How to Stop Pop-Ups and Notifications From Following You
"Notifications following me around" feels like one nuisance and is actually three unrelated mechanisms with three different kill switches — and the scary ones, the "your device is infected" warnings, are usually not notifications at all but page tricks designed to look like them. Here is the vector router, the giveaway that separates a real alert from a fake, and the one permission to revoke.
The Conflation
"Following You" Is Three Unrelated Mechanisms
People describe the whole miserable experience — the banner that pops up at the top of the screen, the cookie overlay that blocks the article, the shoe ad that appears on every site after they looked at shoes once — as "notifications following me," as though it were one pest. It is three, they live in different places, and the fix for one does nothing to the others. Treating them as one is why people mute notifications and still see the shoe ads, or install an ad-blocker and still get the banner when the browser is closed. The router below separates them by the only question that matters: where does it appear?
The axis is location of appearance, and it is diagnostic. A message in your notification centre with the site's name is vector A. A box drawn inside the webpage is vector B. An ad that shows up on a different site than the one you visited is vector C. Once you can say which, the fix is mechanical, and the three fixes are genuinely different: a permission revocation, a content blocker, and a cookie/tracker block respectively. Conflating them is why the nuisance survives every half-measure.
| Where it appears | Vector | The real fix |
|---|---|---|
| OS notification centre / shade, browser closed | A — push | Revoke the site's notification permission (below) |
| Inside the page while you browse | B — overlay | Content blocker + popup blocker |
| On other sites, as ads | C — retargeting | Block third-party cookies & trackers |
| A scary "infected" warning in the page | Fake B | Do not click; it is a page trick, not an alert |
Vector A
The Permission You Granted by Accident
Push notifications are the one vector that is genuinely your doing, which is why they feel so persistent: you handed the site a key, and it can now knock whether you are home or not. The grant almost never happens deliberately. It arrives as a trick — Allow notifications to play the video, Click Allow if you are not a robot, Enable alerts to continue — and a tired or trusting click turns into a standing subscription. From then on the site pushes to your notification centre even with the browser shut, because the permission is stored at the profile level, not the tab level.
The fix is a hunt, not a setting: open your browser's notification permissions — Settings → Privacy and security → Site settings → Notifications in Chrome, the equivalent in other browsers — and read the Allowed list. The sites there are the ones that can ping you; block or remove any you do not actively want. Do this periodically, because the accidental grants accumulate. And resist the temptation to nuke the whole system: a global "block all notifications" throws out the genuinely useful ones — two-factor prompts, calendar reminders, messaging alerts, Find My warnings — alongside the abuse. The right move is per-site revocation, keeping the legitimate few and cutting the accidental many. This is the same per-surface discipline our tracking guide applies elsewhere: surgical, not scorched-earth.
Vector B
The Overlays the Site Draws Itself
Cookie banners, exit-intent pop-ups, and "join our newsletter" modals are not permissions and not notifications; they are content the page renders, which means the notification settings cannot touch them and the fix is a renderer-level one. A content blocker (the built-in popup blocker plus a reputable filtering extension) strips most of these at the source, because they are identifiable patterns the blocker recognises. The cookie banner specifically is increasingly handled by the browser itself, which can auto-dismiss or refuse non-essential cookies on a growing number of engines.
The honest note on vector B is that some overlays are legitimate and some are dark-pattern coercion — the "Accept All" button styled bright and the "Reject" buried in grey is a design manipulation, not a notification problem. A content blocker neutralises the coercive ones; for the rest, the browser's own cookie-prompt handling is the cleaner lever. The point for the router is that B lives in the page, so you fight it with page-level tools, never with the notification centre.
Vector C
The Retargeting That Makes It Feel Like Stalking
Vector C is the one that feels like being followed, because it is the only one that appears on sites you never notified. You looked at shoes on one store, and for a week shoes haunt every unrelated page. That is not a notification and not an overlay; it is cross-site tracking — cookies and browser fingerprinting that recognise you on a third-party ad network's inventory and serve the shoe ad because you viewed the shoe. The mechanism is the ad-tech layer, and the kill switch is the cookie and tracker controls, not anything in the notification settings.
This is where the cluster's threads converge: vector C is the experience side of the same tracking that our account-level guide treats as a control surface and our browser-cache guide treats as the cookies checkbox. The felt "following" is reduced by blocking third-party cookies and cross-site trackers, by the ad-personalisation off-switch at the account level, and by browser fingerprinting defences — none of which live in the notification centre. If you muted notifications (A) and installed a popup blocker (B) and the shoe ads persist, it is because C was never a notification or an overlay at all; it is the tracker recognising you elsewhere, and it needs the tracker tools to die.
The fake notification that is not one — and the giveaway
The most alarming "notification" people get is the full-page or in-page warning that their device is infected, their storage is full, or they have won a prize, usually with a pulsing animation and a Call Now or Scan button. It is a scam, and it is not a real notification. The distinction is mechanical and it is the single most useful fact on this page:
- A real browser notification appears in your operating system's notification centre or shade, carries the site's name, and is dismissible from the OS, not just the page.
- A fake infection warning is drawn inside the webpage, has no site name in the OS tray, and cannot be dismissed except by leaving the page.
