PusharooWeb push notifications and GDPR
Web push is one of the most privacy-friendly marketing channels — no names, no emails, explicit opt-in. That doesn’t remove your obligations. Here’s a practical overview (not legal advice).
- A push subscription is an endpoint plus keys for one browser — still potentially personal data.
- The browser’s permission dialog records an explicit opt-in; your prompt should be honest about what you send.
- Mention push in your privacy notice and make unsubscribing easy.
- Choose a provider that minimises data and can explain how it processes it.
First, a note
This is general information to help you ask the right questions, not legal advice. Privacy law depends on where you and your visitors are, and on what else you do with data. If you process data of people in the EU or UK, talk to a qualified adviser about your specific setup.
What data a subscription involves
| Data | Why it exists | Pusharoo |
|---|---|---|
| Push endpoint URL | Address at the browser’s push service | Stored |
| Encryption keys (p256dh, auth) | To encrypt messages for that browser | Stored |
| Browser type, language, timezone | Targeting and scheduling | Stored |
| Name, email, phone | — | Not collected |
| Cookies / tracking pixels | — | Not used (the snippet uses local storage to remember a “Not now”) |
Even without names, an endpoint relates to one person’s browser, so treat it as potentially personal data. Details: Pusharoo privacy.
Consent
- The browser shows its own permission dialog; nothing is subscribed without an explicit “Allow”.
- Your soft prompt should say what you’ll send and how often — no pre-ticked tricks or “Allow to continue” walls.
- The EU ePrivacy rules on storing or accessing information on a device are relevant to push and to anything else your site stores; get advice on how they apply to you.
- Keep a simple record of how you ask (prompt wording, date changed).
Your privacy notice
- That you offer web push notifications and what they’re used for.
- What data is stored (endpoint, keys, browser type, language, timezone) and for how long.
- Which provider processes it on your behalf.
- How to unsubscribe: browser settings or your own unsubscribe button.
Rights requests and deletion
Because subscriptions are anonymous, you usually can’t identify a subscription from a name or email. The practical route for “delete my data” is unsubscribing in the browser, which invalidates the endpoint; Pusharoo removes subscriptions the push service reports as gone. You can also add an unsubscribe button with Pusharoo.unsubscribe() (docs).
Tags, events and data minimisation
Tags and custom events make segmentation powerful, and they’re also data you collect. Under GDPR’s minimisation principle, tag only what you need for the notifications people asked for — interests and plan types, not names, emails, health information or precise location — and document it in your privacy notice. Delete tags you no longer use (the REST API accepts null to remove a tag).
Other regions
Practical overviews for California (CCPA/CPRA) and Canada (CASL).
Choosing a push provider
- Does it collect only what’s needed to deliver?
- Does it avoid cookies and cross-site tracking for push?
- Where does it host data, and can it describe its processing in writing?
- Does your subscription belong to your domain (service worker on your origin) or the vendor’s?
Background on ownership: owning your push list.
Questions
Do web push notifications need GDPR consent?
Web push requires explicit browser permission, which is a form of opt-in consent. Whether that alone satisfies every legal requirement for your use depends on your situation — ask an adviser.
Is a push subscription personal data?
It can be, because it relates to one person’s browser even without a name. Treat it carefully and minimise what you store alongside it.
Does Pusharoo use cookies?
No. The snippet stores a small “Not now” reminder in the browser’s local storage so it doesn’t ask too often.
Do I need a cookie banner for web push?
Push permission is handled by the browser, not cookies. You may still need a banner for other technologies on your site; Pusharoo itself sets no cookies.
Who is the controller for push subscriber data?
Typically the website owner decides why and how notifications are sent, so it acts as controller; the push provider processes data on its behalf.
Keep reading
Web push vs. email: which to use, and when
A side-by-side comparison of signup friction, reach, message length, cost and the jobs each channel does best.
Web push notification best practices (2026 checklist)
A one-page checklist covering opt-in, iPhone, copy, timing, frequency, segments, deliverability and privacy.
Self-hosted web push and owning your list
Endpoints + VAPID keys = a list you control. What self-hosting means and what it costs you.
Push notifications: what the term actually means
The plain meaning of “push”, the three kinds of push notification and how each one is controlled.
More in Privacy & compliance: CCPA, CPRA and web push notifications · CASL and web push notifications · All guides
Free for life. No limits.
Unlimited subscribers, campaigns and automations. No badges. About five minutes to install.