Cookie Policy
Last updated: January 22, 2026-
What is a cookie?
Cookies and similar technologies such as pixel tags, web beacons, clear GIFs, and JavaScript are standard features of websites that allow us to store small amounts of data on your computer about your visit to the Change.org platform. They help us learn which areas of the platform are useful and which areas need improvement.
On Change.org, we use cookies for many things, which we explain in detail below and which include:- to remember your preferred language and country;
- to help you log in again when you revisit the platform;
- to connect your Change.org account to your social media account, if you choose to do so; and
- to help our engineers improve the platform, by understanding how people find us and what devices they’re using.
The section below, titled “How do I manage cookies?”, outlines the choices you can make to control cookies. However, if you disable cookies and similar technologies, your experience on the platform may be diminished and some features may not work as intended.
-
What cookies do we use?
Below we list the different types of cookies that may be used by Change.org. Our Privacy Policy complements this Cookie Policy and outlines how any information that may be collected from cookies is used.
Provider & legal basis. “1P” means first party (set by Change.org); “3P” means third party (set by our partners). Essential cookies are strictly necessary (no consent required under ePrivacy); processing relies on GDPR Art. 6(1)(b) and/or 6(1)(f). Preference, Analytics, and Marketing cookies are used with your consent (GDPR Art. 6(1)(a)).
Retention. “Session” cookies expire when you close your browser. Unless otherwise stated, non-essential cookies persist for up to 13 months and you can withdraw consent at any time via the cookie manager.
Transfers. Where cookie data is transferred outside your region, we use appropriate safeguards (e.g., Standard Contractual Clauses). See our Privacy Policy for more details.
Essential Cookies
Essential cookies enable you to navigate our platform and to use our services and features. Without these cookies, our website and platform will not perform as smoothly for you, and we may not be able to provide certain core functions and features.
Note: We use Google reCAPTCHA on some pages (including our Help Center). reCAPTCHA may set cookies such as _GRECAPTCHA, AEC, SOCS, NID and may use local storage keys (e.g., rc::a/b/c). We configure reCAPTCHA strictly for anti-abuse/security.
Cookie Provider (1P/3P) Expiry Use / categorization rationale ACCOUNT_CHOOSER Google (3P) Up to 6 months Stores Google account chooser state for Sign-In UX and security. AEC Google (3P) Up to 6 months Ensures requests are made by the user and not malicious sites; anti-abuse. G_AUTHUSER_H Google (3P) Session Facilitates Google login and sharing on Change.org. G_ENABLED_IDPS Google (3P) Session Facilitates Google login and sharing on Change.org. HSID Google/YouTube (3P) Up to 13 months Tracks Google account ID and recent sign-in time for security. LANG PayPal (3P) Session Provides PayPal payment options and security. LSID Google (3P) Up to 2 years Google account session management and security. LSOLH Google (3P) Up to 2 years Login session state and security for Google services. New Relic script New Relic (3P) Session Performance metrics (e.g., page load times, transaction traces). SOCS Google (3P) Up to 13 months Security/state management for Google services; may record consent status. Sentry script Sentry (3P) Session Error diagnostics (logs, stack traces, device/browser info, IP). SID Google/YouTube (3P) Up to 13 months Tracks Google account ID and recent sign-in time for security. X-PP-SILOVER PayPal (3P) Session Provides PayPal payment options and security. __Host-1PLSID Google (3P) Up to 2 years Google account session integrity and security. __Host-3PLSID Google (3P) Up to 2 years Google account session integrity and security. __Host-GAPS Google (3P) Up to 2 years Maintains Google session state and security for Sign-In. __Secure-1PAPISID Google (3P) Up to 2 years Authentication/abuse prevention for Google services; security-only configuration. __Secure-1PSID Google (3P) Up to 2 years Authentication and session security; security-only configuration. __Secure-1PSIDCC Google (3P) Up to 1 year Session security and fraud prevention; security-only configuration. __Secure-1PSIDTS Google (3P) Up to 2 years Timestamped token to protect Sign-In and prevent abuse; security-only configuration. __Secure-3PSIDTS Google (3P) Up to 2 years Timestamped token to protect Sign-In and prevent