Regulator gives industry groups six months to come up with draft code, expected to include rules about age verification