If you did log in, whether you remember your credentials or not, a company can send you transactional emails, marketing emails, or both. CAN-SPAM does not cover

If you did log in, whether you remember your credentials or not, a company can send you transactional emails, marketing emails, or both. CAN-SPAM does not cover emails that are “primarily” transactional, even if the email is part marketing. Companies are legally allowed to require authentication for updating the subscription settings of transactional email. And you wouldn’t want it any other way, otherwise someone could easily spoof you and unsubscribe you from notifications from your bank about your bank account, or other important email you depend on.