Change.org’s mission is to empower people everywhere to create the change they want to see. We want to build the best possible technology to show you relevant petitions that you can help win, and also protect your privacy and security online. Our Privacy Policy outlines how we obtain information from you and what we do with it. It also explains the choices you can make to control your privacy when you use Change.org.
Here’s how to reach us for data privacy, security, and other topics listed below. For all other questions, the best way to get in touch with us is through our Help Center. Because email or postal communications are not always secure, please do not include credit card or other sensitive information in your emails or letters to us.
2. Data privacy
Post: 548 Market Street, #29993, San Francisco, CA 94104-5401, USA
E-mail: Data Protection Officer, dpt@change.org
For decision makers in the EU/UK: Our platform enables petition starters to designate specific people who they believe to be the “decision maker” empowered to act upon the subject of their petition. For decision makers located in the EU/UK, the petition starter’s inclusion of your data means that the petition starter is also a data controller. If you would like to make a data subject request, contact dpt@change.org with your contact details and the petition URL, and Change.org will process your request in compliance with applicable laws and our internal policies.
Post: Carrer de Santaló, 10, 1st Floor, 08021 Barcelona, Spain
E-mail: dpt@change.org
E-mail: dpt@change.org
E-mail: dpt@change.org
3. Law enforcement: If you are a law enforcement officer with a legal inquiry, contact us at dpt@change.org.
4. Decision makers: If you are a decision maker and want to get in touch with the petition starter, you can post a public response on the petition page on our platform, or contact us through our Help Center and we will do our best to relay your message to the petition starter.
5. Account security: If you suspect someone else is using your account, or your account security has been compromised, contact us at dpt@change.org.
6. Platform security: If you believe you have discovered a vulnerability, bug, or other general security issue within the Change.org platform, contact the Change.org Information Security Team at security.help@change.org.
7. Other: For all other inquiries, please contact us through our Help Center and we will do our best to assist you. Messages sent to the contacts listed above that are outside the scope of the corresponding topics will be routed back to the Help Center for assistance; please refrain from sending repeated messages or emailing multiple contacts, as this may slow down our response time!
To provide our services and show you relevant content we need to know a little about you and your interests. Here we outline what information Change.org collects, and how we collect it.
When you sign or create a petition via our Change.org platform, an account is created for you; all of your activities on Change.org are then tied to this account. In the chart below, we’ve detailed the information we may collect about you, depending on your activities on the platform, and how we obtain this information.
What we collect | How we collect it |
Your name. | We require you to provide a chosen name when you create a Change.org account. |
Your email address. | We require you to provide an email address when you create a Change.org account. |
Your password. | We require you to enter a password when you create a Change.org account. |
Your IP address. Your “IP Address” is a designator that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). | An IP Address may be identified and logged automatically in our server log files whenever you use our platform and services, along with the time of your visit and the specific page(s) that you visited. We may use your IP Address to derive geolocation data. |
Your postal address. | You may choose to provide your postal address when you create a Change.org account. Providing this information is not required to use the service. |
Your telephone number. | You may choose to provide your telephone number when you create a Change.org account. Providing this information is not required to use the service. |
Your city. | We use the IP service Maxmind to suggest your city from your IP address, in order to show you local petitions that may be of interest. You can change this information if it is displayed incorrectly. We do not share your information with Maxmind. Providing a city is required to use the service. |
Your state/province. | We use the IP service Maxmind to suggest your state/province from your IP address, in order to show you local petitions that may be of interest. You can change this information if it is displayed incorrectly. We do not share your information with Maxmind. Providing a state/province is required to use the service. |
Your country. | As mentioned above, we use the IP service Maxmind to suggest your city from your IP address, in order to show you local petitions that may be of interest. This enables us to determine your country. We do not share your information with Maxmind. Providing a country is required to use the service. |
Your profile picture. | You may choose to upload a profile picture when you create an account, or at any time. Providing this information is not required to use the service. |
Your specific activities on or connected to the Change.org platform. These might include petitions you have started or signed, shared, or promoted, or whether you decide to become a Change.org member. | When you are signed in or identified as a particular Change.org user, your activities on or connected to the Change.org platform are automatically associated with your account. |
Any other information you voluntarily submit. | You may be offered the choice to provide other information to us. For example, we may collect information when you respond to user surveys, or when you provide information when we assist you by telephone. Providing this information is not required to use the service. |
The name of the browser you use to access Change.org. | Certain information is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows PC or Mac), screen resolution, operating system name and version, device manufacturer and model, language, Internet browser type and version, and the name and version of the Change.org platform you are using. Collecting this information helps us build and deliver the best possible version of Change.org to you. |
Your social media account ID, and information shared with us via your social media account. | Linking a social media account is not required to access the service. You have the option to add social media handles to your Change.org profile. If you sign a petition by logging into a third-party account, we receive your name and email address from the third party. |
