From what I've heard during an Android developers conference in Israel:
There is simply a TCP socket waiting in accept mode on a cloud Google server. The TCP connection had been initiated by the Google Play application. That's why Google Play must be installed on the device for making Google Cloud Messaging (GCM) (formerly Android Cloud to Device Messaging Service - C2DM) work.
When this TCP client socket receives some message, the message contains information such as the package name of the application it should be addressed to, and of course - the data itself. This data is parsed and packed into an intent that is broadcast and eventually received by the application.
The TCP socket stays open even when the device's radio state turns into "idle" mode. Applications don't have to be running to receive the intents.
More information at http://developer.android.com/google/gcm/gcm.html
But I think it works on emulator as well. The thing that come into my mind is that the device keep server updated with its current path (IP). When google server needs to send notification, it takes its current path and forward message to that path. Am I right to some extent?
@Khawar Raza: when the device's IP changed from some reason, the device disconnects from server. when it happens - new connection astemblish instead, based on the device new IP.
@Khawar Raza: the emulator works even without the google play. I guess it initiate this socket built in internally, instead of google play
I see. That would be quite interesting actually, I wonder if that's true.
So it's still polling, but the good side is that polling is centralized by Google Play.