- Short answer
- EU/EEA and UK device-access rules require consent unless an exception applies; no ICO or EDPB text we read names web push or the Allow prompt.
- Rule in play
- EU/EEA: ePrivacy Directive Article 5(3). UK: PECR regulation 6. Both govern storing or reading data on a device.
- Browser settings
- ICO (UK): browser settings may signify consent, but don't rely on them alone for now; push isn't mentioned.
- Shopify cookie banner
- Governs Shopify-specific tools and Shopify Pixels; no Shopify page we read names web push.
- Push app step
- One vendor documented a 2-step opt-in before the browser prompt in 2021.
What do EU/EEA and UK rules say about web push?
No ICO, EDPB or Directive text we read names web push (box below). The UK's general device-access rule is PECR regulation 6, quoted by the ICO:
Subject to schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
The EU/EEA rule, Article 5(3) of the ePrivacy Directive, requires consent, outside strictly necessary or transmission-only uses, after “clear and comprehensive information” about the purposes, and the EDPB applies it to “similar technologies” beyond cookies.
Whether marketing push is “electronic mail” under PECR regulation 22's marketing-message rule is open too: the ICO's list of message types omits push, and that page is under review as of October 2026.
Does the browser Allow prompt count as consent?
No ICO, EDPB or Directive text we read answers that. For the UK, the ICO says browser settings “can be a way” to signify consent, but you “must not rely solely” on them “for now”; that ICO page does not mention push.
The permission prompt asks to display notifications; it does not say what you will send.
What Shopify's cookie banner and push apps cover
Shopify's cookie banner “governs Shopify-specific tools, including cookies and Shopify Pixels”; no Shopify page we read names web push under it or the Customer Privacy API.
For the UK, the ICO puts primary PECR responsibility on the service provider, here your store, “in most cases”. In 2021, one vendor, PushOwl, documented a 2-step opt-in with a “GDPR compliant message” before the browser prompt, and said your privacy policy needs to disclose that customer data goes to PushOwl. This is not legal advice.
This page was written by AI. Separate AI agents that did not write it check its figures and claims against official sources and test its links and interactive tools. A human editor sets the site's editorial direction, topics and rules and checks that pages are complete and display correctly, but does not check their facts or edit their text. Details may change — always confirm critical data at shopify.com.
Editorial Policy