The permission prompt at first launch
With askforpushpermissionatfirstrun set to true, iOS asks before users have seen anything. Users who tap Allow agreed to notifications, not to marketing.
What 4.5.4 says
Guideline 4.5.4 sets four rules for push notifications. The app must work without them. They should not carry sensitive personal or confidential information. They should not be used for promotions or direct marketing unless the user has explicitly opted in through consent language shown in your app's interface. And the app must offer a way to opt out of those messages. Apple adds that abuse can cost you your push privileges.
Note what is not required: messages the user expects, such as "your order shipped" or "you have a new reply", need no extra consent beyond the system permission. The opt-in is specifically about promotions and marketing. The push notifications overview covers the general setup.
What the rejection message usually says
Reviewers usually say that the app uses, or appears to plan to use, push notifications for promotional purposes without explicit consent, or that there is no way to opt out in the app. They find this in the description ("get exclusive deals by push"), in an onboarding screen that promises offers, or in a test notification. A second variant says the app requires users to allow notifications before they can continue, which conflicts with the first sentence of 4.5.4.
Why vibe-coded apps trip over it
"Turn on notifications to continue"
AI-generated onboarding often blocks the next step until permission is granted. That makes push required, which 4.5.4 does not allow.
Abandoned cart reminders
The local push example in the WebViewGold docs is a cart reminder via sendlocalpushmsg://. Useful, but promotional: send it only to users who opted in to marketing.
One topic for everyone
firebaseTopic in Config.swift subscribes the app to one Firebase topic, so every install with Firebase push is in it. Fine for service notices; using it for promotions sends marketing to people who never opted in.
Copy that promises deals
Descriptions and onboarding screens written by an AI love "never miss a special offer". Reviewers read that as a marketing plan without consent.
Great work! Never coded anything but managed to work with this. Easy and fast! Also with great help from the creators!
Transactional or marketing?
| Message | Type | Needs marketing opt-in |
|---|---|---|
| Your order has shipped | Transactional | No |
| Anna replied to your comment | Activity the user follows | No |
| Reminder the user set (workout at 7:00) | Requested by the user | No |
| Price alert the user created for a product | Requested by the user | No |
| 20% off this weekend | Promotion | Yes |
| Your cart is waiting | Promotion | Yes |
| We miss you, come back for a free credit | Re-engagement marketing | Yes |
| New feature: dark mode is here | Product news | Treat it as marketing |
Set up consent and opt-out with WebViewGold push
Works with OneSignal, Firebase and Pushwoosh; the consent lives in your own database.
Stop asking at first launch
Set
askforpushpermissionatfirstrunto false in Config.swift (on Android,requirePushto false in Config.java). The push notification docs describe both options.Show your own notification screen at the right moment
After sign-up or the first meaningful action, explain what you will send. Offer two separate choices: "Order and account updates" and "Offers and news". The marketing choice is off by default and comes with its own consent sentence.
Trigger the system dialog from that screen
When the user switches on either choice, navigate to
registerpush://and iOS shows its permission dialog right then, in context. On Android, this requires at least one push service enabled in Config.java.Store the consent next to the push ID
Read the subscription ID:
getonesignalplayerid://fillsonesignalplayerid,getfirebaseplayerid://fillsfirebaseplayerid,getpushwooshid://fillspushwooshplayerid. For OneSignal and Firebase,autoInjectVariableset to true injects the ID automatically. Save it with the user's choices, the consent text version and a timestamp, and mention push tokens in your privacy policy (privacy policy and labels guide).Send marketing only to opted-in users
Your backend selects recipients from the database: OneSignal's API can target specific subscription IDs, and Firebase can send to individual tokens or to a topic your server subscribes opted-in tokens to. Never use the shared
firebaseTopicfor promotions. The push provider comparison explains the targeting options of each service.Add the opt-out in settings
An "Offers and news" toggle in your settings page that updates the database immediately. Show the system status with
checkNativePushPermissions://, which setsnativePushEnabled, and link tosettingsapp://for users who want to switch off all notifications (Open App Settings docs).Gate local promotional reminders
Schedule cart or win-back reminders with
sendlocalpushmsg://only when marketing consent is true. When a user opts out, callsendlocalpushmsg://push.send.cancel; it cancels all scheduled local notifications, so reschedule the reminders the user asked for.
