I've found it's possible to disable the social login providers quite easily (we had this discussion here on the mailinglist recently), but I don't see an option to disable Gravatar. If there is one, please enlighten me
You can trick a bit and set GRAVATAR_URL and GRAVATAR_SECURE_URL to a address with the special IP-address "http://192.0.2.0/". This IP-Address is intended for documentation and example purposes and normally ends in nowhere. This might not be compliant to RFCs, but at least you comply with GDPR.