Do transactional emails require consent?

Generally, no. Transactional emails don't require marketing consent because they're fulfilling the expectations of an existing relationship or action. When someone places an order, creates an account, or resets their password, they implicitly expect the email that follows. It's the fulfillment of something they asked for.

CAN-SPAM doesn't require prior consent for transactional emails, though it still requires honest sender information and honoring unsubscribes for the marketing portions of any email. GDPR can be satisfied through "legitimate interest" or "contract performance" as a legal basis for transactional sends, rather than consent. CASL allows transactional emails without prior express consent under its implied consent provisions for existing business relationships.

That said, a few important limits:

• The email has to actually be transactional. An email you call transactional in order to skip consent requirements is still a marketing email under the law. (See the primary purpose test.)
• Even transactional emails are subject to CAN-SPAM's sender identification requirements and must include a valid postal address.
• If a transactional email contains significant promotional content, the marketing rules apply to the whole email. You can't "transactional" your way out of consent requirements for what is functionally a marketing message.

The practical rule: send transactional emails without consent, but keep them genuinely transactional. If you want to include promotional content, do it below the fold and proportionally small. For the consent question applied to your email program more broadly, see implied consent and when it applies.