Yes, CAN-SPAM accepts a PO box or a virtual mailbox, as long as the US Postal Service can tie it to you. The FTC’s rule lists three valid addresses: your current street address, a Post Office box you have accurately registered with the USPS, or a private mailbox you have accurately registered with a commercial mail receiving agency under USPS rules. The smallest USPS box costs $31 to $170 for six months, and the FTC puts the penalty at up to $53,088 for each email that breaks the law. I read every rule quoted here on 16 October 2026.
The easy mistake is treating the footer address as decoration, so a founder working from home prints the home address on every email or pastes in a virtual office address without asking how it is registered. The first is a privacy cost. The second can fail the rule, which asks one thing of a box: can the Postal Service say who rents it?
A footer address has two jobs. The FTC kept the registration rule for the second one: letting an investigator find you.
Key numbers
| Item | Number |
|---|---|
| Kinds of address the FTC rule accepts (street, USPS box, CMRA private mailbox) | 3 |
| Most the FTC can seek per violating email | $53,088 |
| Smallest USPS PO box, six months (by Post Office fee group) | $31 to $170 |
| Smallest USPS PO box, a year | $62 to $340 |
| iPostal1 business address plan (or $149 paid yearly) | $14.99 a month |
| Forms of ID per person listed on a PO box | 2 |
| US opt-out route must keep working (after the email is sent) | 30 days |
| US and Canada opt-out deadline | 10 business days |
| Canada contact details must stay valid (after the message is sent) | 60 days |
| Canada maximum penalty for a business (per violation) | CAD 10 million |
| Australia contact details must stay valid (after sending) | 30 days |
| Year the FTC added the box options | 2008 |
Read on 16 October 2026 from 16 CFR 316.2, 15 U.S.C. 7704, the FTC’s CAN-SPAM guide and 2008 rulemaking, USPS Notice 123 and DMM 508, iPostal1’s pricing page, CASL, the CRTC regulations and Australia’s Spam Act.
What the FTC rule accepts
The statute, 15 U.S.C. 7704(a)(5), requires “a valid physical postal address of the sender”, and the FTC’s rule at 16 CFR 316.2(p) defines it with the three options above.
The word doing the work is accurately. When the FTC adopted the definition in 2008, it answered HSBC and MasterCard, which had asked it to accept any address where a sender’s mail is delivered, registered or not. The FTC refused: the address also exists so law enforcement can identify the sender, and US agencies can get box registrant records from the Postal Service. In its own example, a box whose renter is not accurately identified on the postal form, or who skipped the two forms of ID, does not count.
The same rulemaking records who asked for boxes: small businesses and independent contractors, citing the privacy and security of people who work from home. The home address was never the requirement. A traceable one is.
Paste the virtual office address from the website and move on.
A box the sender has not accurately registered is not a valid address under 16 CFR 316.2(p).
A street address, or a USPS box or private mailbox registered in the sender’s name.
Keep it working for 60 days after your last send to Canada.
Why a foreign PO box is not on the list
The street address option names no country, so a company in Dubai, Toronto or Lahore can print its real office address and meet the definition as written. The two box options are different: both are defined by USPS registration. Read literally, a box at Emirates Post or Canada Post is neither, and the FTC’s reason for registration, that US agencies can pull the renter from USPS records, does not reach a foreign post office.
Neither the FTC’s compliance guide nor its 2008 rulemaking mentions foreign boxes, so this is a reading of the text, not a ruling. It is the one I would plan around: if your published address is a P.O. Box abroad, use your street address in emails to US recipients.
Canada reads the other way: the CRTC’s 2012 guidance says a mailing address can be a street, postal box, rural route or general delivery address, naming no postal service.
What it costs to keep your home address private
A USPS box is the cheap route. Notice 123, the Postal Service price list effective 4 October 2026, puts the smallest box at $31 to $170 for six months depending on the Post Office’s fee group, or $62 to $340 a year. You apply on PS Form 1093, online or at a Post Office, and each person listed shows two forms of current ID. Rent it in the name of the business whose offer the email promotes: the box has to be the sender’s, and when an agency sends for a client, the sender is the client, which is why CAN-SPAM liability stays with your company.
A virtual mailbox is the remote route. Its operator is a commercial mail receiving agency, or CMRA, under USPS rules, and the Domestic Mail Manual counts office business centers as CMRAs too. You complete PS Form 1583, the CMRA uploads your two forms of ID to the Postal Service’s database, and you sign in front of the CMRA or a notary commissioned in a US state or territory, in person or over live video, which makes it workable from abroad. iPostal1 lists business address plans from $14.99 a month, $179.88 over a year, or $149 paid yearly, varying by location.
The vendor calls it a real physical street address. The rule calls it a private mailbox, marked PMB or # and a number under the Domestic Mail Manual, and it counts because your Form 1583 is on file.
What Canada, Australia, the UK and the EU ask for
Canada asks for the most. CASL’s regulations want the name of the business sending and of any business it sends for, the mailing address, and a phone number that reaches a person or voicemail, an email address or a web address. The Act requires that contact information to stay valid for at least 60 days after the message is sent, unsubscribes take effect within 10 business days, and penalties reach $10 million per violation for a business.
Australia’s Spam Act, section 17, asks for accurate information about how to contact whoever authorised the message, reasonably likely to stay valid for at least 30 days after sending. The section says contact, not postal.
The UK and the EU frame it as an opt-out duty: PECR regulation 23 and Article 13(4) of the ePrivacy Directive ban marketing email that conceals who it was sent for or gives no “valid address” for opt-out requests. Neither says postal. Of the rules quoted here, only the American one is written around a postal service.
What I would put in the footer
I have built outbound systems for more than 200 businesses, and the address line is one of my checks before a first send. Four steps cover the address rules above.
Register the address in the sender’s name
Use the street address if you have an office. Otherwise rent a USPS box or a CMRA mailbox in the name of the business whose offer the email promotes, with Form 1093 or Form 1583 filled in accurately.
Write it the way the USPS does
A private mailbox carries PMB or # and the box number, the designation the Domestic Mail Manual requires of a CMRA. Copy the format the CMRA gives you.
Put it in every email, not just the first
The FTC counts each separate email as its own violation, so the business name, the address and a reply email go into the template every step of the sequence uses.
Keep it working after the campaign ends
Canada wants the contact details valid 60 days after the last send and Australia 30. In the US the opt-out route must work for 30 days and requests take effect within 10 business days. Diary the box renewal past your last send.
The bottom line
Keeping your home address out of the footer costs as little as $62 a year: the smallest USPS box in the lowest fee group. Send from abroad with your street address, rent a box in the sender’s name if you work from home, and keep it past the last send. The domain side of the same question is in whether a secondary domain is legal, and the country rules sit in our cold email laws by country table.
If you would rather have the sending side built with one-click unsubscribe and suppression from the first send, and the footer checked against these rules, that is the email infrastructure work we do. I am not a lawyer and this is not legal advice; it is what the texts said when I read them on 16 October 2026.