PusharooCCPA, CPRA and web push notifications
If your business is covered by the California Consumer Privacy Act (as amended by the CPRA), your push subscriber list is likely part of the personal information you handle. Here’s a practical overview of what that means for notices, requests and vendors.
- The CCPA covers for-profit businesses that meet a threshold (for example revenue above an inflation-adjusted $25 million).
- A push subscription endpoint is a unique device identifier and is likely “personal information”.
- List push data in your privacy notice, honour deletion and access requests, and don’t sell or share it for cross-context ads without opt-out handling.
- Choose vendors that don’t sell your list; Pusharoo stores minimal data and doesn’t sell or share it.
Does the CCPA apply to you?
The CCPA applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above $25 million (adjusted for inflation — the California Privacy Protection Agency set it at $26,625,000 from 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of annual revenue from selling or sharing personal information. Many small sites aren’t covered — but following its principles is good practice anyway.
Is a push subscription personal information?
The CCPA’s definition is broad and includes unique identifiers, online identifiers and device identifiers that can reasonably be linked to a consumer or household. A push endpoint uniquely identifies one browser on one device, and it’s stored with data like browser type, language, timezone and activity. Treat it as personal information. If you attach a push subscription to a logged-in account, it clearly is.
Notice at collection
- Your privacy policy should list push subscription data as a category you collect: the identifier, device/browser data, and engagement (delivered, clicked).
- State the purpose (sending the notifications the person asked for) and retention (until they unsubscribe or the browser reports the subscription gone).
- Your soft prompt can link to the policy; the browser’s own dialog can’t.
Handling consumer requests
| Request | For push data |
|---|---|
| Know / access | Explain what you hold for that browser; if subscriptions are linked to accounts, include them |
| Delete | Remove the subscription (and unsubscribe the browser if possible); unlinked anonymous subscriptions may not be identifiable to a person |
| Correct | Rarely relevant; tags you set may be correctable |
| Opt out of sale/sharing | Don’t sell push data or use it for cross-context behavioural advertising; if you do, honour opt-outs including Global Privacy Control |
| Non-discrimination | Don’t penalise people who decline notifications |
Vendors and “service providers”
If a push vendor processes subscriber data for you, the CCPA expects a contract restricting how it uses that data. Ask any vendor: do you sell or share subscriber data, use it for your own ads, or send ads to my list? Ad-supported push plans that send third-party ads to your subscribers deserve particular scrutiny (one example).
Pusharoo’s privacy note states that it stores a browser’s push address and keys, browser type, language, timezone, subscription and last-seen times and delivery/click events — plus any tags or events your site chooses to send — and that it doesn’t sell or share subscriber data, use advertising cookies or track across sites.
A practical checklist
- Inventory: what push data you hold and where.
- Privacy policy: add push subscriptions and purposes.
- Requests: a process to delete a subscription by account or browser.
- Tags: don’t tag subscribers with sensitive personal information (health, precise location, etc.).
- Vendors: written terms; no selling or ad use of your list.
This is a practical overview, not legal advice. Laws and their interpretation change; check with a qualified lawyer for your situation.
Questions
Does the CCPA require consent for push notifications?
The CCPA is mainly a notice-and-opt-out law; the browser’s permission dialog already requires opt-in for push. You still need a notice and must honour requests.
Is a push endpoint personal information under CCPA?
Likely yes — it’s a unique identifier for a browser on a device. Treat it as personal information.
Does Pusharoo sell subscriber data?
No. Pusharoo’s privacy note states it doesn’t sell or share subscriber data.
Does CCPA require consent for web push?
CCPA is mainly an opt-out law about selling or sharing personal information; the browser opt-in handles permission. Respect deletion and know requests for stored data.
Keep reading
Web push notifications and GDPR
What a subscription is, consent, privacy notices, minimisation, rights requests and processors — at a practical level.
CASL and web push notifications
Whether CASL covers web push, consent, sender identification and unsubscribe — and a cautious checklist.
Self-hosted web push and owning your list
Endpoints + VAPID keys = a list you control. What self-hosting means and what it costs you.
Push notification segmentation that actually helps
Filter by site, device, language, recency and inactivity. Six recipes you can copy.
Free for life. No limits.
Unlimited subscribers, campaigns and automations. No badges. About five minutes to install.