abuse; security-only configuration. __Secure-BUCKET Google/YouTube (3P) Up to 13 months Prevents spam/abuse and ensures secure operation of embedded Google/YouTube services. Not used for advertising. __Secure-ENID Google (3P) Up to 13 months Prevents spam/fraud and protects services against abuse. Not used for advertising. __Secure-STRP Stripe (3P) Up to 1 year Stripe security and fraud-prevention for payments/embedded components. __cf* Cloudflare (3P) Session General Cloudflare security cookies. __cf_bm Cloudflare (3P) Up to 30 minutes Prevents certain attacks (DDoS) and other security risks. __cf_ob_info Cloudflare (3P) Session Prevents certain attacks (DDoS) and other security risks. __cf_use_ob Cloudflare (3P) Session Prevents certain attacks (DDoS) and other security risks. __cfduid Cloudflare (3P) Session Legacy Cloudflare security cookie (used only if enabled). __cfruid Cloudflare (3P) Session Prevents certain attacks (DDoS) and other security risks. __cfuid Cloudflare (3P) Session Prevents certain attacks (DDoS) and other security risks. __cfuvid Cloudflare (3P) Session Prevents certain attacks (DDoS) and other security risks. __stripe_mid Stripe (3P) Up to 1 year Prevents payment fraud. __stripe_sid Stripe (3P) Session Prevents payment fraud. _GRECAPTCHA Google (3P) Up to 6 months reCAPTCHA bot detection and abuse prevention for forms; may be set on google.com. _change_id Change.org (1P) Session Tracks user state and login. _change_lang Change.org (1P) Up to 13 months Tracks language preference. _change_session Change.org (1P) Session Maintains session for logged-in users. _helpjuice_session_v2 Helpjuice (3P) Session Maintains session for our Help Center/knowledge base. _px3 Human Security (3P) Up to 1 year Bot/fraud detection. _pxff_* Human Security (3P) Session Bot/fraud detection. _pxhd Human Security (3P) Up to 1 year Bot/fraud detection. _pxvid Human Security (3P) Up to 1 year Bot/fraud detection. app_meta_ppmu_ty_receipt Change.org (1P) Up to 13 months Tracks user preferences (e.g., banner dismissals, promotions, unsubscriptions). app_meta_promoted_ty Change.org (1P) Up to 13 months Tracks user preferences (e.g., banner dismissals, promotions, unsubscriptions). app_meta_starter_dash_prompt_banner Change.org (1P) Up to 13 months Tracks user preferences (e.g., banner dismissals, promotions, unsubscriptions). app_meta_unsubscribe_gtm Change.org (1P) Up to 13 months Tracks user preferences (e.g., banner dismissals, promotions, unsubscriptions). cf_clearance Cloudflare (3P) Up to 1 year Cloudflare challenge clearance; protects against abuse. cid Stripe (3P) Session Provides payment options and security. cookie_banner Change.org (1P) Up to 13 months Stores cookie preferences. country Change.org (1P) Up to 13 months Shows content relevant to a user’s country. docs.prefs Stripe (3P) Session Provides payment options and security. dont_auto_login_via_facebook Change.org (1P) Up to 13 months Allows users to disconnect Facebook auto-login. enforce_policy PayPal (3P) Session Provides PayPal payment options and security. fbsr_* Meta/Facebook (3P) Session Facilitates login and sharing on Change.org. g_state Google (3P) Session Temporary state for One-Tap/Sign-In flow; anti-abuse. l7_az PayPal (3P) Session Provides PayPal payment options and security. machine_identifier Stripe (3P) Up to 1 year Prevents payment fraud. membership_view Change.org (1P) Up to 6 months Personalizes membership signup options displayed. optimizelyEndUserId Optimizely (3P) Up to 13 months Include/exclude user in experiments per consent. optimizelyOptOut Optimizely (3P) Up to 13 months Records a user’s Optimizely opt-out state. pending-signature-* Change.org (1P) Session Keeps track of signatures requiring authentication. private_machine_identifier Stripe (3P) Up to 1 year Provides payment options and security. pxcts Human Security (3P) Session Bot/fraud detection. recent-views Stripe (3P) Session Provides payment options and security. sc_f PayPal (3P) Session Provides PayPal payment options and security. stripe.csrf Stripe (3P) Session CSRF protection for Stripe. ts PayPal (3P) Session Provides PayPal payment options and security. ts_c PayPal (3P) Up to 3 years Provides PayPal payment options and security. tsrce PayPal (3P) Session Provides PayPal payment options and security. uuid Change.org (1P) Up to 13 months Tracks user state and login. Preference Cookies
Preference cookies remember your choices and settings—like language or region—so the site works the way you expect when you come back. They help us keep your preferences over time and personalize content (for example, greeting you by name).
