Push notifications 101: alerts people allowed

A push notification is a short alert that your app, or a website the person allowed, shows on their phone, tablet or computer, even when the app or site is closed. Tapping it opens the right screen. It is the cheapest way to reach your own users in the moment, and the easiest to lose, because each person decides whether your notifications appear at all.

• What it is: a title, a line or two of text, sometimes an image or buttons, and a link into your app or site.
• Who runs it: the platform owners. Apple runs the Apple Push Notification service (APNs), Google runs Firebase Cloud Messaging (FCM), Huawei runs Push Kit, and each browser maker runs a push service for the web.
• Reach: only people who installed your app or allowed your website, and who granted notification permission.
• Who may start: the business, once permission is given.
• How it is priced: the platform services are free or included in a developer membership; tools built on them charge by user, device or volume.
• Best for: timely updates about something the person is already doing with you: a delivery, a login, a booking, a reply.
• Avoid for: messages that must arrive, long content, and people who do not use your app.
• As of: October 2026.

1. Registration. When your app starts, it asks the operating system's push service for a device token, an address that points at this app on this device. The app sends the token to your server.
2. Sending. When something happens, your server, or a push provider you use through an API, sends a request with the token and a short payload to the platform service. Apple's interface is an HTTP/2 request carrying a JSON payload of at most 4KB (4096 bytes).¹⁰
3. Holding and delivering. If the device is offline, APNs stores the notification and keeps trying until an expiry time you set; with an expiry of zero it tries once and discards it.¹⁰ On Android, the system defers network activity while a phone is idle (a state called Doze); FCM's high-priority messages can wake the device, and Google asks developers to use them only for messages that show a notification.¹³
4. Showing. The phone's operating system decides how to present it, following the person's settings: banners, sound, a quiet entry in a list, or nothing.

Senders also choose a priority. On Apple devices, priority 10 means "send now" and must produce an alert, a sound or a badge; priority 5 means "send when it suits the device's battery", and such notifications may be grouped, delivered in bursts or throttled.¹⁰ Live Activities use the same service with their own address: when one starts, the system obtains a push token unique to that activity, and your server sends each update to it.¹⁵

Two details matter to a buyer. First, a token can go stale: when an app is removed, APNs answers with status 410, meaning the token is no longer active and you should stop sending to it.¹⁰ Second, FCM depends on Google Play services on Android. Google's documentation notes that some devices, such as Amazon's Kindle Fire tablets or devices sold in some regions, do not have them,⁸ so those phones need another service, such as the device maker's own; Huawei's Push Kit, for instance, serves HarmonyOS, Android, iOS and the web.⁹

On the web, the Push API, a W3C specification, lets a website receive messages from a push service through a small background script called a service worker, and the Notifications API, a WHATWG standard, displays them.¹⁸¹⁹ On Apple devices web push travels over the same APNs as app notifications.¹⁶

Apple announced its push service in March 2009 with the beta of iPhone OS 3.0, as a way for apps to alert users with sounds, text or a badge.¹ Google introduced Android Cloud to Device Messaging (C2DM) in May 2010, mainly to tell an app that new data was waiting on a server.² Google Cloud Messaging (GCM) replaced C2DM, which was deprecated in June 2012,³ and in April 2018 Google deprecated GCM in turn and moved developers to Firebase Cloud Messaging.⁴ On the web, Apple added Safari Push Notifications in Safari 7 for the Mac,¹⁷ and the industry later converged on the standard Push API.¹⁸

The next phase was about control for the person receiving. Android 8.0 required every notification to belong to a "channel" that users can switch off or quieten one by one.¹² iOS 15 in 2021 introduced four interruption levels, from Passive to Critical, alongside Focus modes and a scheduled notification summary.¹⁴ Android 13 made notifications something a new app must ask for.¹¹

Then push widened. iOS and iPadOS 16.4 brought web push to web apps added to the Home Screen in 2023.¹⁶ In 2023 Apple also let servers update Live Activities, the live panels on the lock screen for a delivery or a match, through APNs,¹⁵ and in 2024 it added broadcast updates for large audiences.²² Google switched off its legacy FCM sending interfaces in June 2024 in favour of the HTTP v1 API.⁵ In 2025 Apple introduced Declarative Web Push, which needs no service worker,¹⁷ and Android 16 added progress-centric notifications for rides, deliveries and navigation.²⁰

Push works wherever people use smartphones and modern browsers, which is to say in every region. What differs is which service carries the message, and that depends on the device, not the country alone:

• Americas, Europe, the Middle East and Africa: most audiences are on Apple devices or on Android phones with Google Play services, so APNs and FCM carry most traffic.¹⁰⁸
• Asia-Pacific: devices sold in some regions ship without Google Play services,⁸ and Huawei's HarmonyOS uses Push Kit,⁹ so a business with customers on those phones needs a provider that supports the device makers' own services.
• The web: web push suits publishers, retailers and software products used on desktop; on iPhone and iPad it reaches only people who have added your site to the Home Screen.¹⁶

The businesses that rely on push most are those whose customers open their app often or follow something in real time: retail and delivery, banking and payments, travel and transport, media and sport, and services that run on appointments.

