Yeah, this is a very big change in policy, and I suspect it might catch out Mandrill customers who don't read the fine print. The privacy policies for a couple of web applications I work with, for example, are incompatible with this new policy.