- The giveaway is therefore where it appears, not what it says: if it is painted into the page, it is a lie; if it is in your notification centre with a site attached, it is a granted permission you can revoke.
- What to do with a fake: do not click Call Now or Scan, close the tab (or force-close the browser if it traps you), and never call a number on a page warning. A real problem shows in your OS, not in a webpage's theatrics.
- If a site tricked you into a real notification permission along the way, revoke it in the Allowed list above — the fake warning and the accidental grant often travel together.
The pattern is old and still works because it mimics the thing people genuinely fear. The defence is the location test: a webpage cannot issue a system notification, so any "alert" rendered inside a page is performance, not diagnosis.
A worked example: the "virus" and the permission behind it
Concretely, all three vectors and the scam in one visit. A user lands on a streaming-adjacent page that throws a pulsing red "Your device is infected — 47 threats found — Call Now" overlay. They panic, and before panicking they had also clicked Allow on a "Enable notifications to verify you are human" prompt the page slipped them. Two things happened at once: the fake warning (a vector-B page trick) frightened them, and the human-check prompt granted a real vector-A push permission they did not intend.
The correct response separates them. The red warning is not a notification — it is drawn in the page, has no site name in the notification centre, and is therefore a lie; close the tab, do not call. The accidental grant is real and will keep pinging even after the tab closes, because it is a profile-level subscription; so the user goes to the notification Allowed list and blocks that site. Had they only closed the tab (treating it as pure vector B) the push permission would have survived; had they only muted notifications globally (treating it as pure vector A) they would have lost their calendar reminders for nothing. The router is what lets them cut the one accidental permission and dismiss the page lie without collateral damage.
The lesson is the whole page: one scary moment can be two mechanisms plus a scam, and the fix is to identify each by where it lives — the page, the notification centre, or the ad network — rather than to nuke the whole notification system in panic.
The Check
A Sensible Default
- Diagnose by where it appears: notification centre (A), page (B), other sites (C).
- For A, revoke per-site from the Allowed list; do not nuke all notifications.
- Keep the useful notifications — 2FA, calendar, messaging, Find My — and cut the rest.
- For B, use a content blocker and the browser's cookie-prompt handling.
- For C, block third-party cookies and trackers; it is never a notification setting.
- Apply the location test to any "infected" warning: in-page means fake, close the tab.
- Remember a granted permission survives incognito; the key was handed outside the session.
The honest takeaway is that "notifications following you" is a three-vector problem with a scam riding on top, and the panic response — mute everything, or click the scary button — is wrong in opposite directions. Identify each nuisance by where it lives, revoke the one accidental permission surgically while keeping the useful alerts, block the page overlays and the cross-site trackers with the right tools, and apply the location test so a webpage's theatre never reads as a system warning. For the account-level tracking that vector C mirrors, see our tracking guide; for the cookies checkbox that is part of the same fight, see our browser-cache guide; and for the private-window layer that does not revoke a granted permission, see our incognito guide.
Common Questions
Frequently Asked Questions
Why do I get notifications from websites I never allowed?
Almost always because you granted the permission without meaning to, often via a trick like Allow to play the video or Click here if you are not a robot. The browser then treats it as a consented push subscription. Find the site in your notification permissions and block it.
Is a pop-up that says my device is infected a real virus scan?
No, and it is a well-known scam pattern. A genuine notification appears in your OS notification centre with the site name; a fake infection warning is drawn inside the webpage, often with a pulsing animation and a Call Now button. The giveaway is where it appears, not what it says.
Does blocking all notifications make sense?
No, because some are genuinely useful: two-factor prompts, calendar reminders, messaging alerts, and Find My warnings. Revoke per-site, removing the accidental or spammy few while keeping the legitimate ones. A global mute throws out the useful with the abusive.
Why do ads for a product I viewed follow me to other sites?
That is cross-site retargeting, a different mechanism from push notifications. It uses cookies and fingerprinting to recognise you elsewhere. Reduce it by blocking third-party cookies and trackers and the account-level tracking controls, not the notification settings.
I muted notifications but the banners keep coming. Why?
Because the banners were never notifications — they were in-page overlays (vector B) or cross-site ads (vector C), neither of which the notification centre controls. Use a content blocker for overlays and cookie/tracker blocking for the ads.
Does incognito stop a site from notifying me?
No. A notification permission is profile-level, so it survives a private window; the site can still push you from a granted permission even in incognito. Revoke the permission in the Allowed list; incognito does not touch it.
What do I do with a scary full-page infection warning?
Apply the location test: if it is painted into the page with no site name in your notification centre, it is fake. Do not click Call Now or Scan, close the tab, and if a human-check prompt slipped you a real permission, revoke that site afterwards.
More privacy & browser guides like this
We split "notifications following you" into three unrelated vectors plus a scam, so the fix is a surgical per-site revoke and a location test rather than a panicked global mute.
Explore All GuidesKeep Reading
Sources:
Chrome Help — manage site notifications & pop-ups · Safari User Guide — warnings & fraud · FTC — online scams & tech-support fraud (reference)
Other Projects
More from the creator
Explore two other projects from the same creator.