Marketers and platforms face scrutiny as new rules aim to protect children under 16 from online harm