AliExpress secretly ran audio to track users
AliExpress has been running silent audio scripts in users’ browsers to generate device fingerprints, a tracking technique that works without cookies and happens entirely out of sight. Researchers and developers found the code on the site’s homepage, tied to Alibaba’s security infrastructure. The scripts tap into a device’s audio hardware to produce a signal and measure the tiny, hardware-specific variations in how it comes back — effectively creating a unique identifier for the machine.
The issue surfaced only after a developer noticed problems with multipoint Bluetooth headphones while an AliExpress tab was open. The headphones wouldn’t switch properly from the computer to a phone. Closing the tab fixed the problem. Digging into the site’s code, the developer found it was using the Web Audio API to build audio-processing graphs set to zero volume.
No audible sound was produced, but the process still connected to the computer’s audio system, keeping the audio path active in the background. That appears to be what interfered with the headphones’ ability to switch devices. Because the processing graph ran at zero gain and connected directly to the system’s audio output, muting the browser tab did nothing to stop it.
Related: Oura sued over $300 ring’s sleep tracking claims
The same code can support browser fingerprinting, a technique that collects device-specific details and combines them to recognize a browser over time. In this case, the scripts measured tiny differences in how a device processed an identical audio signal. Those differences are shaped by a computer’s processor, sound hardware, operating system, browser, and drivers.
There’s a reason companies are reaching for these methods. As cookies become a less reliable way to track people online, platforms are looking for alternatives that don’t depend on stored data. Audio fingerprinting is particularly attractive because it requires no user interaction and leaves no obvious trace. The trade-off is that users never know it’s happening, and they have few practical ways to stop it beyond switching browsers or installing specific blockers.
What the Scripts Actually Collected
Audio measurements were only one part of the reported data collection. The scripts also gathered information tied to canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior and user interactions. Together, those signals can create a more detailed profile of a device than any one signal would provide on its own.
Fingerprinting is often used by large online platforms for fraud prevention, bot detection and risk assessment. It can help companies spot suspicious transactions or automated activity when cookies have been deleted or accounts have changed. But privacy advocates have raised concerns because users may not know the tracking is happening and have limited control over it.
Related: Seven Surprisingly Useful Mac Apps You’ve Never Heard Of
Brave was among the first to call out the behavior. In an August 22 post on X, the company said its browser blocks the AliExpress scripts responsible for the audio-based tracking, noting that it has built in default protections against audio fingerprinting for more than six years. Brave’s approach alters certain browser outputs so that websites receive inconsistent fingerprinting signals rather than a stable, trackable identifier.
The company has since extended similar protections to GPU fingerprinting, a method that uses graphics hardware and driver behavior to identify devices, and says fingerprinting techniques will keep evolving as sites look for new ways to tell users and devices apart. People using other browsers may be able to block these scripts through content blockers such as uBlock Origin, though doing so could affect parts of AliExpress that rely on the same code for security or fraud prevention.
The episode is a reminder of the trade-off baked into much of online security today. Companies want more ways to identify suspicious activity. Users and browser makers want limits on tools that can track a device without a clear notice or consent. For now, the balance tilts toward the platforms — and the burden falls on users to find and block the scripts themselves.
