Children's Data Restriction

What it is

The policy states that Mercury's services are not directed at children under 13 and that Mercury does not knowingly collect Personal Information from users under 13, with a parental contact mechanism provided.

Why it matters (compliance & governance perspective)

This provision establishes COPPA compliance positioning; because Mercury also states it does not knowingly sell or share Personal Information of minors under 16 elsewhere in the policy, the age threshold for data sale and sharing restrictions extends to a broader group than the under-13 service exclusion.

Consumer impact (what this means for users)

Under this provision, users under 13 are excluded from Mercury's services, and parents or guardians who believe a minor's data has been collected may contact Mercury at [email protected] to request its removal; separately, the policy states that Personal Information of users under 16 is not knowingly sold or shared.

What you can do

Institutional analysis (regulatory & governance intelligence)

1) REGULATORY LANDSCAPE: This provision engages COPPA, which prohibits knowing collection of personal information from children under 13 without verifiable parental consent, enforced by the FTC. The FTC has brought enforcement actions against companies that failed to implement adequate age verification or that knowingly collected data from children. The separate under-16 age threshold for data sale and sharing aligns with CCPA's minor-specific provisions. 2) GOVERNANCE EXPOSURE: Low. Mercury's services are directed at businesses and adults, which reduces the likelihood of incidental child data collection. The absence of a formal age verification mechanism is noted; the policy relies on a 'not knowingly' standard, which is the COPPA compliance baseline for platforms not directed at children. 3) JURISDICTION FLAGS: COPPA applies federally to all U.S. users under 13. The CCPA's under-16 sale and sharing restriction applies to California residents. No specific international children's data frameworks (such as the UK Children's Code) are addressed in this policy, which may be relevant if Mercury's services are accessed by UK minors. 4) CONTRACT AND VENDOR IMPLICATIONS: The policy's business-focused positioning reduces but does not eliminate the risk that minors access Mercury's services through business accounts. Compliance teams should assess whether business account onboarding processes include sufficient age verification for authorized users. 5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that account creation workflows include adequate age gate mechanisms consistent with Mercury's stated under-13 exclusion. The parental contact mechanism at [email protected] should be tested for responsiveness and data deletion workflow. The under-16 sale and sharing restriction should be implemented at the data layer to prevent inadvertent inclusion of minors' data in advertising data flows.

Applicable agencies

Provision details

Other risks in this policy

• Mercury AI output not a substitute for professional advice medium
• Advertising cookies may constitute sale or sharing high
• AI human oversight for consequential decisions high
• Biometric information collected for identity purposes high
• Business customer responsible for lawful basis to provide data high
• Disclosure in corporate transaction to acquirers high