Does the CAN-SPAM Act Require a Physical Postal Address in Every Marketing Email?

Yes. The CAN-SPAM Act requires every commercial email to include the sender's valid physical postal address. Under the FTC's 2008 rule defining the term, that address can be a current street address, a post office box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency — not just a traditional street address.

Why the FTC Added PO Boxes and Private Mailboxes

CAN-SPAM's original 2003 text simply required a "valid physical postal address" without spelling out exactly what qualified. The FTC's 2008 rulemaking closed that ambiguity by explicitly defining the term to include registered PO boxes and private mailboxes alongside street addresses, giving email senders legitimate, privacy-preserving alternatives to publishing a home or office street address on every marketing email.

What Doesn't Satisfy the Requirement

An address only counts if it's genuinely valid and properly registered — an unregistered PO box, a defunct address, or a mailbox not set up through a commercial mail receiving agency doesn't meet the standard. The address also needs to actually belong to the sender identified in the email; listing an unrelated company's address to obscure who actually sent the message defeats the purpose of the requirement and creates separate exposure under CAN-SPAM's broader prohibition on deceptive sender information.

This Has Real Enforcement History

The FTC has brought CAN-SPAM cases that specifically cited a missing valid physical postal address as one of the violations. In one settled FTC action, failure to include a valid physical postal address was named alongside other violations, with settlements across the named marketers totaling more than $32,000 in civil penalties — a reminder that this isn't a theoretical requirement regulators ignore in practice.

What to Check in Your Email Footer Right Now

• Confirm the address resolves: A street address should be current and able to receive mail; a PO box or private mailbox needs to be actively registered, not just typed into a footer template years ago.
• Match the named sender: The address in the footer should correspond to the business actually sending the message, not a shell entity or unrelated affiliate.
• Don't confuse this with the unsubscribe requirement: The physical address rule is separate from CAN-SPAM's unsubscribe-honoring deadline — both are independently required, and missing either one is its own violation.

Bottom Line

Every commercial email needs a genuine, currently valid physical address in the footer — a real street address, or a properly registered PO box or private mailbox — and it's worth a five-minute audit of your email templates to confirm that address hasn't quietly gone stale.

Sources: 15 U.S.C. § 7704; FTC CAN-SPAM Rule, 16 C.F.R. § 316.2 (2008 amendment defining "valid physical postal address"); Suped, "Can I Use a PO Box? CAN-SPAM" (suped.com); Willkie Farr & Gallagher, "FTC Issues New Rules Under the CAN-SPAM Act" (willkie.com).