A data controller shall apply appropriate mechanisms to verify age and consent, taking into consideration available technology.