OneSignal

Overview

OneSignal is a customer messaging platform specializing in browser push notifications, in-app messaging, email, and SMS. It powers push notification campaigns for over one million websites and apps, enabling operators to re-engage users with targeted messages based on behavioral segmentation and automated triggers.

What This Script Does

OneSignal's browser integration involves a JavaScript SDK, a service worker file, and optional subscription prompt UI components.

Script Files and Domains

• OneSignalSDK.js or OneSignalSDKWorker.js — Loaded from cdn.onesignal.com. The main SDK (~150KB minified) handles subscription management, permission prompts, and messaging.
• OneSignalSDKWorker.js — A service worker registered under the host site's domain (e.g., yourdomain.com/OneSignalSDKWorker.js). Receives push messages even when the browser tab is closed.
• API calls go to onesignal.com/api/v1/ for subscription registration and fcm.googleapis.com (Chrome) or APNs (Safari) for push delivery via browser push infrastructure.

Cookies and Storage Set

• os_pageViews — localStorage key tracking page view count for the subscription prompt display logic (e.g., "show prompt after 3 page views"). Session-scoped behavior, but persisted in localStorage.
• isOptedOut — localStorage key recording the user's notification opt-out preference.
• onesignal-notification-prompt — localStorage key tracking the last time the subscription prompt was shown to prevent excessive re-prompting.
• OneSignal Player ID — A UUID generated for each subscriber, stored server-side and linked to the browser's push subscription endpoint. This is the primary subscriber identifier.
• No persistent tracking cookies are set on the host domain in the traditional sense; OneSignal relies primarily on localStorage and the push subscription endpoint URL for identification.

Data Collected Per Interaction

• Browser push subscription endpoint URL (a unique URL issued by the browser's push service — this is the primary subscriber identifier)
• IP address (at subscription time and notification delivery)
• Browser type, OS, user agent
• Page URL where subscription was initiated
• Page view count (for prompt logic)
• Notification delivery status (delivered, displayed, clicked, dismissed)
• Custom tags set by the site operator (e.g., plan: premium, last_purchase_category: electronics)
• Custom events triggered by the site operator (purchases, signups, etc.) for segmentation and automation

Subscriber Segmentation and Targeting OneSignal builds subscriber segments based on behavioral attributes, tags, and event history. Automated notifications (triggered by cart abandonment, inactivity, price drops) fire based on these segments. Segments can be used for A/B testing notification copy and delivery timing.

Consent & Compliance

Consent category: Marketing

• GDPR/ePrivacy: Push notifications are a direct marketing channel requiring explicit opt-in consent under both GDPR and the ePrivacy Directive. The browser's native permission prompt constitutes a technical mechanism for consent, but the GDPR consent must be freely given, informed, and specific — the site must disclose that subscribing enrolls the user in OneSignal-powered marketing communications. Subscriber segmentation and behavioral tagging constitute profiling under GDPR Article 4(4).
• IAB TCF: OneSignal participates in the IAB TCF ecosystem. Relevant purposes include Purpose 1 (Store and/or access information on a device) and Purpose 4 (Select personalised ads) when behavioral targeting is used.
• CCPA/CPRA: Subscriber behavioral data and segmentation profiles constitute personal information. Targeted push notifications based on purchase history or browsing behavior may constitute sharing under CPRA. Opt-out rights apply.
• EU-US Data Privacy Framework: OneSignal is a US company. It relies on SCCs and DPF for EU-to-US data transfers. Verify current participation status on the DPF list.

Should You Block This Without Consent?

Yes. OneSignal is a marketing communication and subscriber segmentation platform. The service worker and SDK should not be registered or loaded until the user has provided explicit consent for marketing communications. Note that once a service worker is registered, it persists until explicitly unregistered — ensure your consent management properly handles unregistration when consent is withdrawn.