Stop logging the IP address then. Hopefully default settings in web servers will change.
> What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost?
That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account.
> How does for example a small yoga studio’s email list fit in your examples?
If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe.
The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/
