The RTA Label Is Not Age Verification. Skipping It Still Costs You at Underwriting.

Adult merchants keep treating two very different compliance objects as one. Age verification is a legal control. It checks that the human on the other side of the screen is an adult, and a growing list of statutes now demands it. The RTA label is a labeling standard. It is one meta tag that tells parental filters a page is inappropriate for minors, and no law anywhere requires it.

The confusion runs in both directions, and both directions cost money. A merchant who deploys the label and believes the site now complies with age verification laws is exposed to state enforcement and UK fines. A merchant who runs full age verification but never added the free label walks into acquirer site reviews missing the cheapest trust signal in the industry.

ASACP is the institutional spine behind the label

The Association of Sites Advocating Child Protection (ASACP) is a 501(c)(4) nonprofit founded in 1996, now in its thirtieth year. It operates a CSAM reporting tipline that has processed 1.3 million reports since launch, and it forwards red flag reports to agencies including the FBI and the National Center for Missing and Exploited Children. One line in its mission matters specifically to payments people: ASACP notifies payment processors when their billing services are hijacked by child exploitation operators.

The payments industry is not adjacent to this organization. It is inside it. Epoch Payment Solutions sits on ASACP’s advisory council. Segpay is one of its featured sponsors for July 2026. The European advisory council includes the chief executives of age assurance vendors AgeChecked and VerifyMy. When an underwriter at an adult friendly PSP reviews your site, there is a fair chance their employer helps fund the organization whose label you skipped.

The label itself is one meta tag and costs nothing

RTA stands for Restricted To Adults, and it is deliberately minimal. There is no registration, no application, and no fee. You paste a fixed meta tag into the head of every page that carries adult content, or you send the same string as an HTTP response header and cover an entire platform in one move.

The June 2026 refresh removed the last practical excuse. ASACP now publishes deployment snippets for effectively every stack an adult site runs on, and the response header route labels everything a server delivers, including images and video, not just HTML pages. There is also a paid RTA Verified tier that audits your labeling and issues a badge, but the label itself stays free.

For a site with a working deploy pipeline this is under an hour of work. That number matters when you set it against what the label buys at underwriting, which we get to below.

Regulators are explicit that a label is not verification

Start with what the label does not do. RTA only works when something on the user’s side is listening: an operating system parental control, a filtering router, a family safety setting. If no filter is active, the label blocks nobody. Age verification interrogates the user directly, which is why lawmakers keep mandating it and never mention labeling.

Ofcom’s guidance under the UK Online Safety Act lists the methods it considers capable of being highly effective age assurance: open banking, photo ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services, and email based age estimation. Self declaration is explicitly ruled out. A meta tag readable by parental filters is not on the list and never will be, because it checks the page, not the person.

US state laws work the same way, requiring commercial entities to verify visitor age through government ID or transactional data. We map the statutes and their penalty regimes in our age verification cornerstone, and the Texas domain lock case shows what enforcement now looks like in practice. For the underlying concept, the glossary entry on age verification covers the method families.

ASACP draws the same line itself. Executive director Tim Henning describes the pairing plainly: RTA blocks children when parental control is present, while age verification blocks them when parental control is unavailable. The two mechanisms cover different failure modes. The label protects children whose parents configured filters. Verification catches everyone else, and only verification carries legal weight.

Underwriters still read the label as a signal

No card network rule names RTA. What exists instead is the site review. Before an acquirer or an adult specialist PSP boards you, someone walks your site against a checklist, and the checklist is longer than most applicants expect. Segpay’s published disclosure requirements ask for an 18+ warning before adult content because most acquiring banks require it, a 2257 compliance statement, a complaints and content removal flow, visible merchant identity, and clear pricing.

The RTA label lives in the same stack. ASACP’s published best practices for adult sites tell operators to label with RTA, keep explicit imagery off warning pages, display age disclaimers, and keep deep links to explicit content out of search engine indexes. Those best practices exist per market segment, including one for billing companies. A reviewer who sees the label, the warning page, and the 2257 statement together reads operator maturity. A reviewer who sees none of them reads risk.

This is the practical meaning of the compliance signal stack: each layer answers a different reviewer. Filters read the label. Acquirer site reviews read the warning page and the disclosure set. Regulators read the verification gateway. Card network content rules read the moderation program, which we cover in the adult platform content moderation guide.

Deploy both, in this order

Add the label this week. It is free, it takes under an hour, and ASACP’s checker confirms it is live. From that point on, every household running parental controls stops being your problem. Then close the rest of the site review stack: warning page, 2257 statement, complaints flow, merchant identity, pricing.

Age verification is the separate, harder decision: which vendor, which markets, what fallback for visitors who refuse to verify. That analysis lives in the age verification cornerstone, and it does not get easier by waiting. But do not let the hard project delay the free one. The label buys credibility with the people who decide whether you process at all. Verification buys legality with the people who decide whether you get fined. Merchants who confuse the two end up either declined or enforced against.

Sources
1. ASACP, “About ASACP,” asacp.org, 2026.
2. ASACP, “Industry Best Practices,” asacp.org, 2026.
3. RTA, “Label Your Website as Restricted To Adults,” rtalabel.org, 2026.
4. ASACP, “ASACP Revamps Restricted To Adults (RTA) Labeling Tools,” rtalabel.org, 23 June 2026.
5. Ofcom, “Age checks to protect children online,” ofcom.org.uk, 16 January 2025.
6. Segpay, “Disclosures (Compliance),” gethelp.segpay.com, 2026.