Privacy Policy

NOTED

FIRST SEEN 2026-09-10 · VERSION 20260910_rev01 · COMPARED WITH 20260907_rev01

What changed, in plain language

This update to Change.org's Privacy Policy is purely cosmetic. It changes heading levels (e.g. from H4 to H3, H3 to H2) and re-indents a bulleted list, but does not add, remove, or change any actual policy language about what data is collected, how it's used, shared, retained, or any of your rights.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

± CHANGEDHeading levels changed throughout the document
Several section and subsection headings were changed from one heading size to another (for example '#### Categories of Personal Data We Collect' became '### Categories of Personal Data We Collect', and top-level numbered sections like '### 3. How We Use Your Information' became '## 3. How We Use Your Information'). This is a formatting/styling change only and does not affect the meaning of the policy.
#### Categories of Personal Data We Collect
### Categories of Personal Data We Collect
± CHANGEDBulleted list under 'Categories of Sources of Personal Data' re-indented
The list explaining how Change.org collects information directly from you was reformatted with sub-bullets nested under their parent bullet, instead of being listed as separate top-level bullets. The same information is still there, just organized more clearly.
- When you provide such information directly to us. - When you create an account or use our interactive tools and Services.
- When you provide such information directly to us. - When you create an account or use our interactive tools and Services.

Full text changes — 20260907_rev01 to 20260910_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" or "sensitive personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage.
 For any questions about this Policy or our Services, the best way to get in touch with us is through our [Help Center](https://help.change.org/). You can also write to one of the [Privacy Policy \[9. Key contacts\]](https://change.org/policies/privacy#9) listed at the bottom of this Policy.
 To provide our services and show you relevant content we need to know a little about you and your interests. Here we outline what information Change.org collects, and how we collect it.
+#### Categories of Personal Data We Collect
+### Categories of Personal Data We Collect
 This chart details the categories of Personal Data that we collect and have collected, including over the past 12 months:
 <table><tbody><tr><td><strong>Category of Personal Data (and Examples)</strong></td><td><strong>Business or Commercial Purpose(s) for Collection</strong></td><td><strong>Categories of Third Parties With Whom We Disclose this Personal Data</strong></td></tr><tr><td><strong>Profile or Contact Data</strong> such as first and last name, email and mailing address.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li><li>Corresponding with You</li></ul></td><td><ul><li>Service Providers</li><li>Parties You Authorize, Access or Authenticate</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Professional Data.</strong> If you are a Decision Maker in the U.S., we collect information about your position with the government from public records via the <a href="https://developers.google.com/civic-information" rel="noopener" tabindex="0" data-react-aria-pressable="true" target="_self"><span data-size="medium" data-truncate="false" data-underline="false" data-variant="body">Google Civic Information API</span></a> and the <a href="https://organizations.ballotready.org/ballotready-api" rel="noopener" tabindex="0" data-react-aria-pressable="true" target="_self"><span data-size="medium" data-truncate="false" data-underline="false" data-variant="body">BallotReady API</span></a>.</td><td><ul><li>Providing, Customizing and Improving the Services</li></ul></td><td><ul><li>Service Providers</li><li>Parties You Authorize, Access or Authenticate</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Payment Data</strong> such as the transaction amount you contributed or received through a refund or otherwise.</td><td><ul><li>Payment processing</li></ul></td><td><ul><li>Service Providers (specifically our payment processing partner, currently Stripe, Inc., Braintree (offered by PayPal, Inc.), dLocal Corp LLP, and Paypal, Inc.)</li></ul></td></tr><tr><td><strong>Commercial Data</strong> such as transaction information and purchase history with Change.org.</td><td><ul><li>Providing, Customizing and Improving the Services</li></ul></td><td><ul><li>Service Providers</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Device/IP Data</strong> such as IP address, device ID, domain server and type of device/operating system/browser used to access the Services.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li></ul></td><td><ul><li>Service Providers</li><li>Advertising Partners</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Web Analytics</strong> such as web page interactions, request IDs and statistics associated with the interaction between device or browser and the Services, and browsing or search history associated with your use of our Services.