Notification Channel Preferences

Sending every notification type to every user with no opt-out mechanism violates GDPR Art. 21 (right to object to processing) and GDPR Art. 7 (conditions for consent). CCPA §1798.120 grants similar opt-out rights. Beyond compliance, a platform that ignores preferences trains users to mute or uninstall the app rather than adjusting settings — a direct retention problem. Notification preference checks must happen before dispatch, not as a post-hoc filter; dispatching a notification and suppressing delivery still constitutes processing the personal data used to trigger it.

Add a NotificationPreference model to your Prisma schema and check it before dispatching any notification in your notification service.

// lib/notifications.ts
export async function sendNotification(
  recipientId: string,
  type: 'post_liked' | 'user_followed' | 'post_commented',
  data: Record<string, unknown>
) {
  const prefs = await db.notificationPreference.findUnique({
    where: { userId: recipientId }
  })

  const gateMap = {
    post_liked: prefs?.notifyOnLike ?? true,
    user_followed: prefs?.notifyOnFollow ?? true,
    post_commented: prefs?.notifyOnComment ?? true
  }

  if (!gateMap[type]) return // Preference says no: abort before any dispatch

  await db.notification.create({ data: { userId: recipientId, type, payload: data } })

  if (prefs?.emailEnabled ?? true) {
    await sendNotificationEmail(recipientId, type, data)
  }
}

Expose preference toggles in app/settings/notifications/page.tsx so users can adjust each type independently without contacting support.