On the site change.org it's possible to start a petition.

I found two (somewhat) contradicting statements in their privacy policy:

  1. We do not monitor, verify, or perform any background check on campaign starters, petition signers, or other users of Change.org.

  2. Fraud prevention: We may use and disclose the information we collect from and about our users as we believe necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect the safety, privacy, rights, or property of us, our users, or others.

They also state, that they store the IP address of users who have signed a petition:

An IP Address may be identified and logged automatically in our server log files whenever you use our platform and services, along with the time of your visit and the specific page(s) that you visited.

From what I could gather it would be very easy to create petitions with fake users to bring attention to a petition (or to reach a certain amount).

My question is simply:

How does the site ensure that there's no voter fraud?

  • 5
    What makes you think they are effective at preventing voter fraud? Commented Feb 26, 2019 at 13:31

2 Answers 2


Short version (and obligatory IANAL*): they don't prevent "voter fraud" as this is not an official electoral system. Change.org is just some organization offering online petitions. Those petitions have no binding impact on any judiciary.

Longer version: As you have already quoted, they apparently do some kind of IP correlation analysis. This is regular fraud monitoring/detection, albeit not trivial. Low effort fraud - as probably conducted by someone who's trying to manipulate an online petition - will most likely leave some form of red flags. E.g. a large number of votes from the same IP within a short amount of time, same browser user agent etc.

As for how exactly they do it: They will most probably not disclose their exact process as this might lead to someone crafting more elaborate fraud attempts.

*I am not a lawyer

Fun fact on the side, there's even a rather ironic petition to make change.org legally binding for the UK government - with 23 whole signatures and apparently no traction whatsoever.


The default fraud “prevention” relies on IP blacklists (vpns/tor exit nodes/proxies (occasionally scanning the IP for a few ports)), browser user-agent, client localtime (javascript), and more recently WebGL kung-fu. And godless Google-served CAPTCHAs.

These systems are available to anyone willing to pay, and decent quality. It is good enough for petitions and similar diddling.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .