Push Notification Strategy That Doesn't Get Muted

A good push notification strategy rests on three decisions: ask for permission at the right moment, separate notifications by type with separate consent, and cap frequency based on measured behavior. The median app gets an opt-in rate of only 59.5% on Android and 49.4% on iOS, so roughly half your users never see a single push.

Those figures come from Airship's 2025 push notification benchmark report, which analyzed data from more than 9 billion app users across 2024. The same report shows the median Android opt-in rate falling from 71.3% to 59.5% in a single year. The reason is simple: since Android 13, notifications are off by default for newly installed apps, and you now have to ask for permission just as you do on iOS.

Regulators are tightening the rules at the same time. Apple only allows marketing pushes after explicit in-app consent. In Turkey, the data protection authority declared in January 2026 that bundling order updates and promotional notifications under one consent is unlawful. This guide walks you through the permission flow, a consent architecture that survives those rules, segmentation, frequency limits and measurement, using ecommerce and loyalty app examples.

What This Guide Covers

• What Is a Push Notification and How Does It Work?
• Notification Types: Transactional, Reminder and Marketing
• Consent Rules: Apple, GDPR and Turkey
• Consent Architecture: Separate System Permission From Marketing Consent
• When to Ask for Notification Permission
• Segmentation: Stop Sending Everyone the Same Message
• Frequency and Timing: How to Avoid Getting Muted
• Ecommerce and Loyalty App Examples
• Measurement: The Metrics That Matter
• Technical Setup Checklist
• Frequently Asked Questions

What Is a Push Notification and How Does It Work?

A push notification is a short message your server sends to a user's lock screen or notification center, even when your app isn't open. Unlike an SMS, it doesn't go to a phone number. It goes to a unique address, called a token, that your app receives for that specific device.

Your server never talks to the phone directly. Two platform services sit in between:

• APNs (Apple Push Notification service): delivers to iPhone, iPad and Mac.
• FCM (Firebase Cloud Messaging): delivers to Android devices. If you upload your APNs key, FCM can also reach iOS devices through the same API.

The flow has four steps. Your app asks the user for permission. Once granted, the device generates a token and your app registers it with your server. Your server sends the message and the target tokens to FCM or APNs. The service then delivers the message to the device.

FCM itself appears as a no-cost product on the Firebase pricing page. The real cost sits elsewhere: the segmentation engine, the preference center, the reporting dashboard and the backend work that ties them together. Those costs continue after launch, which is why we cover them in our guide to app maintenance costs.

Token hygiene: stop messaging dead addresses

Tokens don't last forever. Users delete apps, switch phones or simply stop opening your app for months. Firebase's token management documentation sets three clear rules:

• Refresh each token's timestamp once a month; a registration older than a month most likely belongs to an inactive device.
• On Android, FCM treats a registration that stays inactive for 270 days as expired and removes it.
• If a send returns UNREGISTERED (HTTP 404) or INVALID_ARGUMENT (HTTP 400) and you're sure the payload is valid, delete that registration from your database.

Teams that skip this cleanup underestimate their delivery and open rates. Then they build strategy on the wrong numbers.

Notification Types: Transactional, Reminder and Marketing

Strategy starts by putting every notification you send into a type. That single step does three jobs: it shows users what they can switch off, it defines the consent layer you need, and it lets you set a separate frequency rule for each type.

These frequency rules are a starting framework, not law. Still, an app that throws the first two rows into the same pool as marketing messages turns both users and regulators against it.

Consent Rules: Apple, GDPR and Turkey

Push notification consent now sits on the agenda of app stores and regulators alike. The summary below isn't legal advice; have a privacy lawyer review your own flow for the markets you serve.

Apple guideline 4.5.4

Apple's App Review Guidelines, section 4.5.4, says push notifications must not be required for your app to function. For promotions and direct marketing, users must explicitly opt in through consent language displayed in your app's UI, and you must give them a way to opt out inside the app. Apple adds that abuse may result in revoked privileges. For other review pitfalls, see our list of App Store rejection reasons.

GDPR: separate, demonstrable, easy to withdraw

Push tokens are device identifiers tied to individual users, so they generally count as personal data under the GDPR. If your marketing pushes rely on consent, Article 7 requires you to demonstrate that the user consented and states that withdrawing consent must be as easy as giving it. Recital 43 goes further: consent is presumed not freely given if it doesn't allow separate consent for different processing operations, or if a service depends on consent that isn't necessary for it.

Turkey: the clearest push-specific rulings

If you have users in Turkey, the rules are unusually explicit. In decision 2021/361, dated April 13, 2021, the Turkish Personal Data Protection Board fined a bank whose Android app shipped with promotional messages pre-approved. The Board ordered the default to be set to "no promotional messages."

On January 14, 2026, the authority published a public announcement on push notifications. It described an app that combined "hear about campaigns" and "track your order status" in one consent, forcing users who wanted order updates to accept promotions too. The authority called this a breach of the granular consent principle. Users must be able to choose, through in-app or operating system settings, which notification types they receive, for example shipping updates but no campaign announcements.

Turkey's Advertising Board reached a similar conclusion from the consumer protection side. In decision 2024/4177, published in its September 2025 bulletin, it examined a large ecommerce app whose in-app preferences only covered email, SMS and phone calls. Users could only disable push notifications from phone settings. The Board treated this as an unfair commercial practice and ordered it stopped. According to a legal analysis of the decision, the Board doesn't consider the general permission users give in phone settings sufficient for marketing notifications.

Across all three regimes, the practical lesson is the same: operating system permission is not marketing consent.

Consent Architecture: Separate System Permission From Marketing Consent

Store rules and privacy law point to the same design: a two-layer consent model.

The first layer is operating system permission. The iOS system prompt and Android 13's POST_NOTIFICATIONS runtime permission live here. This permission only means your app may deliver notifications to the device.

The second layer is your in-app preference center. Here users switch each notification type on or off. The marketing toggle starts off. Before every send, your server checks both that the token is valid and that the user has opted in to that specific type.

Android supports this layer at the OS level too. According to the Android documentation, every notification must belong to a channel since Android 8.0, and users can disable channels individually. Map your channels one-to-one to your notification types, and a user who turns off promotions keeps receiving shipping updates.

Don't skip the last row. Under both the GDPR and Turkish law, the burden of proving consent sits with you. A system that doesn't store when a user opted in, to which type and after seeing which wording has nothing to show when a complaint arrives. Our mobile app security and data privacy guide covers the rest of the compliance picture.

When to Ask for Notification Permission

Timing is the biggest lever on your opt-in rate, because neither platform gives you unlimited attempts.

On iOS you get one shot. According to Apple's authorization documentation, the system prompts the user only the first time your app requests authorization; later requests don't show the dialog. After a denial, your only route back is sending users to Settings.

On Android you get two at most. Since Android 13, notifications for newly installed apps are off by default. Under Android's general runtime permission rules, if a user denies the same permission more than once, the system stops showing the dialog. If your app still targets Android 12L or lower, it's worse: a single "Don't allow" blocks the prompt until the user reinstalls.

Apple and Google agree on the fix: ask in context, not on first launch. Apple's example is a task app that asks right after the user schedules a first task. Android's documentation suggests moments like tapping a bell icon, following an account or placing a food delivery order.

Use a pre-permission screen

Before the system dialog, show a short screen of your own that explains in one sentence what notifications will do for the user. If they tap "Yes," trigger the system prompt. If they tap "Not now," don't trigger it at all, and your one-time chance stays available for a better moment.

In ecommerce and loyalty apps, natural permission moments look like this:

Provisional authorization: a quiet trial on iOS

iOS provisional authorization lets you send trial notifications without asking first. They arrive quietly, without sound or banners, and appear only in Notification Center history. Each one includes buttons to keep or turn off future notifications, so users decide after seeing real value. It works well for news, content and price-tracking apps that can prove their worth by example. The trade-off is visibility: during the trial, your notifications don't appear on the lock screen.

