Businesses using Mercury's services: Your business customers' personal data may flow to Mercury not just from the business itself, but directly from employees, contractors, and payment recipients, requiring potentially broader privacy disclosures.

→ Review your SMS consent preferences in Mercury settings to confirm whether you have opted in to marketing messages separately from transactional messages.

→ If you are an employee or contractor receiving payments through a Mercury business account, review the business's privacy notice to understand what personal information is being collected and processed.

This is the 2nd significant Data Collection Expansion change Mercury has made since ConductAtlas began monitoring.

ConductAtlas has recorded 2 material changes to this document over 34 days of monitoring (since July 2026). An additional minor or cosmetic changes were excluded.

Across all monitored documents, Mercury has made 4 significant changes.

2 of Mercury's significant changes have been classified as negative for consumers.

Mercury may now collect personal information directly from employees, contractors, payment beneficiaries, and dependents at a business's direction, expanding the category of individuals whose data Mercury processes.

Transactional SMS (receipts, confirmations) and marketing SMS now require separate consent; marketing SMS opt-in permits personalization using phone number and account activity.

Removed explicit restriction on affiliate sharing and data broker use; current language restricts only third-party use of opt-in data for their own advertising purposes, not Mercury's own use.

Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.