Google says Chrome blocked more than 7 billion unwanted notifications a day on Android during Q1 2026.

Seven billion a day is a number that only makes sense once you understand what web push became. A site asks for notification permission, a user taps allow to make the prompt go away, and the site acquires a channel to that phone indefinitely — no app install, no store review, no ongoing consent.

What Chrome actually does now

Google describes a "Swiss cheese" model of overlapping layers:

Our goal is to ensure that if abuse slips through one layer, another is there to catch it.

The layers:

  • Automatic permission revocation — notification access is removed from sites the user has stopped visiting, and from sites that repeatedly trigger suspicious warnings
  • Rate limiting — sites classified as disruptive are capped at 1,000 messages per minute, and excess requests get an HTTP 429
  • Network analysis — behaviour is examined across related sites, including coordinated service-worker activity

Factors monitored: notification volume, user engagement time, permission-prompt frequency and overall site engagement.

The two details worth stopping on

A cap of 1,000 per minute is not a strict limit. It is a limit on industrial abuse. A site that would send more than a thousand notifications a minute is not a publisher having a busy news day; it is a system. The threshold tells you what the floor of the problem looked like before.

Network analysis across related sites is the more consequential mechanism. Abusive push is run as networks — hundreds of domains, one operator, shared service worker code. Detecting a single bad site and revoking its permission achieves nothing when the operator has four hundred more. Correlating them is the only approach that changes the economics, and it is also the one with the most room to catch legitimate sites that happen to share a template or a CDN.

Google has not published a false-positive rate.

What a user can do

  • Safety Hub on Android lists permissions to review
  • Unsubscribe directly from the Android notifications panel
  • Desktop: Settings → Privacy and security → Site Settings → Notifications
  • Mobile: Settings → Notifications

Most people have granted notification permission to sites they cannot name. The review list is usually longer than expected.

Why this belongs in a security feed

Notification abuse is normally filed as annoyance. It is a delivery channel.

A push notification appears in the same tray as messages from apps the user installed and trusts, carries the site's icon, and arrives with no browser chrome to indicate its origin. It is one of the few ways to put attacker-controlled text in front of someone on a phone without an install, a message, or an email — which is why fake virus alerts, fake delivery notices and fake bank warnings all migrated to it.

Google also claims a side effect worth noting: the changes substantially decreased unnecessary background activity and reduced device battery consumption. That is the honest measure of the scale of the problem — the abuse was large enough that suppressing it is visible in battery life.

No launch date was given for the complete system, and the 7 billion figure is Google's own, unaudited.