Set realistic targets

Airship's 2025 report gives this distribution by platform:

The same report says apps running onboarding campaigns see opt-in rates up to 40% above their category average. In-app messages shown to opted-out users lift opt-in rates in that group by 14% on average. These are a platform vendor's figures from its own customer base, so measure your own baseline before you adopt them as goals.

Segmentation: Stop Sending Everyone the Same Message

After you win permission, the most common mistake is sending the same campaign to every user at the same time. A notification's value depends on who receives it. A customer who ordered yesterday and a user who hasn't opened your app in three months shouldn't get the same message.

Five behavioral segments cover most ecommerce and loyalty apps at the start:

• New users (first 7 days): Discovery, not promotions. One notification that makes the first order easier or shows a key feature.
• Active shoppers: Personal recommendations based on viewed categories and favorites.
• Cart abandoners: A single reminder. Baymard Institute's average across 50 studies puts cart abandonment at 70.22%, so this segment is never small.
• Dormant users (30+ days): A low-frequency win-back message with genuine value.
• Top-tier loyalty members: Early access, tier upgrades and points updates.

Segmentation also lifts engagement. According to Airship's own customer data, segmented push notification campaigns raise direct open rates by 18% to 65%, and personalized messages lift opens by 37% on average. Keep the baseline in mind: in the same report, the median direct open rate is 3.4% on Android and 3.1% on iOS. Most users won't open any single push notification.

Trigger, don't blast

Your most valuable notifications come from behavior, not the calendar. "Back in stock," "price dropped" and "your order is ready" are expected because they follow the user's own action. Build your campaign calendar around these triggers, not the other way around.

Frequency and Timing: How to Avoid Getting Muted

Over-messaging rarely costs you an uninstall. It costs you something quieter and more expensive: the user turns notifications off, keeps the app, and you lose the channel.

An eMarketer survey of 1,167 US smartphone users from June 2021 shows exactly this (Statista). When they receive too many notifications, 42% change some notification settings and 39% turn off all notifications for the app. Only 8% delete the app entirely. If you only watch uninstalls, you never see the real loss.

Airship's consumer survey across seven countries found the same top two reasons for opting out of brand communications: messages were either too frequent or not relevant. Apple's notification design guidelines put it plainly: if you send multiple notifications for the same thing, you fill up Notification Center, and people may turn off all notifications from your app.

Platforms filter the noise too

• Android 15 notification cooldown: reduces the appearance, volume and vibration of repetitive notifications that arrive in quick succession, for up to two minutes.
• Android notification grouping: if an app sends four or more ungrouped notifications, the system groups them automatically; Android 16 extends this auto-grouping.
• iOS interruption levels: a passive notification joins the list without lighting up the screen, while time-sensitive breaks through system notification controls. Critical alerts bypass the mute switch and need a special entitlement from Apple. Marking a promotion as time-sensitive is the fastest way to make users switch that setting off.
• Apple Intelligence: iPhone can summarize and prioritize notifications, and the Reduce Interruptions Focus silences notifications it judges less important. Put the key information in the first few words.

Frequency and quiet-hour rules

The table below is our recommended starting point. Adjust the values based on your own data.

Instead of a fixed send time, personalize by the hours when each user usually opens your app. If you sell across borders, always use the user's local time zone rather than your office's.

Ecommerce and Loyalty App Examples

A good notification reads at a glance: context in the title, a concrete detail in the body and the right screen on tap. Apple's guidelines add two more rules: never include sensitive personal information, and write generic text that still makes sense when previews are hidden.

A loyalty app scenario: a regional coffee chain

Picture a coffee chain with 14 stores in Izmir, Turkey (an illustrative example). Its app handles order-ahead, points and promotions. The first version fires a single "Allow notifications" prompt on launch and sends every message through the same channel.

In the redesign, the team makes three changes. First, it asks for permission after the first mobile order, with "Want us to tell you when your coffee is ready?" Next, it adds three toggles to the preference center: order status (on), points reminders (user's choice) and promotions (off by default). Finally, it maps those three types to three separate Android channels.

Now order notifications no longer suffer from promotion fatigue. A user who switches off promotions still gets "your coffee is ready." That's exactly the "shipping updates yes, campaigns no" choice Turkey's data protection authority described.

