Consent and Push Notifications: The Browser Prompt Is Not the Whole Story

Published 2026-10-22

Push notifications have two gatekeepers. The browser shows a permission prompt that most sites trigger carelessly and most visitors refuse on sight, and behind it sits a set of marketing and consent duties that the prompt alone does not settle. Sites that treat an allowed prompt as permanent, unlimited permission end up with blocks, complaints, and browsers restricting them further.

This guide covers how to ask well, what the permission does and does not cover, frequency and timing discipline, and how revocation should work so leaving is as easy as joining.

Ask with a pre prompt you control

The native browser prompt cannot be styled, explained, or timed well, and a refusal there is hard to reverse because the browser remembers it. A soft pre prompt of your own, shown after a visitor has shown real interest, lets you explain what your notifications contain and how often they arrive. Only people who say yes to that see the native prompt, which protects your permission rate and respects the rest. Never trigger the native prompt on first page load before any value is visible; it trains visitors to block you and browsers to distrust your site.

Permission is purpose bound

Someone who accepted order updates has not accepted daily promotions. The categories you described when asking define what you may send, and drifting from service messages into marketing is where push programs get into trouble. Keep the promise specific in the pre prompt text and in your records: what topics, roughly how often, and whether marketing is included. If you later want to add a new category, ask again in product, where the person can say no without losing the updates they actually wanted.

Frequency, timing, and the block button

Every push competes with the nuclear option: the visitor blocking your site at browser level, which ends the channel entirely and is almost never reversed. Sensible programs cap frequency, respect local night hours, and drop off quickly when a subscriber stops engaging instead of escalating. Time zone handling matters more than most teams expect. A 9 AM offer sent to a 3 AM inbox is remembered. Build the caps into the sending tool, not into a wiki page, so a busy campaign week cannot quietly override them.

Make leaving genuinely easy

Unsubscribing from push should not require a support article about browser settings. Provide a notification preferences page on your own site that turns categories off immediately using the same subscription the browser holds, and link it from your emails and account pages. When someone revokes in the browser instead, your systems should learn that state on the next visit and stop treating the subscription as live. Records of permission, category, and revocation together are the receipt that this channel, like any other, was run on a real choice.

Related reading

These earlier guides cover connected questions in more depth: Debugging Consent Mode Signals When Numbers Do Not Match, Cookie Scanner False Positives: A Triage Routine That Keeps Notices Accurate, and Consent Across Subdomains: Should One Choice Follow the Visitor?.

Frequently asked questions