Cookie Provider (1P/3P) Expiry Use / categorization rationale OTZ Google (3P) Up to 6 months Google preferences tracking. app_download_banner_closed_count Change.org (1P) Up to 13 months Tracks times seen/dismissed for banners (policy updates, GDPR, surveys). app_meta_membership_before_you_go Change.org (1P) Up to 13 months Tracks membership page visits. app_meta_membership_reminder Change.org (1P) Up to 13 months Tracks membership page visits. app_meta_public_signature_* Change.org (1P) Up to 13 months Signature display preference. current_user_language Helpjuice (3P) Up to 13 months Saves language preference in the Help Center. mem_banner_x Change.org (1P) Up to 13 months Membership banner dismissal preference. mem_card_x Change.org (1P) Up to 13 months Membership card dismissal preference. psf_combo_bandit_rr1 Change.org (1P) Up to 13 months Keeps track of amount displayed on combo page. starter-banner-petition-[petitionID] Change.org (1P) Up to 13 months Banner frequency and preference tracking. tos_banner_remaining_views_* Change.org (1P) Up to 13 months Banner frequency and preference tracking. Analytics Cookies
Analytics cookies collect information about how you use Change.org, like which pages you visited and which links you click on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions.
Cookie Provider (1P/3P) Expiry Use / categorization rationale __stripe_orig_props Stripe (3P) Up to 1 year Analyzes and improves Stripe payment services. __utm* Google (3P) Up to 13 months Google Analytics: distinguishes users/sessions. _airbrake_session_* Change.org / Airbrake (1P/3P) Session Error and performance monitoring. _ga Google (3P) Up to 13 months Google Analytics: distinguishes users. _gat* Google Tag Manager (3P) 1 minute Throttles request rates. _gid Google (3P) Up to 13 months Google Analytics: distinguishes users. Experiments_* Change.org (1P) Up to 13 months Product experiments evaluation. ga_first_visit Google (3P) Up to 13 months Remembers first-visit traffic source/browser. NID Google (3P) Up to 6 months Google preferences tracking. optimizelyRedirectData Optimizely (3P) Up to 13 months Runs product experiments. optimizelySession Optimizely (3P) Up to 13 months Runs product experiments. Marketing Cookies
Marketing cookies track your activity to help deliver more relevant content or advertising or to limit how many times you see an ad. These cookies can share that information with other organizations or advertisers.
Cookie Provider (1P/3P) Expiry Use / categorization rationale APISID Google (3P) Up to 2 years Used for ads on Google. NID Google (3P) Up to 6 months Google preferences tracking. PREF Google (3P) Up to 2 years Used for ads on Google. SAPISID Google/DoubleClick (3P) Up to 2 years Used by DoubleClick for ads on Google/YouTube. SIDCC Google (3P) Up to 1 year Used for ads on Google. SSID YouTube (3P) Up to 2 years Used by YouTube for ads on Google/YouTube. _gcl_au Google Tag Manager (3P) 3 months Stores and tracks conversions. _uetsid Microsoft Advertising (3P) Session Microsoft Advertising (Bing) ads. _uetvid Microsoft Advertising (3P) Up to 13 months Microsoft Advertising (Bing) ads. __Secure-3PAPISID Google/YouTube (3P) Up to 2 years Used by YouTube for ads on Google/YouTube. __Secure-3PSID Google/YouTube (3P) Up to 2 years Used by YouTube for ads on Google/YouTube. __Secure-3PSIDCC Google/YouTube (3P) Up to 1 year Used by YouTube for ads on Google/YouTube. -
How do I manage cookies?
You can manage your cookie preferences and opt-out of preference, analytics, and marketing cookies with the cookie manager. You can change or withdraw your consent at any time using the cookie manager.
If you are in a region that requires prior consent (e.g., the EU/EEA/UK), we will set only essential cookies until you provide consent for additional categories. If you are in California, you can use the cookie manager to exercise your “Do Not Sell or Share My Personal Information” choice for cookies that may be considered a “sale” or “sharing” under the CPRA.
You can also control cookies via your browser settings and device-level controls (which may allow you to block or delete cookies and similar technologies). Note that certain features of the platform may not function properly without essential cookies.
-
Policy updates
This is a snapshot of how we use cookies today; we may change this Cookie Policy if we change our use of cookies over time. The “last updated” date at the top of this page indicates when this page was last changed.
Please refer to our Privacy Policy for more information about Change.org’s data usage. If you have specific questions, please reach out to the appropriate contact listed in our Privacy Policy [9. Key contacts].
Thanks for supporting change in your community — we can’t wait to see what you’ll change next!
More information about cookies can also be found at http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm, https://ico.org.uk/for-the-public/online/cookies/ and http://www.allaboutcookies.org/.
We provide this Cookie Policy in multiple languages, using artificial intelligence (ChatGPT). To the extent permitted by applicable law, the English version will control in the event of any conflict or inconsistency.