The law requires companies to block the accounts of more than a million people under the cut-off age, punishing "systemic breaches" with penalties.