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li></ul></td><td><ul><li>Service Providers</li><li>Advertising Partners</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Social Network Data</strong> such as email, username and profile photo.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li><li>Corresponding with You</li></ul></td><td><ul><li>Service Providers</li><li>Parties You Authorize, Access or Authenticate</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Consumer Demographic Data</strong> such as age and/or date of birth, zip code, political opinions, and, in the U.S., voter registration data.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li><li>Corresponding with You</li></ul></td><td><ul><li>Service Providers</li><li>Parties You Authorize, Access or Authenticate</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Geolocation Data</strong> such as IP-address-based location information.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li><li>Corresponding with You</li></ul></td><td><ul><li>Service Providers</li><li>Advertising Partners</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Audio/video data.</strong> Audio, electronic, visual, and similar information, such as call and video recordings (for example, for user research purposes).</td><td><ul><li>Providing, Customizing and Improving the Services</li></ul></td><td><ul><li>Service Providers</li><li>Parties You Authorize, Access or Authenticate</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Inferences</strong> drawn from any of the Personal Information listed above to create a profile about, for example, an individual's petition preferences.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li></ul></td><td><ul><li>Service Providers</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Sensitive personal information</strong> such as personal information that reveals an individual's account log-in, or personal information collected from a known child.</td><td><ul><li>Providing, Customizing and Improving the Services</li></ul></td><td><ul><li>Service Providers</li><li>Affiliates and Local Chapters</li></ul></td></tr><tr><td><strong>Other Identifying Information that You Voluntarily Choose to Provide</strong> such as emails, letters, and texts you send us.</td><td><ul><li>Providing, Customizing and Improving the Services</li><li>Marketing the Services</li><li>Corresponding with You</li></ul></td><td><ul><li>Service Providers</li><li>Parties You Authorize, Access or Authenticate</li><li>Affiliates and Local Chapters</li></ul></td></tr></tbody></table>
 #### Categories of Sources of Personal Data
 We collect Personal Data about you from the following categories of sources:
 - You
     - When you provide such information directly to us.
+    - When you create an account or use our interactive tools and Services.
+    - When you voluntarily provide information in free-form text boxes through the Services or through responses to surveys or questionnaires.
+    - When you send us an email or otherwise contact us.
+        - When you create an account or use our interactive tools and Services.
+        - When you voluntarily provide information in free-form text boxes through the Services or through responses to surveys or questionnaires.
+        - When you send us an email or otherwise contact us.
     - When you use the Services and such information is collected automatically.
+    - Through Cookies (defined in the [Information from Cookies and Similar Technologies](https://change.org/policies/privacy) section below).
+        - Through Cookies (defined in the [Information from Cookies and Similar Technologies](https://change.org/policies/privacy) section below).
 - Public Records
     - Currently in the United States only, we use information available in public records, or other publicly available databases, such as civic data APIs which help match citizens with the elected officials who represent them in all levels of the government.
     - In the United States, we receive data from the [Google Civic Information API](https://developers.google.com/civic-information) and the [BallotReady API](https://organizations.ballotready.org/ballotready-api) that contain lists of local and federal office holders and legislators, state legislators, and governors. That data is integrated into our platform to enable users in the United States to accurately identify the correct Decision Maker for their petition. We also use this data to match petitions from a particular district to the right political representative. We do not share any user data via the [Google Civic Information API](https://developers.google.com/civic-information) and the [BallotReady API](https://organizations.ballotready.org/ballotready-api). In the future, we may carry out similar activities in other countries, subject to applicable law.
     - In the United States, we receive voter data from [Aristotle](https://www.aristotle.com/data/political-data/) to estimate aggregate statistics about the voter registration statuses of petition signers. This data may be reported in aggregate on petition pages and is not stored or used for any other purpose.