Information about the issues you care about based on your activities on the platform. | As part of our efforts to connect people to causes that interest them, petitions you sign might be tagged by our users or by us as particular cause areas. For example, a petition may be tagged as “animal rights” or “women’s rights”. If you sign one petition tagged in a particular cause area, we may infer that you would be interested in other petitions tagged in the same way. We may also send you petitions that are relevant to your general geographic area. |
Currently in the United States only, we use information available in public records, or other publicly available databases, such as civic data APIs which help match citizens with the elected officials who represent them in all levels of the government. | In the United States, we receive data from the “Google Civic Information API” that contains lists of federal office holders and legislators, state legislators, and governors. That data is integrated into our platform to enable users in the United States to accurately identify the correct decision maker for their petition. We also use this data to match petitions from a particular district to the right political representative. We do not share any user data via the “Google Civic Information API.” In the future, we may carry out similar activities in other countries, subject to applicable law. |
Information collected through cookies as disclosed in our Cookie Policy | We, and/or our service providers, may use cookies, pixel tags (also known as web beacons and clear GIFs), and other similar technologies to understand user activities. Like other websites, Change.org will not function properly if cookies are not enabled. We use third-party analytics services like Google Analytics provided by Google Inc. (“Google”), the Amplitude service provided by Amplitude (“Amplitude”), the Optimizely service provided by Optimizely (“Optimizely”), and the Looker service provided by Looker Data Sciences, Inc. These analytics services may use cookies and similar technologies to analyze how people use our services and provide statistical reports about aggregated user behavior. Such services may also collect information about platform visitors’ use of other websites. Please review our Cookie Policy for detailed information on the cookies we use, and how you can manage these. |
The currency of any contributions made through Change.org. | We infer your currency based on your country. |
The transaction amount you contributed or received through a refund or otherwise. | Your payment information, including your credit card or bank number, expiration date, billing address and transaction amount is collected on our payment page by a third-party payment processor and will be subject to its privacy policy. We have no control over, and are not responsible for, the third-party’s collection, use, and disclosure of your personal information. We receive information on payment amount only; no other payment information is stored or saved within our systems. |
Our platform enables petition starters to designate specific people who they believe to be the “decision maker” empowered to act upon the subject of their petition. If you are identified as a decision maker for a petition, we may process your personal information.
Please note that if you create an account on our platform, the section above, “For platform users, petition starters and petition signers,” will also apply to you.
What we collect | How we collect it |
Your name. | If you are identified as a decision maker, your name may be provided to us. |
Your email address. | If you are identified as a decision maker, your email address may be provided to us. |
Your office, title, and/or organization | If you are identified as a decision maker, your office, title, and/or organization may be provided to us. |
Your profile picture. | If you are identified as a decision maker, your public profile photo may be added. |
Any other information you voluntarily submit. | You may decide to respond to a petition that identifies you as a decision maker. Your response will be published on the petition page. |
Currently in the United States only, we use information available in public records, or other publicly available databases, such as civic data APIs which help match citizens with the elected officials who represent them in all levels of the government. | In the United States, we receive data from the “Google Civic Information API” that contains lists of federal office holders and legislators, state legislators, and governors. That data is integrated into our platform to enable users in the United States to accurately identify the correct decision maker for their petition. We also use this data to match petitions from a particular district to the right political representative. We do not share any user data via the “Google Civic Information API.” In the future, we may carry out similar activities in other countries, subject to applicable law. |
Please note that if you are a prominent public figure, we may use the above-mentioned information to create a decision maker profile page for you, in order to enable petition starters to more accurately direct their petitions towards the public figures best positioned to respond to their request. As a decision maker, you and/or your designee can reach out to us to update the information on your profile by contacting our support team through our Help Center.
Some of the information above reveals your specific identity, or is directly tied to your specific identity, such as your name and email address. Some of this information does not reveal your specific identity, or does not directly relate to you, such as your browser and device information or information collected through cookies. If we ever combine non-personally identifiable information with personally identifiable information, the combined information will be treated by us as personally identifying information and protected accordingly.
Our services are not directed to people under the age of thirteen (13) or under the legal age of consent in your country of residence (for example, in some countries, you must be age 16 years or older), and we do not knowingly collect personal information from them, unless otherwise permitted by law.
Here are the ways we might use your information to run our platform, provide our services, and serve you better content.
Where required by applicable law, we and our service providers will rely on your consent whether implied or express and may use your information for our legitimate business interests in providing a petition platform that enables people to connect with issues of interest. Our legitimate business interests are explained below, alongside examples of how your information may be used for these purposes.
