Aliexpress Accused of Secret Audio Fingerprinting Scheme

Imagine your browser whispering to a shopping site while no music or video is playing. That’s the claim now shadowing AliExpress: hidden audio routines running in the background to help identify and track users.

Technical probes show the site’s security scripts create silent audio buffers via the Web Audio API, generate specific waveforms and run signal-processing steps even when there’s no audible content. Those audio-derived fingerprints are then fused with other browser fingerprints—Canvas and WebGL signatures, for example—to build a surprisingly precise hardware identifier tied to a user’s device.

The result is more than clever analytics. It’s a new vector for cross-site and cross-session tracking. Short session? Doesn’t matter. Different browser tabs or even different logins can be linked by the same under-the-radar hardware fingerprint. Think of it as a digital DNA marker made from the way your browser handles invisible sound.

There’s a practical, unexpected side effect too. Continuous background audio processing appears to interfere with Bluetooth multipoint headsets. Because the audio pipeline never truly idles, some multi-device headphones fail to switch automatically between your laptop and phone. Small annoyance for many. Big signal for anyone tracking how often their techniques touch end-user hardware.

This method turns silent browser activity into a tracking channel that sidesteps typical privacy boundaries.

Brave’s developers say their built-in shields block these audio-fingerprinting attempts and prevent scripts from harvesting hardware identifiers. Other privacy-focused browsers and extensions may offer similar protections, but not every user runs them by default.

So what can a concerned user do? Keep browsers updated, consider privacy-first options, and monitor permission and extension settings. And if a storefront can fingerprint you from silence, maybe it’s time to ask louder questions about who gets to listen.