Sending transactional / critical emails are typically accepted even without express consent, from what I’ve learnt. Even if someone has unsubscribed from marketing emails (aka express denial of consent), one it would be ok for an org to send an user a reminder when their trial has ended or their password has been reset. In fact we are legally obligated to do so.
However, sending marketing emails disguised as “critical” emails can attract penalties.
Did a fair amount of research on this, but please do correct me if I’m wrong.