I think it might be session, but the issue is that most users simply accept permission popups, often without consciously recognizing they did. I've cleaned out the notifications permissions on browsers for dozens of people; all of them denied allowing various websites to spam them with notifications.