Skip to main content

​
Overview

OneSignal is designed to help you meet global privacy and data protection requirements, including GDPR and CCPA, across all plans, including Free. This guide explains:
  • What data OneSignal collects
  • How to minimize or avoid sending personal data
  • How to collect and enforce user consent
  • How to mask, restrict, or delete data when required
If you require a Data Processing Addendum (DPA) or Standard Contractual Clauses, see our Paid Plans for details.

​
How OneSignal collects data

The OneSignal SDK begins collecting data after it is initialized in your app or website. For a full list of fields collected automatically by the SDK, see Data Collected by the OneSignal SDK. Most collected data is not considered PII (Personally Identifiable Information). However, some fields may be considered personal data depending on your region or use case. This guide focuses on how to use OneSignal without sending personal user data, or how to control it when required.

​
IP address collection

In some regions, including the EU and UK, IP addresses may be considered personal data.
  • Default behavior: OneSignal will automatically not collect IP Addresses from Users within the EU and UK.
  • Optional: Disable IP collection globally
    • If you want to prevent IP address storage for all users, including non-EU/UK users, contact [email protected]
Disabling IP collection is permanent per app and cannot be selectively re-enabled later.

​
Masking personally identifiable information (PII)

Emails and phone numbers masked in the OneSignal dashboard

PII masked in the OneSignal dashboard

PII masking helps protect user privacy while allowing teams to safely view and analyze data. What gets masked
  • Email addresses
  • Phone numbers
Masking applies to:
  • The OneSignal dashboard
  • Data exported directly from the dashboard
What is not masked PII masking does not currently apply to:
  • REST API responses
  • External IDs
  • Data tags
Availability PII masking is available to:
  • Enterprise plans
  • Professional or Growth plans with the Security & Legal package
To enable PII masking, contact [email protected] or your Account Manager.
PII masking is a display-level control. The underlying data is still stored securely by OneSignal.

​
Personal information sent as tags or other fields

You are responsible for ensuring that you have appropriate consent for any data you send to OneSignal, including:
  • Email addresses
  • Phone numbers
  • Names
  • Any personal attributes
For example, if you send an email address as a tag, you must ensure the user has consented to that data being shared and processed.
Some fields are collected automatically by the SDK. You can selectively disable or override many of these fields using SDK configuration options.See Data Collected by the OneSignal SDK.
To support GDPR and similar regulations, OneSignal provides consent gating methods that allow you to delay all data collection until the user explicitly agrees. Consent vs. Message Opt-in How consent gating works
  • You enable consent requirements before initializing our SDK.
  • Our SDK does not collect or send any data until consent is granted via our SDK consent methods.
  • Any SDK methods calls made before consent is granted are safely ignored.
  • Consent state is persisted across sessions. You only need to collect consent once per user.
If a user has previously accepted push permissions and has since revoked consent, they can still receive push notifications. To prevent them from receiving push notifications, you can programmatically call our SDK optOut method before revoking consent, or the user can either:
  • Disable push permissions in their devices notification settings
  • Uninstall the app
SDK references

Mobile SDKs

More details on the mobile SDK privacy methods.

Web SDKs

More details on the web SDK privacy methods.

​
Location sharing

OneSignal provides a method to disable Location sharing within each mobile SDK.

Mobile SDKs

More details on the mobile SDK location methods.

Web SDKs

Our web SDK does not collect or send location data.

​
Push tokens

Push tokens are generally not considered PII because:
  • They cannot be reused outside the originating app
  • They do not reveal user identity or personal attributes
However, you should still disclose in your privacy policy that you use a third-party service (like OneSignal) to deliver personalized or targeted notifications.

​
Deleting data

OneSignal provides multiple ways to delete or retain data depending on the data type.
  • User data: See the Delete Users guide for deleting user profiles, Subscriptions, and associated data.
  • Message data: Messages sent from the dashboard are stored indefinitely unless deleted manually or the app is deleted.
    • Messages sent via the API are typically deleted ~30 days after delivery.
  • Other data: Most remaining data is stored until your OneSignal app is deleted. See Managing your OneSignal account for details.