Compliance isn’t a feature.
It’s the architecture.
Every PushEngage subscriber exists because a browser or OS logged an explicit permission grant. Data storage defaults to a subscription token and behavior events, nothing personal, and export and deletion tooling covers GDPR Articles 15 and 17. Every plan, including Free, runs on the same consent architecture.
“We are able to reach our customer base in almost an instant. Email would have been too slow to put together in an emergency.” John Smith · CEO
75,000+ businesses GDPR and CCPA compliant on every plan 14-day money-back guarantee
Trusted by 75,000+ businesses in 150+ countries
Why it works
The vendor review that closes in days, not quarters.
Push programs stall in legal queues when the consent model is murky. Browser-level permission, minimal data defaults, and documented subject-rights tooling give your legal team clean answers.
Consent is the entry ticket
No subscriber enters your account without an active Allow click at the browser or OS level. There is no passive enrollment and no pre-checked box anywhere in the flow.
Minimal by default
PushEngage stores a subscription token and behavior events. Names, addresses, and payment data are never stored unless you explicitly pass them through the Attributes API, which is opt-in only.
Subject rights without engineering
Export a subscriber’s data for an access request or delete the record entirely, from the dashboard or the API. No custom extraction pipeline, no developer ticket.
How it works
Informed consent, demonstrably.
A two-step consent flow for EU traffic
The pre-permission overlay explains what subscribers will receive, in plain language you write, before the browser dialog appears. Geo segmentation serves EU visitors the two-step flow and US visitors the standard prompt, so each jurisdiction gets the right consent path.
- Customizable pre-permission overlay on Business and above
- Geo-segmented consent flows per jurisdiction
- Opt-out lives at the browser level, always under the subscriber’s control
Every channel, the same consent posture
Web push runs on browser permission, app push on the iOS and Android opt-in dialogs, and WhatsApp under Meta’s opt-in and template framework. Across all of it, the compliance event happens before the first message can send.
- Web push: an active Allow in Chrome, Firefox, Edge, or Safari
- App push: OS-level opt-in and opt-out
- WhatsApp: Meta-approved templates and standard opt-out keywords
What’s included
Exactly what you’re buying, on one dashboard.
Compliance is platform plumbing, not a plan upgrade: the consent architecture underneath every channel is the same on Free as it is on Enterprise.
Consent-first capture
The browser or OS permission grant is the compliance event. Every subscriber record in your account traces back to an explicit, logged Allow.
See the consent modelPre-permission overlay
Plain-language copy before the browser dialog closes the gap between technically compliant and demonstrably informed. Preview the two-step ask on your own site.
Preview the consent flowMinimal data footprint
Tokens and behavior events by default. The Attributes API is the only way personal data enters the record, and using it is entirely your call.
Read the data modelExport and deletion tooling
Article 15 access requests and Article 17 erasure requests are dashboard operations on all paid plans, with API endpoints for your own pipeline.
See subject-rights toolingGeo-segmented consent flows
Serve EU subscribers the two-step GDPR flow and US subscribers the standard prompt, from the same segmentation engine that runs your campaigns.
Explore segmentationWhatsApp under Meta’s framework
Opt-in before business-initiated messaging, approved templates, and standard opt-out keywords. The channel is anti-spam by structure.
Read the WhatsApp guideOne posture, four channels
Web push, app push, WhatsApp, and chat run on one login and one consent-first architecture your vendor questionnaire can quote.
See the platform overviewSetup and integrations
The same clean data posture wherever you install.
One-click plugins for the major platforms, with the consent flow and the minimal data defaults shipping in the box.
Shopify & Shopify Plus
Native app, no code required. The consent flow ships with the storefront install, so EU traffic gets the right ask from day one.
Shopify Plus app
WooCommerce
Plugin install from the WordPress admin, with EU-ready opt-in configuration included.
WooCommerce setup
HubSpot
Sync lists and events without widening the data footprint you have to defend.
HubSpot integrationREST API & webhooks
Export and deletion endpoints are documented, so subject-rights requests can also run through your own pipeline.
Read the API docsThe numbers
Clean answers for the questionnaire.
“PushEngage is quick and easy to implement. The ability to tailor your target audience is particularly impressive as you are able to increase your engagement rates as you use the software.”
Alex Avery
Database Marketing Executive
Trust and capture
Where compliance meets the rest of the platform.
Web push notifications
The flagship channel, running on browser-level consent from the first subscriber.
Explore web pushDynamic segmentation
The same engine that segments campaigns serves the right consent flow per region.
See segmentationPlatform overview
Web push, app push, WhatsApp, and chat: one login, one consent posture.
See the platformWhatsApp Business templates
Meta’s opt-in and template framework, productized inside PushEngage.
Read the guideFAQ
Questions, answered.
Is the free plan GDPR compliant too?
Yes. Compliance is a platform-level commitment, not a tier-gated feature. Every plan runs on the same consent architecture and minimal data defaults, and your consent posture carries forward when you upgrade.
How do subscribers opt out?
At the browser or OS level, entirely under their own control. They revoke permission in browser settings or device notification settings without contacting you, and WhatsApp subscribers opt out with standard keywords.
What data does PushEngage actually store?
A subscription token and behavioral events like page views and notification clicks. Names, emails, addresses, and payment data are never stored unless you actively pass them through the Attributes API, and doing so changes your data-handling obligations, so review it during integration design.
How do I handle an access or deletion request?
Export the subscriber’s record for an Article 15 access request or delete it for an Article 17 erasure request, from the dashboard or the API on paid plans. You remain responsible for any downstream copies in your own exports.
Does using PushEngage make my whole business GDPR compliant?
No vendor can claim that, and we don’t. GDPR covers your entire data stack. What PushEngage ensures is that the notification channel it operates for you is consent-first, minimal by default, and equipped with the subject-rights tooling your legal team will ask about.
What about CCPA?
CCPA and GDPR have different scopes and obligations. Geo-segmented consent flows let you serve EU visitors the two-step GDPR flow and configure US traffic per CCPA’s model, instead of applying one framework everywhere.
Ship the push program legal has been sitting on.
Set up in minutes. If PushEngage isn’t the best fit within 14 days, we refund 100%. No questions asked.
Free plan available Set up in minutes Pay only for active subscribers