--- title: "Push notifications 101: alerts people allowed" summary: "Push notifications are short alerts from your own app or website, carried by the platforms' notification services (Apple's APNs, Google's FCM, Huawei's Push Kit and the browsers' push services). Sending is free or nearly free; the real price is permission, which people can refuse or withdraw at any time." canonical: https://cpaas.co/en/learn/push-101 kind: explainer depth: foundation origin: original published: 2026-10-13T16:26:18.899Z updated: 2026-10-14T16:26:19.844Z topics: ["Messaging", "Architecture", "Fundamentals"] language: en --- # Push notifications 101: alerts people allowed ## At a glance A push notification is a short alert that your app, or a website the person allowed, shows on their phone, tablet or computer, even when the app or site is closed. Tapping it opens the right screen. It is the cheapest way to reach your own users in the moment, and the easiest to lose, because each person decides whether your notifications appear at all. - **What it is:** a title, a line or two of text, sometimes an image or buttons, and a link into your app or site. - **Who runs it:** the platform owners. Apple runs the Apple Push Notification service (APNs), Google runs Firebase Cloud Messaging (FCM), Huawei runs Push Kit, and each browser maker runs a push service for the web. - **Reach:** only people who installed your app or allowed your website, and who granted notification permission. - **Who may start:** the business, once permission is given. - **How it is priced:** the platform services are free or included in a developer membership; tools built on them charge by user, device or volume. - **Best for:** timely updates about something the person is already doing with you: a delivery, a login, a booking, a reply. - **Avoid for:** messages that must arrive, long content, and people who do not use your app. - **As of:** October 2026. ```diagram:compare | Mobile app push | Web push Where it appears | The notification area of a phone or tablet | A desktop browser, Android, and web apps on an iPhone's Home Screen What the person must install | Your app | Nothing, but on iPhone and iPad the site must be added to the Home Screen Who carries it | APNs, FCM or the device maker's own service | The browser's push service; APNs on Apple devices How permission is asked | By the app; off by default on Android 13 and later | By the site, after the person taps something ``` ## How it works 1. **Registration.** When your app starts, it asks the operating system's push service for a **device token**, an address that points at this app on this device. The app sends the token to your server. 2. **Sending.** When something happens, your server, or a push provider you use through an [API](/en/learn/glossary#api), sends a request with the token and a short payload to the platform service. Apple's interface is an HTTP/2 request carrying a JSON payload of at most 4KB (4096 bytes).[^10] 3. **Holding and delivering.** If the device is offline, APNs stores the notification and keeps trying until an expiry time you set; with an expiry of zero it tries once and discards it.[^10] On Android, the system defers network activity while a phone is idle (a state called Doze); FCM's high-priority messages can wake the device, and Google asks developers to use them only for messages that show a notification.[^13] 4. **Showing.** The phone's operating system decides how to present it, following the person's settings: banners, sound, a quiet entry in a list, or nothing. Senders also choose a priority. On Apple devices, priority 10 means "send now" and must produce an alert, a sound or a badge; priority 5 means "send when it suits the device's battery", and such notifications may be grouped, delivered in bursts or throttled.[^10] Live Activities use the same service with their own address: when one starts, the system obtains a push token unique to that activity, and your server sends each update to it.[^15] Two details matter to a buyer. First, a token can go stale: when an app is removed, APNs answers with status 410, meaning the token is no longer active and you should stop sending to it.[^10] Second, FCM depends on Google Play services on Android. Google's documentation notes that some devices, such as Amazon's Kindle Fire tablets or devices sold in some regions, do not have them,[^8] so those phones need another service, such as the device maker's own; Huawei's Push Kit, for instance, serves HarmonyOS, Android, iOS and the web.[^9] On the web, the Push API, a W3C specification, lets a website receive messages from a push service through a small background script called a service worker, and the Notifications API, a WHATWG standard, displays them.[^18][^19] On Apple devices web push travels over the same APNs as app notifications.[^16] ```diagram:path # The path of one notification Your server | Decides an alert is due and looks up the device token | A request with the token and a short payload Push provider (optional) | One API in front of several platform services | The same request, once per platform Platform service | APNs, FCM, Push Kit or a browser push service | Held and retried until it expires Phone or computer | The operating system applies the person's settings | Shown, grouped into a summary or kept silent Your app | Opens on the right screen when tapped | An open event back to you ``` ## A short history Apple announced its push service in March 2009 with the beta of iPhone OS 3.0, as a way for apps to alert users with sounds, text or a badge.