Consent screen and opt-out in JavaScript
A minimal version for any web stack; the endpoint names are placeholders for your own backend. Built with Lovable? The Lovable push notification guide covers the provider setup around it.
javascript
// Notification screen after sign-up (Config.swift: askforpushpermissionatfirstrun = false)
var CONSENT_TEXT_V2 = "Send me offers and news by push notification. I can turn this off anytime in Settings.";
async function saveNotificationChoices(updates, offers) {
await fetch("/api/me/notification-prefs", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
transactional: updates,
marketing: offers, // false unless the user switched it on
marketing_consent_text: offers ? CONSENT_TEXT_V2 : null,
marketing_consent_at: offers ? new Date().toISOString() : null
})
});
if (updates || offers) {
window.location.href = "registerpush://"; // iOS permission dialog, in context
}
}
// On later page loads: store the push ID once it exists (autoInjectVariable = true)
if (typeof onesignalplayerid !== "undefined" && onesignalplayerid) {
fetch("/api/me/push-id", { method: "POST", headers: { "Content-Type": "application/json" },
body: JSON.stringify({ provider: "onesignal", id: onesignalplayerid }) });
}
// Settings page: opt-out toggle
async function setOffers(enabled) {
await fetch("/api/me/notification-prefs", { method: "PATCH", headers: { "Content-Type": "application/json" },
body: JSON.stringify({ marketing: enabled }) });
if (!enabled) {
window.location.href = "sendlocalpushmsg://push.send.cancel"; // clears ALL scheduled local reminders
}
}Resolution Center reply template
Describe the consent flow step by step and tell the reviewer exactly where the opt-out is.
Reply in Resolution Center (replace the bracketed parts)
Hello App Review team, Thank you for reviewing [App name] [version] ([build]). We changed how the app handles push notifications to comply with Guideline 4.5.4: 1. The app no longer asks for notification permission at launch, and every feature works when notifications are declined. 2. After sign-up, a notification screen offers two separate choices: "Order and account updates" and "Offers and news". The marketing option is off by default and shows this consent text: "[consent sentence]". 3. Only users who switch on "Offers and news" receive promotional notifications. Promotional local reminders are also sent only with this consent. 4. Users can opt out at any time in [Settings > Notifications > Offers and news]. The same screen links to the iOS notification settings. To verify: log in with the demo account from App Review Information and open [Settings > Notifications]. [New build: [number].] Best regards, [Name], [email]
Checklist
askforpushpermissionatfirstrunis false; the permission dialog appears after the user has seen value.- The app works fully with notifications declined.
- Marketing consent is a separate, unticked choice with its own wording in your UI.
- Consent is stored with the text version and a timestamp, next to the push ID.
- Marketing sends and promotional local reminders go only to opted-in users;
firebaseTopicis not used for promotions. - An opt-out toggle in settings, plus a link to the iOS notification settings.
- No sensitive data in notification texts; the description promises nothing you do not do.
Frequently asked questions
Is tapping Allow on the iOS dialog enough consent for marketing?
No. The system dialog asks for permission to show notifications at all. Apple wants marketing consent in your own UI, with wording that says promotional messages will be sent, plus an opt-out inside the app.
Do local notifications count?
Guideline 4.5.4 speaks of push notifications, but a promotional local notification looks the same to users and to reviewers. Treat cart and win-back reminders like marketing push and send them only with consent.
What about users who allowed notifications before the update?
Send them only transactional messages until they opt in. Show the new notification screen once after the update, or add a short note in settings that explains the new "Offers and news" option.
Can my app require notifications, for example an alarm or on-call app?
The app must still work without them. Explain clearly what the user will miss, offer a link to the settings, and let them continue.
Does GDPR also apply?
In the EU, marketing messages usually need consent under data protection and e-marketing rules too. The same opt-in screen, stored with a timestamp and the consent text, helps with both. If marketing is central to your business, ask a lawyer about your specific case.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.