In response to GDPR concerns with Gravatar there is a plugin called »Avatar Privacy« which shows a way how this could be handled:

https://wordpress.org/plugins/avatar-privacy/

Summary from the plugin page:
- Self-uploaded avatars for users (and custom default images), hosted on your server.
- Users and commenters explicitly opt-in before using gravatars.
- Gravatar caching to ensure the privacy of your website visitors.
- Don’t publish weakly encrypted e-mail addresses of comment authors.