[^1] Google introduced Android Cloud to Device Messaging (C2DM) in May 2010, mainly to tell an app that new data was waiting on a server.[^2] Google Cloud Messaging (GCM) replaced C2DM, which was deprecated in June 2012,[^3] and in April 2018 Google deprecated GCM in turn and moved developers to Firebase Cloud Messaging.[^4] On the web, Apple added Safari Push Notifications in Safari 7 for the Mac,[^17] and the industry later converged on the standard Push API.[^18] The next phase was about control for the person receiving. Android 8.0 required every notification to belong to a "channel" that users can switch off or quieten one by one.[^12] iOS 15 in 2021 introduced four interruption levels, from Passive to Critical, alongside Focus modes and a scheduled notification summary.[^14] Android 13 made notifications something a new app must ask for.[^11] Then push widened. iOS and iPadOS 16.4 brought web push to web apps added to the Home Screen in 2023.[^16] In 2023 Apple also let servers update Live Activities, the live panels on the lock screen for a delivery or a match, through APNs,[^15] and in 2024 it added broadcast updates for large audiences.[^22] Google switched off its legacy FCM sending interfaces in June 2024 in favour of the HTTP v1 API.[^5] In 2025 Apple introduced Declarative Web Push, which needs no service worker,[^17] and Android 16 added progress-centric notifications for rides, deliveries and navigation.[^20] ```diagram:timeline # From badges to live lock-screen updates March 2009 | Apple previews push in iPhone OS 3.0 | Alerts with sounds, text or a badge May 2010 | Google introduces C2DM for Android | Succeeded by GCM, then FCM April 2018 | Google deprecates GCM | Developers move to Firebase Cloud Messaging June 2021 | iOS 15 adds interruption levels and Focus | Time Sensitive alerts break through only if allowed 2023 | Web push reaches iPhone and iPad | Only for web apps on the Home Screen June 2024 | Legacy FCM sending interfaces switched off | The HTTP v1 API replaces them 2025 | Declarative Web Push and Android 16 progress notifications | Simpler web push; live trip and delivery tracking September 2027 | FCM device groups and InstanceId server APIs end | Decommissioning already scheduled ``` ## Where it is used Push works wherever people use smartphones and modern browsers, which is to say in every region. What differs is which service carries the message, and that depends on the device, not the country alone: ```diagram:matrix # Four routes to a notification Apple devices | APNs, for apps and for web apps on the Home Screen Android with Google Play services | Firebase Cloud Messaging Android without Google services, and HarmonyOS | The device maker's push service, such as Huawei's Push Kit Desktop and Android browsers | The browser's push service, through the Push API ``` - **Americas, Europe, the Middle East and Africa:** most audiences are on Apple devices or on Android phones with Google Play services, so APNs and FCM carry most traffic.[^10][^8] - **Asia-Pacific:** devices sold in some regions ship without Google Play services,[^8] and Huawei's HarmonyOS uses Push Kit,[^9] so a business with customers on those phones needs a provider that supports the device makers' own services. - **The web:** web push suits publishers, retailers and software products used on desktop; on iPhone and iPad it reaches only people who have added your site to the Home Screen.[^16] The businesses that rely on push most are those whose customers open their app often or follow something in real time: retail and delivery, banking and payments, travel and transport, media and sport, and services that run on appointments. We found no independent, dated figure for how many people allow notifications, by platform or by region, so we give none. Ask any provider for opt-in rates measured on your own audience. ## What businesses use it for - **[Notifications](/en/ecosystem/use-cases/notifications):** order and delivery updates, flight and gate changes, account balances. Live Activities on iPhone and progress notifications on Android 16 show a journey such as a delivery or a ride as it happens.[^15][^20] - **Security:** sign-in approvals and alerts about unusual activity, where a tap in your own app can confirm it is really the customer. For one-time codes see [OTP](/en/ecosystem/use-cases/otp). - **[Booking](/en/ecosystem/use-cases/booking) and [no-shows](/en/ecosystem/use-cases/no-shows):** reminders before an appointment, with a link to confirm or reschedule. - **[Marketing](/en/ecosystem/use-cases/marketing):** offers and news, only to people who explicitly opted in to promotional notifications.[^23] - **[Embedded messaging](/en/ecosystem/use-cases/embed):** telling people a new chat message is waiting inside your app. - **[Automation](/en/ecosystem/use-cases/automation):** a nudge when a basket is left behind or a subscription is about to renew. ## What it costs The platform services themselves cost little or nothing: - **FCM** is listed by Google as no-cost on every Firebase plan, as of October 2026.