For how notifications fit into the scope and budget of a shopping app, read our guide to ecommerce mobile app costs. For the revenue side, see our comparison of app monetization models.

Measurement: The Metrics That Matter

The number of notifications you send isn't a success metric. Report the following separately for each platform and notification type:

To see your disable rate, your app should read the system setting on every launch and send the result to your server. On Android, areNotificationsEnabled() returns it; on iOS, the notification settings query does. Without that value, you won't notice your channel quietly shrinking.

The holdout group is the most neglected step. Withhold a campaign from a small share of eligible users and compare sales between the two groups. Otherwise you'll credit your push notification program with orders that would have happened anyway.

Technical Setup Checklist

Use this list when you build or audit your push notification setup:

1. Notification types are defined in a written list, and each type has an owner.
2. The permission request follows a contextual action and a pre-permission screen, not first launch.
3. The app has a per-type preference center, with the marketing toggle off by default.
4. Android notification channels map one-to-one to your notification types.
5. The server checks per-type consent before marketing sends and stores the consent timestamp and wording version.
6. Token timestamps stay fresh, and registrations returning UNREGISTERED get deleted.
7. Notification copy contains no sensitive data, and every notification deep links to the relevant screen.
8. A weekly cap and quiet hours for marketing notifications live in code, not in someone's memory.
9. Opt-in rate, disable rate and holdout lift are tracked per platform on a dashboard.

If you're preparing for release, our free app launch checklist also covers privacy declarations and KVKK/GDPR steps. For store visibility and downloads, our app store optimization guide complements this article.

Frequently Asked Questions

What is a push notification?

A push notification is a short message sent from a server to a user's lock screen or notification center, even when the app isn't open. Apple's APNs service delivers it on iPhone, and Google's FCM service delivers it on Android devices.

What is a good push notification opt-in rate?

In Airship's 2025 report, the median opt-in rate for 2024 was 59.5% on Android and 49.4% on iOS. Apps in the top 10% reached 79.7% on Android and 74.1% on iOS. Your industry and audience can move you above or below that range.

Do I need separate consent for marketing push notifications?

In most cases, yes. Apple's guideline 4.5.4 requires explicit in-app opt-in and an in-app opt-out for promotional pushes. GDPR Recital 43 presumes consent isn't freely given when users can't consent separately to different purposes, and a 2024 Turkish Advertising Board decision indicates that phone-level permission isn't enough for marketing notifications.

How many push notifications per week is too many?

There's no universal number. Send transactional notifications whenever the event happens, and start marketing notifications with a low weekly cap such as 2–3 per user. If your disable rate rises, reduce frequency or narrow the segment.

Can I ask again if a user denies notification permission?

On iOS, the system prompt appears only the first time you request authorization, so afterwards you have to guide users to Settings. On Android, if a user denies the permission more than once, the system stops showing the dialog. That's why you should show a pre-permission screen before the system prompt.

Is push notification infrastructure expensive?

Firebase Cloud Messaging is listed as a no-cost product, and APNs comes with an Apple Developer Program membership. The real cost is the backend work for segmentation, preference centers, reporting and automation, plus any third-party engagement platform subscription you choose.

What's the difference between web push and mobile app push?

Web push arrives through the browser and doesn't require installing an app, while mobile push needs an installed app with permission granted. On iPhone, web push only works for web apps added to the Home Screen. We compare both approaches in our PWA vs native app guide.

Should transactional notifications count toward my frequency cap?

No. Users expect order, payment and booking updates, so capping them hurts the experience. Keep transactional and marketing notifications on separate channels and separate counters, and apply the weekly cap only to marketing.

The measure of a strong push notification strategy isn't how many messages you send, but how many you send that users never feel the need to switch off. Ask in context, split consent by type and watch your disable rate, and you'll stay compliant while protecting your most valuable direct channel.

If you want to build notification infrastructure from scratch or redesign an existing permission flow around these rules, explore our mobile app development services or contact us. Our team in Turkey builds for international clients, and we'll gladly review your current flow with you.