Privacy Policy

This chart details the categories of Personal Data that we collect and have collected, including over the past 12 months:

The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Please see details about our use of cookies in our Please see our Cookie Policy.

We may serve advertisements, consisting of Change.org Promoted Petitions, through the Services. We may also work with third-party advertising partners to show you advertisements about Change.org on other sites, based on general profile categories or your preferences or behaviors (“Interest-Based Ads”). Information for Interest-Based Ads (including Personal Data) may be provided to us by you, or derived from the usage patterns of particular users on the Services and/or services of third parties. Such information may be gathered through tracking users’ activities across time and unaffiliated properties, including when you leave the Services. To accomplish this, we or our service providers may deliver Cookies, including a file (known as a “web beacon”) from an ad network to you through the Services. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Web beacons allow ad networks to view, edit or set their own Cookies on your browser, just as if you had requested a web page from their site.

Our Commercial or Business Purposes for Collecting Personal Data

Purpose	Examples
Providing, customizing and improving the Services	Creating and managing your account or other user profiles. Processing orders or other transactions; billing. Providing you with the products, services or information you request. This includes: To allow you to create petitions, sign petitions, join “topics” or “movements” (groups of similar petitions), follow their progress, and manage petitions (including publishing your name and/or signature). To allow you to participate in other activities on Change.org platforms, sites and apps, as well as to complete and fulfill your transactions with us. To facilitate the social sharing functionality that you choose to use, such as sharing content and petitions through the Change.org platform and other social media platforms, like Facebook and X. To connect you with media outlets, if applicable. For Decision Makers: providing you with the option to respond to a petition that identifies you as a Decision Maker, and creating a profile page for you, if applicable. Specifically, note that our platform enables petition starters to designate specific people who they believe to be the “Decision Maker” empowered to act upon the subject of their petition (“Decision Maker”). If you are identified as a Decision Maker for a petition, we may process your personal information. Meeting or fulfilling the reason you provided the information to us. Providing support and assistance for the Services. Improving the Services, including testing, research, internal analytics and product development. Determining the effectiveness of campaigns. Notifying Decision Makers of campaigns, if applicable. Personalizing the Services, website content and communications based on your preferences including to personalize your experience by presenting petitions, campaigns, and offers tailored to you based on information we have collected from you. Doing fraud protection, security and debugging. Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (the “CCPA”), the Colorado Privacy Act (the “CPA”), the Connecticut Data Privacy Act (the “CTDPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Oregon Consumer Privacy Act (“OCPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Utah Consumer Privacy Act (the “UCPA”), or the Virginia Consumer Data Protection Act (the “VCDPA”) (collectively, the “State Privacy Laws”).
Marketing the Services	Marketing and selling the Services. This may include: Communications related to petitions you’ve signed, other petitions that may be of interest, or petitions relevant to your location. Editorial communications about specific issues or about Change.org. Communications about contributions to causes or about crowdfunding for a specific petition. Communications about becoming a member or subscriber of Change.org. If you choose to provide your telephone number or postal address, which are not required, outreach by phone, SMS, or postal mail about the Change.org contribution program or other ways you can support campaigns. For more information on text messages and SMS, please refer to our Terms of Service [10. Text messaging]. Invitations to Change.org events. Outreach to allow you to participate in events and similar promotions and to administer these activities. Some of these activities have additional rules, which could contain additional information about how we use and disclose information about you, so we suggest that you read these rules carefully. Reminders about particular petitions or the Change.org contribution program, if you have not completed starting or signing or joining. Showing you advertisements, including interest-based, online behavioral or targeted advertising.
Corresponding with you	Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Change.org or the Services. Sending emails and other communications according to your preferences.

In addition, each of the above referenced categories of Personal Data may be collected, used, and disclosed with the government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms including: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, Change.org, or another party; enforcing any agreements with you; responding to claims that any posting or other content violates third-party rights; and resolving disputes.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent.

We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below.

We may disclose any Personal Data that we collect with third parties in conjunction with any of the activities set forth under Other Permitted Purposes for Processing Personal Data section above.