We found no independent, dated figure for how many people allow notifications, by platform or by region, so we give none. Ask any provider for opt-in rates measured on your own audience.

• Notifications: order and delivery updates, flight and gate changes, account balances. Live Activities on iPhone and progress notifications on Android 16 show a journey such as a delivery or a ride as it happens.¹⁵²⁰
• Security: sign-in approvals and alerts about unusual activity, where a tap in your own app can confirm it is really the customer. For one-time codes see OTP.
• Booking and no-shows: reminders before an appointment, with a link to confirm or reschedule.
• Marketing: offers and news, only to people who explicitly opted in to promotional notifications.²³
• Embedded messaging: telling people a new chat message is waiting inside your app.
• Automation: a nudge when a basket is left behind or a subscription is about to renew.

The platform services themselves cost little or nothing:

• FCM is listed by Google as no-cost on every Firebase plan, as of October 2026.⁷
• APNs comes with the Apple Developer Program, which costs US$99 a year (local prices vary), as of October 2026.²¹ Web push to Home Screen web apps on iPhone and iPad does not require that membership.¹⁶

The money goes on the tooling around them. Push and engagement platforms commonly charge by monthly active user, by device or by notification volume, often with a free tier and with segmentation, scheduling, A/B testing and analytics in higher tiers. Customer-messaging suites may include push in a per-seat or per-contact price. Budget also for engineering time (keeping tokens clean, building notification settings in your app) and for the fallback channel, such as SMS or email, that catches what push cannot deliver.

This is not legal advice. For push, the platforms' own rules do most of the regulating, and they are enforced through app review and the permission prompt.

• Permission comes first. On Android 13 and later, a newly installed app's notifications are off until the person grants the POST_NOTIFICATIONS permission; apps that already had notifications when the phone was upgraded keep them.¹¹ Google advises asking in context, after people understand what the notifications are for.¹¹ On iPhone, a web app may ask only in response to something the person taps.¹⁶
• People control the categories. Since Android 8.0 every notification belongs to a channel, and the person can turn each channel off or make it quiet.¹² On Apple devices, only alerts marked Time Sensitive can break through Focus and the notification summary, and only if the person allows it; Critical alerts need a special entitlement from Apple.¹⁴
• Promotions need explicit opt-in. Apple's App Review Guideline 4.5.4 says push must not be required for an app to work, must not carry sensitive personal or confidential information, and may be used for promotions only after customers explicitly opt in through consent language in the app, with a way to opt out. Guideline 5.1.2 forbids requiring people to enable push to use the app or to receive a reward.²³
• Data protection still applies. A device token tied to a customer record is personal data under laws such as the GDPR. Some countries' marketing rules for email and SMS may also reach promotional notifications; take local advice before sending offers.

• No guaranteed delivery or timing. Low-priority APNs notifications may be grouped, throttled and in some cases not delivered;¹⁰ Android defers background activity on idle phones.¹³ Never make push the only route for a message that must arrive.
• Budgets for urgency. High-priority updates to Live Activities draw on a budget set by the system; exceed it and updates are throttled.¹⁵
• Stale tokens. Uninstalls and reinstalls change tokens. Remove tokens that return 410 and keep the rest current.¹⁰
• Small payloads. 4KB is enough for an alert, not for content; the alert should link to it.¹⁰
• Muted by the person. Channels switched off, Focus modes and summaries all mean a delivered notification may never interrupt anyone.¹²¹⁴
• Asking too early. A permission prompt on first launch, before people see any value, wastes the one chance many apps get.¹¹
• Migrations. Platform interfaces change: the legacy FCM interfaces stopped in June 2024,⁵ and more FCM server interfaces are scheduled to end in September 2027.⁶
• Devices without Google services need a second route.⁸⁹
• Web push on iPhone and iPad works only after the person adds your site to the Home Screen and then taps to allow notifications, so most mobile visitors to a website will never see one.¹⁶

• FCM clean-up. Google deprecated FCM's InstanceId server APIs and device groups in September 2026; new projects cannot adopt them after 1 January 2027, and they will be decommissioned on 29 September 2027.⁶
• Simpler web push. Declarative Web Push works in Safari 18.5 and later on the Mac and in Home Screen web apps on iOS and iPadOS 18.4 and later, with no service worker needed.¹⁷
• Richer progress on Android. Android 16's progress-centric notifications target rideshare, delivery and navigation journeys.²⁰
• Live Activities at scale. Apple's broadcast push lets one request update a Live Activity for everyone following the same event.²²
• The web standards. The W3C Push API is still a Working Draft (last dated 1 December 2025), and the WHATWG Notifications API is a living standard that keeps changing.¹⁸¹⁹

Choose push when people already use your app or site and the message is short, timely and about something they are doing with you. Pair it with a channel that does not depend on permission or on an installed app when the message matters: email for the record, SMS or a chat app for the urgent. Inside your app, in-app chat carries the conversation a notification starts. The push channel page lists providers, choosing a channel per message covers the trade-offs, and which channel for which need compares every channel side by side. Record notification permission and marketing opt-in separately, per channel and purpose: consent is a data model.