial email is any message whose primary purpose is advertising or promoting a product or service, and the guide states that the law makes no exception for business-to-business email. A newsletter that promotes your consulting, your shop, or your course is commercial. A shipping confirmation or an account notice is a transactional or relationship message and is treated differently.

The guide also gives the number people search for: each separate email in violation is subject to penalties of up to $53,088. The figure is adjusted for inflation; that is the amount on the FTC page as of September 2, 2026. The guide adds that more than one person may be held responsible, for example both the company whose product is promoted and the company that sent the message.

The three addresses the FTC rule accepts

Congress wrote 'valid physical postal address' without defining it. The FTC defined it in 2008, in 16 CFR 316.2(p). The definition is one sentence, and it is worth reading before you read any platform's help page:

'Valid physical postal address means the sender's current street address, a Post Office box the sender has accurately registered with the United States Postal Service, or a private mailbox the sender has accurately registered with a commercial mail receiving agency that is established pursuant to United States Postal Service regulations.'

Each of the three has a condition attached to it, and the second and third depend on registration with the United States Postal Service (USPS).

	What it is	What makes it valid	How USPS writes it
Current street address	The sender's own street address, such as an office or a home	It is the sender's own address, and it is current	Street number and name, plus suite or unit if there is one
Post Office box	A box at a USPS Post Office	Registered with USPS by the sender, accurately	PO Box and number
Private mailbox at a CMRA	A box at a business that accepts mail on your behalf and is registered with USPS as a commercial mail receiving agency (USPS Domestic Mail Manual, DMM 508.1.8.1 and 508.1.8.2)	You are registered with the CMRA on PS Form 1583 with two forms of ID, accurately	'PMB' (private mailbox) and number, or '#' and number, either on its own line above the street address or on the same line as the street, such as 10 MAIN ST PMB 234 (DMM 508.1.8.3)

Ready to set up your business address?

See which US cities fit — about a minute, no card needed.

See your options — no card →

Why PO boxes and private mailboxes made the list

The FTC published the reasoning with the rule (Federal Register notice 73 FR 29654, May 21, 2008). The three categories were already in the definition the FTC had proposed in 2005, and the 2008 notice reports 25 comments on that definition, 18 of them in support. Some supporters were industry associations and large companies. Others, in the FTC's words, were 'small businesses and independent contractors' who backed the definition 'because it recognizes the privacy and security concerns of individuals who work from home or are fearful of publishing their street address for other reasons.'

Five commenters opposed it, and three of them argued that boxes shield fraudsters. The FTC answered that a person trying to hide 'can just as easily use inaccurate street addresses' and noted that no commenter offered evidence to the contrary. It also pointed to the reason the trade works: USPS regulations require that anyone receiving mail at a box be registered, and federal, state, and local agencies can obtain that registrant information from USPS when they need it for an investigation. The FTC cited the USPS regulation for that, 39 CFR 265.6, in a footnote.

The FTC also declined a proposal from two commenters to accept any address where mail is delivered for a sender whether or not the sender is registered with USPS. Its reason was that law enforcement authorities need to be able to identify a sender from the address, which the notice says would be difficult, if not impossible, without registration of all mailbox users.

That is why the final rule added one word to the proposed definition. A box counts only if it is 'accurately' registered. The FTC gave the example directly: if a sender lists a PO box or private mailbox but is not accurately identified on the postal form, or did not provide the two forms of identification the form requires, the address 'would not be considered a valid physical postal address for purposes of the Act.' The privacy of a box is available to you because your identity is on file with the Postal Service. Skip the paperwork and the box stops being a valid address at all.

What the email platforms tell you, and where the advice runs thin

We read the address help pages of five platforms: Mailchimp, Kit, Klaviyo, Flodesk, and beehiiv. All five point to anti-spam law. Four say the address is required, and Klaviyo calls it important for CAN-SPAM compliance. They differ in how much of the rule they pass on.

