Google and Apple push notification services are often whitelisted in WiFi networks so they work before you "sign in" to the network.

(I work for a company that provides guest WiFi services in public spaces.)

It's usually not that those specific services are whitelisted, but that a number of hostnames have to be whitelisted for the user experience. Sometimes, those hostnames include those types of services, depending on the phone, OS, carrier, etc.

This sounds like the most reasonable explanation as I have data roaming off (and am always flying between countries)

I often toggle mobile data on my phone when I'm away from WiFi, and I also noticed that even when mobile data is off, sometimes push notifications come through. It's hard to explain the conditions when it has happened, but it's uncanny when it happens.

I know for sure, push notification can come through airport wifi (the ones that you need to log in), even when you are not logged in. It may be something to do with notification via IP address instead of hostname.

Can someone who has dived into the code on iOS/Darwin or Android/Linux kernel verify this?

These are probably local notifications https://developer.apple.com/documentation/usernotifications/...

Out of airplane mode or not? If yes: yeah why not, perhaps your mobile network was able to get something in or you catched a wifi short term.

If no: i would say no. But if you get an alert popup, it can be mechanism like mobile sending generic alerts for tornado and stuff

You're maybe getting them through the mobile network instead of wifi ?