AliExpress Uses Silent Audio to Fingerprint and Track Shoppers
What seemed like a simple Bluetooth hiccup — multipoint headphones refusing to switch between a computer and a phone — uncovered a covert tracking mechanism embedded in AliExpress's website code. A developer investigating why the browser tab wouldn't release the audio path to another device discovered that the marketplace's page was executing Web Audio API scripts configured at zero volume. Nothing was audible, but the signal was enough to create a device-specific identifier.
What was found
The AliExpress scripts generated a fixed, inaudible sound wave routed to the system's audio path. Even with the browser tab muted, the Web Audio processing graph remained connected to the system audio output, keeping the audio path active in the background. The page measured the minute variations in how the device's audio hardware responded to the exact same signal — variations shaped by the processor, audio drivers, operating system, and browser.
This mechanism is a variant of browser fingerprinting: instead of cookies, identification is based on how the device physically processes an identical signal. When combined with other data collected by the same scripts — canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior, and mouse interactions — it creates a significantly more detailed device profile than any single signal could provide on its own.
The issue came to light only because the developer's multipoint Bluetooth headphones stopped switching correctly between the computer and smartphone while the AliExpress tab was open. Closing the tab restored normal behavior, which led to the discovery of the hidden scripts.
The broader context: the post-cookie world
This practice sits within a wider industry trend. As regulations like the GDPR and browser privacy policies in Safari and Chrome progressively reduce the reliability of third-party cookies, internet companies are migrating to alternative tracking techniques. Browser fingerprinting has existed for years, but the methods have evolved dramatically.
Earlier studies cited by Malwarebytes showed that in more than half of cases examined, users' cookie consent choices were ignored. Audio fingerprinting adds another layer of concern because it operates independently of cookies, clearing browsing history, or using incognito mode — the device's own physical response to a signal becomes the identifier.
Industry response
Brave Software was the first to publicly flag the AliExpress behavior, publishing a detailed analysis on X on August 22, 2026. Brave browser already blocks these scripts by default, having implemented audio fingerprinting protections for over six years. According to the company, its protections alter certain browser outputs so that websites receive inconsistent fingerprinting signals rather than stable, trackable identifiers.
The company has also extended similar protections against GPU fingerprinting — another technique that uses graphics hardware and driver behavior to identify devices. Brave warns that these techniques will continue to evolve as commercial platforms constantly seek new ways to distinguish users and devices.
What it means for users
For the average user, this episode illustrates an increasingly pervasive cybersecurity dilemma: companies like AliExpress argue that these techniques are legitimate for fraud prevention, bot detection, and risk assessment — functionalities that genuinely help protect transactions. At the same time, users rarely know this tracking is happening and have very limited control over it.
Security experts recommend using content blockers like uBlock Origin to limit the information websites can collect, keeping browsers updated since vendors continually adjust fingerprinting defenses, and considering separate browser profiles for shopping services. Brave itself recommends staying updated, as browser developers continuously refine privacy protections.
The underlying tension here is whether the balance between financial security and user privacy is being achieved when platforms collect identifiable data without clear notification or explicit consent — and whether individual fingerprinting defenses will hold as these techniques grow increasingly sophisticated.
Sources: The Register, Malwarebytes, TechSpot, Brave Software
✓ Independent sources cross-checked and verified before publishing