[^7] - **APNs** comes with the Apple Developer Program, which costs US$99 a year (local prices vary), as of October 2026.[^21] Web push to Home Screen web apps on iPhone and iPad does not require that membership.[^16] The money goes on the tooling around them. Push and engagement platforms commonly charge by **monthly active user**, by **device** or by **notification volume**, often with a free tier and with segmentation, scheduling, A/B testing and analytics in higher tiers. Customer-messaging suites may include push in a per-seat or per-contact price. Budget also for engineering time (keeping tokens clean, building notification settings in your app) and for the fallback channel, such as SMS or email, that catches what push cannot deliver. ## Rules and regulation This is not legal advice. For push, the platforms' own rules do most of the regulating, and they are enforced through app review and the permission prompt. - **Permission comes first.** On Android 13 and later, a newly installed app's notifications are off until the person grants the POST_NOTIFICATIONS permission; apps that already had notifications when the phone was upgraded keep them.[^11] Google advises asking in context, after people understand what the notifications are for.[^11] On iPhone, a web app may ask only in response to something the person taps.[^16] - **People control the categories.** Since Android 8.0 every notification belongs to a channel, and the person can turn each channel off or make it quiet.[^12] On Apple devices, only alerts marked Time Sensitive can break through Focus and the notification summary, and only if the person allows it; Critical alerts need a special entitlement from Apple.[^14] - **Promotions need explicit opt-in.** Apple's App Review Guideline 4.5.4 says push must not be required for an app to work, must not carry sensitive personal or confidential information, and may be used for promotions only after customers explicitly opt in through consent language in the app, with a way to opt out. Guideline 5.1.2 forbids requiring people to enable push to use the app or to receive a reward.[^23] - **Data protection still applies.** A device token tied to a customer record is personal data under laws such as the [GDPR](/en/learn/glossary#gdpr). Some countries' marketing rules for email and SMS may also reach promotional notifications; take local advice before sending offers. ```diagram:checklist # What the platforms ask before you push Permission first | Off by default for new installs on Android 13 and later Ask in context | After the person sees why, not on first launch Promotions only with explicit opt-in | Apple's App Review Guideline 4.5.4 No sensitive personal data in the alert | Apple's App Review Guideline 4.5.4 [!] Push required to use the app | Not allowed under Apple's Guideline 5.1.2 ``` ## Limits and pitfalls - **No guaranteed delivery or timing.** Low-priority APNs notifications may be grouped, throttled and in some cases not delivered;[^10] Android defers background activity on idle phones.[^13] Never make push the only route for a message that must arrive. - **Budgets for urgency.** High-priority updates to Live Activities draw on a budget set by the system; exceed it and updates are throttled.[^15] - **Stale tokens.** Uninstalls and reinstalls change tokens. Remove tokens that return 410 and keep the rest current.[^10] - **Small payloads.** 4KB is enough for an alert, not for content; the alert should link to it.[^10] - **Muted by the person.** Channels switched off, Focus modes and summaries all mean a delivered notification may never interrupt anyone.[^12][^14] - **Asking too early.** A permission prompt on first launch, before people see any value, wastes the one chance many apps get.[^11] - **Migrations.** Platform interfaces change: the legacy FCM interfaces stopped in June 2024,[^5] and more FCM server interfaces are scheduled to end in September 2027.[^6] - **Devices without Google services** need a second route.[^8][^9] - **Web push on iPhone and iPad** works only after the person adds your site to the Home Screen and then taps to allow notifications, so most mobile visitors to a website will never see one.[^16] ## Strengths and weaknesses ```diagram:compare | Strengths | Weaknesses Cost | Platform services free or included | Tooling and fallback channels cost money Speed | Immediate, and can wake a sleeping phone | Delivery and timing are best effort Context | Opens the exact screen in your own app | Only reaches people who installed it or allowed your site Control | Your design, your data, your timing | People can mute a channel or withdraw permission at any time Richness | Images, buttons and live progress on the lock screen | 4KB payload; not a place for long content ``` ## What comes next - **FCM clean-up.** Google deprecated FCM's InstanceId server APIs and device groups in September 2026; new projects cannot adopt them after 1 January 2027, and they will be decommissioned on 29 September 2027.[^6] - **Simpler web push.** Declarative Web Push works in Safari 18.5 and later on the Mac and in Home Screen web apps on iOS and iPadOS 18.4 and later, with no service worker needed.[^17] - **Richer progress on Android.