 - Third Parties
     - Third-Party Credentials: If you provide your third-party account credentials, such as your social network account credentials, to us or otherwise sign in to the Services through a third-party site or service, some content and/or information in those accounts may be transmitted into your account with us.
 The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, "Cookies") to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Please see details about our use of cookies in our Please see our [Cookie Policy](https://change.org/policies/cookies).
 #### Information about Interest-Based Advertisements
 We may serve advertisements, consisting of Change.org [Promoted Petitions](https://change.org/policies/terms-of-service), through the Services. We may also work with third-party advertising partners to show you advertisements about Change.org on other sites, based on general profile categories or your preferences or behaviors ("Interest-Based Ads"). Information for Interest-Based Ads (including Personal Data) may be provided to us by you, or derived from the usage patterns of particular users on the Services and/or services of third parties. Such information may be gathered through tracking users' activities across time and unaffiliated properties, including when you leave the Services. To accomplish this, we or our service providers may deliver Cookies, including a file (known as a "web beacon") from an ad network to you through the Services. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Web beacons allow ad networks to view, edit or set their own Cookies on your browser, just as if you had requested a web page from their site.
+### 3\. How We Use Your Information
+## 3\. How We Use Your Information
 We use your information to run our platform, provide our services, and serve you better content.
+#### Our Commercial or Business Purposes for Collecting Personal Data
+### Our Commercial or Business Purposes for Collecting Personal Data
 <table><tbody><tr><td><strong>Purpose</strong></td><td><strong>Examples</strong></td></tr><tr><td>Providing, customizing and improving the Services</td><td><ul><li>Creating and managing your account or other user profiles.</li><li>Processing orders or other transactions; billing.</li><li>Providing you with the products, services or information you request. This includes:<ul><li>To allow you to create petitions, sign petitions, join "topics" or "movements" (groups of similar petitions), follow their progress, and manage petitions (including publishing your name and/or signature).</li><li>To allow you to participate in other activities on Change.org platforms, sites and apps, as well as to complete and fulfill your transactions with us.</li><li>To facilitate the social sharing functionality that you choose to use, such as sharing content and petitions through the Change.org platform and other social media platforms, like Facebook and X.</li><li>To connect you with media outlets, if applicable.</li></ul></li><li>For Decision Makers: providing you with the option to respond to a petition that identifies you as a Decision Maker, and creating a profile page for you, if applicable.<ul><li>Specifically, note that our platform enables petition starters to designate specific people who they believe to be the "Decision Maker" empowered to act upon the subject of their petition ("Decision Maker"). If you are identified as a Decision Maker for a petition, we may process your personal information.</li></ul></li><li>Meeting or fulfilling the reason you provided the information to us.</li><li>Providing support and assistance for the Services.</li><li>Improving the Services, including testing, research, internal analytics and product development.</li><li>Determining the effectiveness of campaigns.</li><li>Notifying Decision Makers of campaigns, if applicable.</li><li>Personalizing the Services, website content and communications based on your preferences including to personalize your experience by presenting petitions, campaigns, and offers tailored to you based on information we have collected from you.</li><li>Doing fraud protection, security and debugging.</li><li>Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (the "CCPA"), the Colorado Privacy Act (the "CPA"), the Connecticut Data Privacy Act (the "CTDPA"), the Montana Consumer Data Privacy Act ("MCDPA"), the Oregon Consumer Privacy Act ("OCPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Utah Consumer Privacy Act (the "UCPA"), or the Virginia Consumer Data Protection Act (the "VCDPA") (collectively, the "State Privacy Laws").</li></ul></td></tr><tr><td>Marketing the Services</td><td><ul><li>Marketing and selling the Services. This may include:<ul><li>Communications related to petitions you've signed, other petitions that may be of interest, or petitions relevant to your location.</li><li>Editorial communications about specific issues or about Change.org.</li><li>Communications about contributions to causes or a specific petition.</li><li>Communications about becoming a member of Change.org.