Purpose | Examples |
Providing the functionality of our platform. We engage in these activities to manage our contractual relationship with you. |
|
Fulfilling your specific requests through the platform. We engage in these activities to manage our contractual relationship with you. |
|
Accomplishing our business purposes. We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, because we have a legitimate interest, and/or with your consent. |
|
Analyzing personal information for business reporting and providing personalized services. We provide personalized services either with your consent or because we have a legitimate interest. |
|
Sharing marketing communications that we believe may be of interest to you. We engage in this activity with your consent or because we have a legitimate interest. |
|
Sending communications about the service as required by our contractual relationship. |
|
We may use your information for our legitimate business interests in providing a petition platform that facilitates the exercise of the right to petition and enables people to connect with issues of interest, as well as to inform you about petitions that identify you as a decision maker and the option to respond to such petitions.
Please note that if you create an account on our platform, the section above, “For platform users, petition starters, and petition signers,” will also apply to you.
Purpose | Examples |
Facilitating the exercise of the right to petition |
|
Here we outline who may receive your information when it is shared either by you via the platform, or by us.
We may share your information with third parties for the following purposes:
We may use and disclose your personal information as necessary or appropriate, especially when we have a legal obligation or legitimate interest to do so:
Here we outline your privacy and communication choices and what rights you may be able to exercise as a data subject.
When you sign or create a petition via our Change.org platform, an account and user profile page are created for you. Any petitions that you sign will not appear on your user profile by default. Any petitions that you have started and published will appear on your user profile by default. If you would like to delete any petitions you have published, please contact our support team through our Help Center.
If you no longer want to receive marketing-related emails from Change.org going forward, you may opt out of receiving these by (1) following the instructions contained in any such email; (2) logging in to your account, clicking on “Settings,” and selecting “Manage communications preferences”; or (3) contacting our support team through our Help Center. We will comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails from us, we may still send you important administrative messages (such as updates about your account or service changes), from which you cannot opt out.
For information on opting out of text messages, please refer to our Terms of Service [10. Text messaging].
If you are a data subject in an applicable jurisdiction, such as the EU, UK, Brazil, and Canada, you may have the following rights under applicable laws:
Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the personal data or where certain exemptions apply.
If you have such rights and your request complies with the requirements under applicable laws, we will give effect to your rights as required by law.
To exercise any rights you may have under applicable privacy laws, reach out to the appropriate contact listed in our Privacy Policy [1. Key contacts] or get in touch with our support team through our Help Center. If we are unable to identify you from your first communication, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Although we urge you to contact us first to find a solution for every concern you may have, you may have the right to lodge a complaint with your competent data protection authority. Contact details of EU Data Protection Authorities can be found here.
If you suspect someone else is using your account, contact our support team through our Help Center.
If you believe you have discovered a vulnerability, bug, or other general security issue within the Change.org platform, please contact the Change.org Information Security team at security.help@change.org.
We seek to use reasonable organizational, technical, and administrative measures to protect your personal information within our organization from loss, misuse, unauthorized access or disclosure, alteration and/or destruction. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify our Data Protection Team using the contact details listed in our Privacy Policy [1. Key contacts].
We will retain your personal information for as long as needed or permitted in light of the purposes for which it was obtained. The criteria used to determine our retention periods include the length of time we have an ongoing relationship with you and provide our services to you, our legal obligations or whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).
Change.org is a global organization with offices around the world, so your information may be transferred across borders when you use the platform. We have put in place measures to comply with laws regulating cross-border transfers.
Change.org is a global organization. Your personal information may be stored and processed outside of your place of residence in countries that are subject to different standards of data protection. In particular, you should be aware that your personal information may be shared with, and transferred to, Change.org PBC and affiliates and third-party business partners and service providers.
Some of these recipients may be located in countries outside the EEA and/or the UK for which the European Commission or UK Government (as and where applicable) has not issued adequacy decisions in respect of the level of data protection in such countries (“Restricted Countries”). For example, the United States is a Restricted Country. Where we transfer your personal data to a recipient in a Restricted Country, we will either:
You may obtain a copy of these measures by contacting our Data Protection Team using the contact details listed in our Privacy Policy [1. Key contacts].
Leaving our platform.
Our platform may contain links to other websites, which may have privacy policies or notices that differ from ours. We are not responsible for the collection, processing, or disclosure of personal information collected through other websites. We are also not responsible for any information or content contained on such websites. Links to other websites are provided solely for convenience. Your usage and browsing on any such website are subject to that website’s own policies; as such, please review the privacy notices posted on those websites. We may provide you with additional or different privacy notices in specific instances which describe how your personal information is collected and used for a specific service.
Here we provide information to California residents about our collection, use, disclosure, and other processing of their personal information.
