This is only partially true. While some app developers code their apps properly to sleep nicely in the background, others (Facebook is a prime example) basically exploit loopholes in iOS to remain active in the background doing god knows what (IIRC Facebook added in non-existent VOIP to keep it active for extended periods).
It might not be obvious to the user but I mentioned that apps that use music, be it silent music or actual music, are still active in the background.
[doublepost=1459561393][/doublepost]
Very useful to know.
So how does the notification process work for apps that are not running?
Does the app's remote server tell the phone without the app running?
or does the app need to be alive in some way to pick up the notification?
Facebook's messenger is very fast with instant notifications, yet Facebook app can take some time or only when you go into the app before the notification is seen.
Apple provides developers with a certificate that validates any notifications you want to push out to the user's device. The developer sets up their own server to handle the push notifications and attaches the certificate to each notification. Apple validates it (which requires a handshake with the user's device to also confirm the user has turned on notifications for that app) and the notification is sent to the device. If you tap the notification, the corresponding app is opened. This all happens behind the scenes without the app needing to be open.
For example: FB processes an incoming message sent to you and the app is closed. The FB server generates a push notification with their certificate and relevant info (Mike has sent you a message.) and pushes it out to your device. Apple validates it and makes sure the certificate is valid, you have opted to receive notifications and some other security stuff. If everything runs smooth, the notification appears. The app is never involved, just the "ID" of the app to make sure you actually have the developer's app installed.
The certificate is renewed and reissued by Apple on a regular basis as well as encrypted to ensure the certificate can't be faked. If the certificate isn't renewed, it expires and can't be used to send users push notifications any longer.