Companies should implement age assurance in a "risk-based and proportionate manner", the EU Data Protection Board says.