IANAL, and I tried to talk to some email professionals about EU-specific regulations for non-unsolicited, transactional email (like Discourse notifications) … but they didn’t know of any additional requirements other than what’s included via CAN-SPAM. In other words, in practice many email pro’s consider the US regulations enough to cover what’s also needed for the EU. (I don’t know in reality if this is actually enough, but someone else might know.)
For CAN-SPAM in the USA, email notifications from an interactive system like Discourse are not considered commercial messages; rather, they are considered transactional in nature, and are therefore not subject to the additional requirements of the law such as providing physical location information or requiring opt-out information.
That said, it’s always good to have a way for people to control what email they get, and fortunately we already have that with Discourse in the footers with a link to user preferences.