PusharooWeb push notifications and GDPR
Web push is one of the most privacy-friendly marketing channels — no names, no emails, explicit opt-in. That doesn’t remove your obligations. Here’s a practical overview (not legal advice).
- A push subscription is an endpoint plus keys for one browser — still potentially personal data.
- The browser’s permission dialog records an explicit opt-in; your prompt should be honest about what you send.
- Mention push in your privacy notice and make unsubscribing easy.
- Choose a provider that minimises data and can explain how it processes it.
First, a note
This is general information to help you ask the right questions, not legal advice. Privacy law depends on where you and your visitors are, and on what else you do with data. If you process data of people in the EU or UK, talk to a qualified adviser about your specific setup.
What data a subscription involves
| Data | Why it exists | Pusharoo |
|---|---|---|
| Push endpoint URL | Address at the browser’s push service | Stored |
| Encryption keys (p256dh, auth) | To encrypt messages for that browser | Stored |
| Browser type, language, timezone | Targeting and scheduling | Stored |
| Name, email, phone | — | Not collected |
| Cookies / tracking pixels | — | Not used (the snippet uses local storage to remember a “Not now”) |
Even without names, an endpoint relates to one person’s browser, so treat it as potentially personal data. Details: Pusharoo privacy.
Consent
- The browser shows its own permission dialog; nothing is subscribed without an explicit “Allow”.
- Your soft prompt should say what you’ll send and how often — no pre-ticked tricks or “Allow to continue” walls.
- The EU ePrivacy rules on storing or accessing information on a device are relevant to push and to anything else your site stores; get advice on how they apply to you.
- Keep a simple record of how you ask (prompt wording, date changed).
Your privacy notice
- That you offer web push notifications and what they’re used for.
- What data is stored (endpoint, keys, browser type, language, timezone) and for how long.
- Which provider processes it on your behalf.
- How to unsubscribe: browser settings or your own unsubscribe button.
Rights requests and deletion
Because subscriptions are anonymous, you usually can’t identify a subscription from a name or email. The practical route for “delete my data” is unsubscribing in the browser, which invalidates the endpoint; Pusharoo removes subscriptions the push service reports as gone. You can also add an unsubscribe button with Pusharoo.unsubscribe() (docs).
Choosing a push provider
- Does it collect only what’s needed to deliver?
- Does it avoid cookies and cross-site tracking for push?
- Where does it host data, and can it describe its processing in writing?
- Does your subscription belong to your domain (service worker on your origin) or the vendor’s?
Background on ownership: owning your push list.
Questions
Do web push notifications need GDPR consent?
Web push requires explicit browser permission, which is a form of opt-in consent. Whether that alone satisfies every legal requirement for your use depends on your situation — ask an adviser.
Is a push subscription personal data?
It can be, because it relates to one person’s browser even without a name. Treat it carefully and minimise what you store alongside it.
Does Pusharoo use cookies?
No. The snippet stores a small “Not now” reminder in the browser’s local storage so it doesn’t ask too often.
Keep reading
Web push vs. email: which to use, and when
A side-by-side comparison of signup friction, reach, message length, cost and the jobs each channel does best.
Web push notification best practices (2026 checklist)
A one-page checklist covering opt-in, iPhone, copy, timing, frequency, segments, deliverability and privacy.
Self-hosted web push and owning your list
Endpoints + VAPID keys = a list you control. What self-hosting means and what it costs you.
Push notifications: what the term actually means
The plain meaning of “push”, the three kinds of push notification and how each one is controlled.
Free for life. No limits.
Unlimited subscribers, campaigns and automations. No badges. About five minutes to install.