EMail Addresses are protected by the GDPR. Passwords are too. THat doesn't mean you can't use email addresses without asking; ie if the comment system uses ema

EMail Addresses are protected by the GDPR. Passwords are too. THat doesn't mean you can't use email addresses without asking; ie if the comment system uses emails to notify people of replies or moderative actions, then it's totally legit to collect it for exactly this purpose. You only need consent if the personal data collected isn't strictly necessary for the operation of your site, ie if you use tracking cookies and sell emails to advertisers.