GDPR requires informed consent for ANY type of storing or managing any kind of personal data or data which can be linked to personal data (eg email which can contain name and surname of the person behind an account), and you must be explicit on what you do and you cannot give the data to another entity without re-requiring consent for that specific purpose and declaring who will be exactly the new controller of that data.