Regulatory data shows millions of suspected under-age accounts have been removed since the law came into force