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

For example:

• If you are a registered user, we will retain your account information for as long as your account remains active.
• We consider a petition signature to be public speech – namely, a public declaration of support for the associated petition. Accordingly, if you have signed a petition, we will retain this information unless and until you ask us to remove it, as we understand that deleting an account does not necessarily mean withdrawing support for petitions that have been signed.
• We retain your device/IP data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently.
• If we receive a valid data preservation request, subpoena, or similar legally binding request, we will preserve the relevant data to the extent possible for a period of up to 90 days while the legal request is assessed and resolved, after which the data will be permanently deleted unless further retention is legally required.

As part of the CARU COPPA Safe Harbor, we are subject to audits and frequent monitoring of our website and other enforcement and accountability mechanisms administered independently by CARU.

If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at:

CARU COPPA Safe Harbor
Attn: Director
1676 International Drive, Suite 550
McLean, VA 22102
InfoCaru@bbbnp.org

PLEASE NOTE: CARU is not a data controller or a data processor for Change.org and cannot process personal information requests made pursuant to CCPA. Please direct your personal information request directly to Change.org through the following email: dpt@change.org.

Your Profile

When you sign or create a petition via our Change.org platform, an account and user profile page are created for you. Any petitions that you sign will not appear on your user profile by default. Any petitions that you have started and published will appear on your user profile by default. If you would like to delete any petitions you have published, please contact our support team through our Help Center.

Email Marketing Communications

If you no longer want to receive marketing-related emails from Change.org going forward, you may opt out of receiving these by (1) following the instructions contained in any such email; (2) logging in to your account, clicking on “Settings,” and selecting “Manage communications preferences”; or (3) contacting our support team through our Help Center. We will comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails from us, we may still send you important administrative messages (such as updates about your account or service changes), from which you cannot opt out.

Text Message and SMS Communications

For information on opting out of text messages, please refer to our Terms of Service [10. Text messaging].

Data Protection Rights

You are granted under this Privacy Policy the following rights:

• Right of access: You can ask us to provide you with information about our processing of your personal information and give you access to your personal information.
• Right to rectification: You can ask us to correct any personal information we hold about you that is inaccurate or incomplete.
• Right to erasure: You can ask us to delete or remove personal information where there is no lawful reason for us continuing to store or process it, where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully, or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons that you will be informed of, if applicable, at the time of your request.
• Right to restrict processing: You can ask us to suspend the processing of your personal information if (i) you want us to establish the data’s accuracy; (ii) our use of the data is unlawful but you do not want us to erase it; (iii) you need us to retain the data, even if we no longer require it, because you need it to establish, exercise, or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Right to object: You may object to the processing of your personal information in instances where we are relying on a legitimate interest (or that of a third party) if you feel the processing activity infringes upon your fundamental rights and freedoms. We will assess such objections and will cease processing your personal information in instances where we do not have compelling legitimate grounds to continue processing your personal information.
• Right to data portability: You may, in certain circumstances, ask us to provide you (or a third party you have chosen) with your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that was processed based on your consent or a contract we have with you.
• Right to withdraw consent at any time: You may withdraw your consent in instances where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out prior to the withdrawal of your consent.
• Right to opt out from the use of cookies: Please see our Cookie Policy for more information.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the personal data or where certain exemptions apply.

To exercise any rights you may have under this Privacy Policy or applicable privacy laws, reach out to the appropriate contact listed in our Privacy Policy [9. Key contacts] or get in touch with our support team through our Help Center. If we are unable to identify you from your first communication, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Although we urge you to contact us first to find a solution for every concern you may have, you may have the right to lodge a complaint with your competent data protection authority. Contact details of EU Data Protection Authorities can be found here.

“Selling,” “Sharing,” or “Targeted Advertising”

Depending on your state of residence, you may have the right to opt out from the “sale,” “share,” or disclosure of your Personal Data for the purposes of targeted advertising. These or similar terms may be defined differently depending on the applicable U.S. State Privacy Law.

You have the right to opt-out of the sale or share of your Personal Data by following the instructions in the Exercising Your Rights under U.S. State Privacy Laws section. Once you have submitted an opt-out request, we will not ask you to reauthorize the sale of your Personal Data for at least 12 months.