** Android 16's progress-centric notifications target rideshare, delivery and navigation journeys.[^20] - **Live Activities at scale.** Apple's broadcast push lets one request update a Live Activity for everyone following the same event.[^22] - **The web standards.** The W3C Push API is still a Working Draft (last dated 1 December 2025), and the WHATWG Notifications API is a living standard that keeps changing.[^18][^19] ## When to choose it ```diagram:decision # Is push the right channel for this message? Does the person have your app, or allow your site's notifications? | | Use email, SMS or a chat app Have they granted notification permission? | | Ask in context, and reach them elsewhere meanwhile Is it short and useful right now? | | Put it in an email or inside the app Would a missed alert cause harm or cost money? | Send push with a fallback such as SMS or email | Push alone is fine ``` Choose push when people already use your app or site and the message is short, timely and about something they are doing with you. Pair it with a channel that does not depend on permission or on an installed app when the message matters: [email](/en/learn/email-101) for the record, [SMS](/en/learn/sms-101) or a chat app for the urgent. Inside your app, [in-app chat](/en/learn/in-app-101) carries the conversation a notification starts. The [push channel page](/en/ecosystem/channels/push) lists providers, [choosing a channel per message](/en/learn/choosing-a-channel-per-message) covers the trade-offs, and [which channel for which need](/en/learn/which-channel-for-what) compares every channel side by side. Record notification permission and marketing opt-in separately, per channel and purpose: [consent is a data model](/en/learn/consent-is-a-data-model). ## Sources [^1]: [Apple Previews Developer Beta of iPhone OS 3.0](https://www.apple.com/newsroom/2009/03/17Apple-Previews-Developer-Beta-of-iPhone-OS-3-0/) — Apple Newsroom, 2009-03-17 [^2]: [Android Cloud To Device Messaging](https://android-developers.googleblog.com/2010/05/android-cloud-to-device-messaging.html) — Android Developers Blog, 2010-05 [^3]: [Cloud to Device Messaging (Deprecated)](https://developers.google.com/android/c2dm) — Google for Developers, accessed 2026-10 [^4]: [Time to Upgrade from GCM to FCM](https://firebase.blog/posts/2018/04/time-to-upgrade-from-gcm-to-fcm/) — The Firebase Blog, 2018-04 [^5]: [Google Firebase Cloud Messaging migration using REST API and the Azure portal](https://learn.microsoft.com/en-us/azure/notification-hubs/firebase-migration-rest) — Microsoft Learn, accessed 2026-10 [^6]: [Firebase Cloud Messaging troubleshooting & FAQ](https://firebase.google.com/docs/cloud-messaging/troubleshooting) — Firebase (Google), accessed 2026-10 [^7]: [Firebase Pricing](https://firebase.google.com/pricing) — Firebase (Google), accessed 2026-10 [^8]: [Dependencies of Firebase Android SDKs on Google Play services](https://firebase.google.com/docs/android/android-play-services) — Firebase (Google), accessed 2026-10 [^9]: [Push Kit](https://developer.huawei.com/consumer/en/hms/huawei-pushkit/) — HUAWEI Developers, accessed 2026-10 [^10]: [Local and Remote Notification Programming Guide: Communicating with APNs](https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/CommunicatingwithAPNs.html) — Apple Developer (documentation archive), accessed 2026-10 [^11]: [Notification runtime permission](https://developer.android.com/develop/ui/views/notifications/notification-permission) — Android Developers, accessed 2026-10 [^12]: [Create and manage notification channels](https://developer.android.com/develop/ui/views/notifications/channels) — Android Developers, accessed 2026-10 [^13]: [Optimize for Doze and App Standby](https://developer.android.com/training/monitoring-device-state/doze-standby) — Android Developers, accessed 2026-10 [^14]: [Send communication and Time Sensitive notifications (WWDC21)](https://developer.apple.com/videos/play/wwdc2021/10091/) — Apple Developer, 2021-06 [^15]: [Update Live Activities with push notifications (WWDC23)](https://developer.apple.com/videos/play/wwdc2023/10185/) — Apple Developer, 2023-06 [^16]: [Web Push for Web Apps on iOS and iPadOS](https://webkit.org/blog/13878/web-push-for-web-apps-on-ios-and-ipados/) — WebKit, 2023 [^17]: [Learn more about Declarative Web Push (WWDC25)](https://developer.apple.com/videos/play/wwdc2025/235/) — Apple Developer, 2025-06 [^18]: [Push API](https://www.w3.org/TR/push-api/) — W3C, 2025-12-01 [^19]: [Notifications API Standard](https://notifications.spec.whatwg.org/) — WHATWG, accessed 2026-10 [^20]: [Android 16 features and APIs](https://developer.android.com/about/versions/16/features) — Android Developers, accessed 2026-10 [^21]: [Become a member: Apple Developer Program](https://developer.apple.com/programs/enroll/) — Apple Developer, accessed 2026-10 [^22]: [Broadcast updates to your Live Activities (WWDC24)](https://developer.apple.com/videos/play/wwdc2024/10069/) — Apple Developer, 2024-06 [^23]: [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) — Apple Developer, accessed 2026-10 --- Published by the company behind five products in this category. Those products appear in this site's directory alongside competitors under the same published criteria and are labelled as its own. Editorial content does not recommend them.