I'd have to quote too much. Essentially you only have six allowed reasons for processing personal data (article 6). The only ones that could apply are (a) consent or (b) necessary for performance of contract.

(b) isn't applicable because it only applies when it's directly necessary to provide for that particular user (like processing a CC number when paying for a product). That you business model generally needs it is not enough (see the ICO FAQ on the issue[1]).

(a) Consent is valid, but it must be freely given, that is, the provision on the service can't be conditional on the consent (article 7 (4)).

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...