As described in the Information from Cookies and Similar Technologies section above, Certain Cookies placed by third parties into our Services may allow those third parties to collect your Personal Data for targeted advertising purposes. Under certain U.S. State Privacy Laws, this may also constitute a “sale” and/or “share” of your Personal Data. For clarity, when we use the term “sell,” we mean for valuable consideration and not for any monetary value.

We sell or share your Personal Data to the following categories of third parties:

• Advertising Partners

Over the past 12 months, we have sold or shared the following categories of your Personal Data to categories of third parties listed above:

• Device/IP Data
• Web Analytics Data
• Identifiers

Under the certain U.S. State Privacy Laws, we disclose the Personal Data of minors under 18 years of age in a way that may be considered a sale. If you are between 13 and 18 years of age, you must authorize us to sell your Personal Data. If you are under 13 years of age, your parent or guardian must authorize us to sell your Personal Data.

Processing of Sensitive Personal Data
Subject to your consent where required by applicable law, we may use Sensitive Personal Information for purposes of providing goods or services as requested by you; ensuring security and integrity; short term transient use such as displaying first party, non-personalized advertising, in the form of suggested petitions and campaigns of potential interest; performing services for our business, including maintaining and servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of our business; and activities relating to quality and safety control or product improvement.

Automated Decision Making and Profiling
Depending on the state of your residence, you may have the right to opt-out the use of automated decision making technology or from the processing of your Personal Data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects to you, if applicable. However, we do not process your Personal Data in this manner.

Anti-Discrimination
We will not discriminate against you for exercising your rights under applicable privacy laws. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under applicable privacy laws. However, we may offer different tiers of our Services as allowed by applicable data privacy laws with varying prices, rates or levels of quality of the goods or services you receive related to the value of Personal Data that we receive from you.

Other State Law Privacy Rights

California Resident Rights
Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at dpt@change.org.

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Services do not support Do Not Track requests at this time. To find out more about “Do Not Track,” you can visit www.allaboutdnt.com.

Nevada Resident Rights
If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties. You can exercise this right by contacting us through our Help Center with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. However, we do not “sell” Personal Data, as such term is defined under Nevada law.

Exercising Your Rights under U.S. State Privacy Laws

To exercise the rights described in this Privacy Policy, you or your Authorized Agent (if applicable and as defined below), must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data (such as your Contact or Profile Data), and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Data provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.
We will work to respond to your Valid Request within the time period required by applicable privacy laws. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

Request to Opt-Out of Sale, Share, and/or Targeted Advertising
As applicable, you may opt-out from any “sales,” “shares,” or targeted advertising through Cookies, by using the following methods:

• By accessing your cookie consent mechanism by accessing your “Cookie Settings” at the bottom left of our website.

Request to Access, Delete, Correct
As applicable, you may submit a Valid Request for your right to access, delete, correct, or obtain a copy of your Personal Data described in this Privacy Policy by using the following methods:

• Email us at: dpt@change.org.
• Submit a form through our Help Center

If you are a California, Colorado, Connecticut, Delaware, Montana, Nebraska, New Hampshire, New Jersey, Oregon, or Texas resident, you may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

Appealing a Denial

If you are a Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, or Virginia resident and we refuse to take action on your request within a reasonable period of time after receiving your request in accordance with this section, you may appeal our decision. In such appeal, you must (1) provide sufficient information to allow us to verify that you are the person about whom the original request pertains and to identify the original request, and (2) provide a description of the basis of your appeal. Please note that your appeal will be subject to your rights and obligations afforded to you under the State Privacy Laws (as applicable). We will respond to your appeal within the time period required under the applicable law. You can submit a Verified Request to appeal by the following methods:

• Email us at: dpt@change.org (title must include “[STATE OF RESIDENCE] Appeal”)
• Submit a form through our Help Center

If we deny your appeal, you have the right to contact the Attorney General of your State, including by the following links: Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, and Virginia.

8B. European Union, United Kingdom, and Swiss Privacy Rights

9. Key contacts