</li><li>If you choose to provide your telephone number or postal address, which are not required, outreach by phone, SMS, or postal mail about the Change.org contribution program or other ways you can support campaigns. For more information on text messages and SMS, please refer to our <a href="https://change.org/policies/terms-of-service#10" rel="noopener" tabindex="0" data-react-aria-pressable="true" target="_self"><span data-size="medium" data-truncate="false" data-underline="false" data-variant="body">Terms of Service [10. Text messaging]</span></a>.</li><li>Invitations to Change.org events.</li><li>Outreach to allow you to participate in events and similar promotions and to administer these activities. Some of these activities have additional rules, which could contain additional information about how we use and disclose information about you, so we suggest that you read these rules carefully.</li><li>Reminders about particular petitions or the Change.org contribution program, if you have not completed starting or signing or joining.</li></ul></li><li>Showing you advertisements, including interest-based, online behavioral or targeted advertising.</li></ul></td></tr><tr><td>Corresponding with you</td><td><ul><li>Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Change.org or the Services.</li><li>Sending emails and other communications according to your preferences.</li></ul></td></tr></tbody></table>
+#### Other Permitted Purposes for Processing Personal Data
+### Other Permitted Purposes for Processing Personal Data
 In addition, each of the above referenced categories of Personal Data may be collected, used, and disclosed with the government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms including: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, Change.org, or another party; enforcing any agreements with you; responding to claims that any posting or other content violates third-party rights; and resolving disputes.
 We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent.
+### 4\. Who May Receive Your Information
+## 4\. Who May Receive Your Information
 We disclose Personal Data to service providers, advertising partners, parties you authorize, the Change.org community, affiliated entities, and-as required-legal authorities. Some disclosures may be considered a "sale" under certain state laws; see the [U.S. section](https://change.org/policies/privacy).
+#### How We Disclose Your Personal Data
+### How We Disclose Your Personal Data
 We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a "sale" of your Personal Data. For more information, please refer to the state-specific sections below.
 - Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:
     - Hosting, technology and communication providers.
     - Analytics providers for web traffic or usage of the site.
     - Journalists and media outlets.
         - If you opt in to be contacted for media opportunities, we will share your email address with the requesting journalist or media outlet. If you have also provided a phone number for the purpose of media outreach, we will share that phone number as well.
     - Affiliated Entities.
         - We may share your information with our affiliates, which are entities under common ownership or control of Change.org, to provide our services in different countries and for the purposes described in this Privacy Policy.
         - We may share your information with our parent entity, the [Change.org Charitable Foundation](https://www.changefoundation.org/), its subsidiaries, and any affiliated local chapters that operate in certain countries, to perform charitable activities in furtherance of The Change.org Charitable Foundation's nonprofit mission.
+#### Legal Obligations
+### Legal Obligations
+#### Business Transfers
+### Business Transfers
 All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).
+#### Mobile Messaging Data
+### Mobile Messaging Data
 Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services.
+#### Data that is Not Personal Data
+### Data that is Not Personal Data
 We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.
+### 5\. Data Security
+## 5\. Data Security
 If you suspect someone else is using your account, contact our support team through our [Help Center](https://help.change.org/). If you believe you have discovered a vulnerability, bug, or other general security issue within the Change.org platform, please contact the Change.org Information Security team at [security.help@change.org](mailto:security.help@change.org).
 We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.
+### 6\. Data Retention
+## 6\. Data Retention
 We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data.
 When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.
 For example:
 - If you are a registered user, we will retain your account information for as long as your account remains active.
 - We consider a petition signature to be public speech - namely, a public declaration of support for the associated petition. Accordingly, if you have signed a petition, we will retain this information unless and until you ask us to remove it, as we understand that deleting an account does not necessarily mean withdrawing support for petitions that have been signed.
 - We retain your device/IP data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently.