Categories of personal information | Disclosed to which categories of third parties for operational business purposes |
Identifiers, such as name, alias, postal address, unique personal identifiers, IP address that can reasonably be linked or associated with a particular consumer or household, email address, and account name | Affiliates; service providers; legal authorities; other parties in litigation |
Personal information as defined in the California customer records law, such as name and contact information | Affiliates; service providers; legal authorities; other parties in litigation |
Commercial information, such as transaction information and purchase history | Affiliates; service providers; legal authorities; other parties in litigation |
Internet or network activity information, such as browsing history, search history and interactions with our online properties | Affiliates; service providers; legal authorities; other parties in litigation |
Geolocation data, such as approximate location derived from IP address | Affiliates; service providers; legal authorities; other parties in litigation |
Audio/video data. Audio, electronic, visual, and similar information, such as call and video recordings (for example, for user research purposes) | Affiliates; service providers; legal authorities; other parties in litigation |
Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s petition preferences | Affiliates; service providers |
Sensitive personal information such as personal information that reveals an individual’s account log-in, or personal information collected from a known child | Affiliates; service providers |
Most of the personal information Change.org collects is provided by you when you access and use our service. Additionally, in order to show you local petitions that may be of interest to you, we use the IP service Maxmind to suggest your city from your IP address. For more information, please read the Your City and Your Location section in our Privacy Policy [2. Information we collect].
Change.org uses your information for our legitimate business interest of providing a petition platform that enables you to connect with issues that are important to you. Our Privacy Policy [3. How we use your information] gives a detailed description of why we collect your information and what we use it for.
To show you advertisements about Change.org on other sites, we sometimes allow third parties to collect information about you through cookies and similar technologies or disclose information to them for the purpose of promoting Change.org. While we do not receive compensation, these activities may constitute “sharing” or “selling” under California law. In the preceding 12 months, such activities involved collecting the following categories of personal information and sharing them with the following categories of third parties:
Categories of personal information | Disclosed to which categories of third parties for advertising purposes |
Identifiers, such as name, alias, postal address, unique personal identifiers, IP address that can reasonably be linked or associated with a particular consumer or household, email address, and account name | Social networks |
Internet or network activity information, such as browsing history, search history and interactions with our online properties | Social networks |
Without limiting the foregoing, we do not sell or share the personal information of those under 16 years of age unless required by law.
Subject to your consent where required by applicable law, we may use Sensitive Personal Information for purposes of providing goods or services as requested by you; ensuring security and integrity; short term transient use such as displaying first party, non-personalized advertising, in the form of suggested petitions and campaigns of potential interest; performing services for our business, including maintaining and servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of our business; and activities relating to quality and safety control or product improvement.
If you are a California resident you may, subject to applicable law, make the following requests:
We will not unlawfully discriminate against you exercising your rights under California law. You can contact us to make one of these requests through our Help Center or by emailing us at dpt@change.org. We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. In some instances, we may decline to honor your request where the law or right you are invoking does not apply or where an exception applies. We may need to request additional personal information from you, such as a government-issued identification to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your personal information. You may make a request on behalf of a child who is under 13 years old if you are the child’s parent or legal guardian. If you make a request to delete, we may ask you to confirm your request before we delete your personal information.
If an agent would like to make a request on your behalf as permitted under the CCPA, the agent may use the submission methods noted in the section entitled “Individual requests.” As part of our verification process, we may request that the agent provide, as applicable, proof concerning his or her status as an authorized agent. In addition, we may require that you verify your identity as described in the section entitled “Individual requests” or confirm that you provided the agent permission to submit the request.
Where we maintain or use de-identified data, we will continue to maintain and use the de-identified data only in a de-identified fashion and will not attempt to re-identify the data.
This Privacy Policy and the CARU icon shown on our website confirm that Change.org is a valid licensee and participating member in the CARU COPPA Safe Harbor Program (“CARU COPPA Safe Harbor”). To protect your privacy, we have voluntarily undertaken this privacy initiative.
As part of the CARU COPPA Safe Harbor, we are subject to audits and frequent monitoring of our website and other enforcement and accountability mechanisms administered independently by CARU.
If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at:
CARU COPPA Safe Harbor
Attn: Director
1676 International Drive, Suite 550
McLean, VA 22102
InfoCaru@bbbnp.org
PLEASE NOTE: CARU is not a data controller or a data processor for Change.org and cannot process personal information requests made pursuant to CCPA. Please direct your personal information request directly to Change.org, through the email as indicated in our Privacy Policy [9. California Consumer Protection Act].
This policy may change over time. If you have any questions, the best way to get in touch with us is through our Help Center.
We may change this Privacy Policy. The “Last updated” date at the top of this Privacy Policy indicates when it was last revised. Any changes will become effective when we post the revised Privacy Policy on our platform.
We welcome questions, concerns, and feedback about this policy. If you have any suggestions for us, let us know through our Help Center. You can also write to the appropriate contact listed in our Privacy Policy [1. Key contacts].
Thanks for supporting change in your community — we can’t wait to see what you’ll change next!