What about the Jetpack comments/discussion module? At minimum, that's going to need an opt-in checkbox to allow explicit consent for the information collected by the comment form, isn't it? Aside from the information entered voluntarily in the fields, there's at least IP address also collected.