The beehiiv acceptable use policy repeats the FTC's three categories almost word for word, including 'a private mailbox obtained through a commercial mail-receiving agency.' Flodesk names a PO box and a virtual business address as the two alternatives to a home address. Mailchimp's footer page says to use a Post Office box if you work from home. Its separate page of alternative ideas lists a representative's PO box, a studio or rehearsal space, a store where you teach, or a gallery that will receive mail for you, with a note that you should speak with a professional about whether the address fits the rule. Kit's alternatives page suggests renting a PO box, using a day job's office, or asking 'a friend with a business' such as a studio or coffee shop to forward your mail. It also suggests renting a co-working space, or using a UPS Store where 'you get their physical street address and a "suite #" that directs the mail for you to the right box.' The same Kit page opens with a free suggestion: use Kit's own address, a Seattle PMB. The page states that Kit will not accept mail or packages for you and that anything arriving there will not be forwarded to you.

Three of those ideas run into trouble, two with the FTC definition and one with the USPS addressing standard. The first is the borrowed address. The rule's first category is the sender's current street address, and the other two categories both require that the sender is the one registered to receive mail there. A friend's coffee shop is a street address, but it is not yours, and you are not on a postal form for it. Mailchimp's caution about speaking with a professional applies to that idea; our reading is that it does not fit any of the three categories, and the 2008 notice points the same way, since the FTC declined to accept addresses where mail arrives for a sender who is not registered there.

The second is Kit's own PMB, which is the same situation in a sharper form. You are not the registrant of that box, and Kit says mail sent there will not reach you.

The third is the word 'suite.' A box at a mailbox store is a private mailbox at a CMRA, and USPS says the box designation must be written as 'PMB' or '#'. DMM 508.1.8.3 states that combining the store's own suite number with your box number, in the form '10 MAIN ST STE 11-234', is not permissible, and that mail without a proper PMB or # designation may be returned to the sender. If your footer says 'Suite' for what is actually a mailbox number, a reader who writes to you may not reach you, which is the outcome the rule exists to prevent.

One more pattern. Flodesk's page says a missing address can affect whether your email reaches the inbox at all, and a blog post from AWeber on the same topic says mail clients scan message content for an address. Neither cites a published rule from a mailbox provider for that claim. It may reflect their sending experience; treat it as that rather than as a second legal requirement.

Where a virtual office address fits

A virtual office address is a street address in a commercial building where a service receives mail for you. Under the FTC definition it lands in one of two places, and the difference is whether the location is registered with USPS as a CMRA.

If the location is registered as a commercial mail receiving agency, your address is the third category: a private mailbox at a CMRA. You complete PS Form 1583 with two forms of identification, the operator keeps it on file, and your footer address carries a PMB or # designation. This is the same category the FTC accepted in 2008, and Substack, the newsletter platform, uses it: its privacy notice lists '548 Market Street PMB 72296, San Francisco' as the company's mailing address, and that PMB address appears in the footer of the emails Substack sends to its users.

If the location is an office building that receives your mail and is not registered as a CMRA, the address you use is a street address. The rule does not define 'the sender's current street address' any further, and the FTC's 2008 discussion did not address shared buildings. Our reading is that the purpose the FTC described, an address where a recipient or an agency can reach the sender, is met when mail addressed to you is actually received there. Ask the operator which case applies to your location, and for an unusual setup ask a lawyer who works with marketing compliance.

A save office address is a commercial street address in a real building. Mail addressed to you is received there, and you decide whether it is scanned, forwarded, or held. Where a location is registered as a CMRA, PS Form 1583 is part of setup, as USPS requires. The address does not change when you move apartments, which matters for the one word in the rule that catches people later: the street address has to be current.

A short checklist before you paste an address into the footer

Decide which of the three categories your address falls into. If it is a box, confirm that the registration is in your name, or in your company's name with you listed, and that the two forms of identification were provided.
Write the address in the format USPS uses for it. A CMRA box is 'PMB 123' or '#123', either on its own line above the street address or on the same line as the street, and 'Suite' is for a real suite in the building. The complete delivery address is written on the Form 1583 the location keeps for you, so copy it from there.
Check that the address is current. If you moved and the footer still shows the old apartment, the first category no longer describes you.
Remember where the footer goes. It is in each subscriber's inbox for as long as they keep the email, and on any 'view in browser' page your platform publishes.
Keep the rest of CAN-SPAM next to the address: a working opt-out link, an identification that the message is an ad, and honest header and subject lines. The FTC's guide lists all of the requirements on one page.

Not legal advice

This article reports what the statute, the FTC rule, the FTC's 2008 rulemaking, and USPS regulations say, with the sources listed below. For your own compliance program, confirm with an attorney who works with email marketing.