Under Section 9 of the Act, data fiduciaries must obtain “verifiable consent” from parents or lawful guardians before processing data of anyone under 18