 - If we receive a valid data preservation request, subpoena, or similar legally binding request, we will preserve the relevant data to the extent possible for a period of up to 90 days while the legal request is assessed and resolved, after which the data will be permanently deleted unless further retention is legally required.
+### 7\. Personal Data of Children
+## 7\. Personal Data of Children
 Our platform is not for children under applicable age limits; we also participate in CARU's COPPA Safe Harbor program.
 Our services are not directed to people under the age of thirteen (13) or under the legal age of consent in your country of residence (for example, in some countries, you must be age 16 years or older), and we do not knowingly collect personal information from them, unless otherwise permitted by law.
 This Privacy Policy and the CARU icon shown on our website confirm that Change.org is a valid licensee and participating member in the [CARU COPPA Safe Harbor Program](https://www.ftc.gov/safe-harbor-program) ("CARU COPPA Safe Harbor"). To protect your privacy, we have voluntarily undertaken this privacy initiative.
 International Drive, Suite 550
 McLean, VA 22102
 [InfoCaru@bbbnp.org](mailto:InfoCaru@bbbnp.org)
 PLEASE NOTE: CARU is not a data controller or a data processor for Change.org and cannot process personal information requests made pursuant to CCPA. Please direct your personal information request directly to Change.org through the following email: [dpt@change.org](mailto:dpt@change.org).
+### 8\. Your Privacy Choices
+## 8\. Your Privacy Choices
 Here we outline your privacy and communication choices and what rights you may be able to exercise as a data subject.
+#### Your Profile
+### Your Profile
 When you sign or create a petition via our Change.org platform, an account and user profile page are created for you. Any petitions that you sign will not appear on your user profile by default. Any petitions that you have started and published will appear on your user profile by default. If you would like to delete any petitions you have published, please contact our support team through our [Help Center](https://help.change.org/).
+#### Email Marketing Communications
+### Email Marketing Communications
 If you no longer want to receive marketing-related emails from Change.org going forward, you may opt out of receiving these by (1) following the instructions contained in any such email; (2) logging in to your account, clicking on "Settings," and selecting "[Manage communications preferences](https://change.org/account_settings/privacy)"; or (3) contacting our support team through our [Help Center](https://help.change.org/). We will comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails from us, we may still send you important administrative messages (such as updates about your account or service changes), from which you cannot opt out.
+#### Text Message and SMS Communications
+### Text Message and SMS Communications
 For information on opting out of text messages, please refer to our [Terms of Service \[10. Text messaging\]](https://change.org/policies/terms-of-service#10).
+#### Data Protection Rights
+### Data Protection Rights
 You are granted under this Privacy Policy the following rights:
 - **Right of access**: You can ask us to provide you with information about our processing of your personal information and give you access to your personal information.
 - **Right to rectification**: You can ask us to correct any personal information we hold about you that is inaccurate or incomplete.
 - **Right to erasure**: You can ask us to delete or remove personal information where there is no lawful reason for us continuing to store or process it, where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully, or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons that you will be informed of, if applicable, at the time of your request.
 The [Data Protection Rights](https://change.org/policies/privacy) section above details your rights with respect to your Personal Data.
 #### Transfers of Personal Data
 The Services are hosted and operated in the United States ("U.S.") through Change.org and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to Change.org in the U.S. and will be hosted on U.S. servers, and you authorize Change.org to transfer, store and process your information to and in the U.S., and possibly other countries.
+### 9\. Key contacts
+## 9\. Key contacts
 Here's how to reach us for data privacy, security, and other topics listed below. For all other questions, the best way to get in touch with us is through our [Help Center](https://help.change.org/). Because email or postal communications are not always secure, please do not include credit card or other sensitive information in your emails or letters to us.
 **1\. Your account, petitions, contributions**: If you have any questions about managing your account, petitions, or contributions, please contact us through our [Help Center](https://help.change.org/).
 **2\. Data privacy**