AliExpress tracks users using inaudible sound
AliExpress uses the WebAudio API to generate digital fingerprints for user tracking. The technique was discovered after a security researcher noticed glitches in his Bluetooth headphones.
The shopping site AliExpress plays an audio signal at an inaudible frequency through the browser to create a digital fingerprint of users for identification and tracking purposes. This was revealed after the site's technique caused a bug in a security researcher's Bluetooth headphones. While not a new technique in the industry, and despite privacy-oriented browsers having protection mechanisms for years, the way AliExpress implements it is considered relatively aggressive.
The technique was uncovered by the author of the anonymous cyber blog laserphile, who specializes in analyzing browser behavior. The researcher noticed suspicious behavior in his Bluetooth headphones whenever he browsed to AliExpress. "The computer has priority in playing audio in the headset, and the phone plays audio when nothing is playing on the computer," the researcher wrote. "It works reliably until I open an AliExpress page in Firefox or Chrome. Shortly after the page loads, the audio from my phone stops. Closing the tab fixes it immediately. Muting the tab does not help, and there is no media playing on the page."
An analysis of the site's code revealed that AliExpress uses the WebAudio API, a feature designed for sound processing, to generate a muted signal. This allows the site to test how the user's device processes sound, even when no audio is playing. Every computer processes sound differently based on hardware variables like the CPU and sound card, creating a unique signature or "fingerprint." By identifying this, AliExpress can tag users without relying on traditional cookies, which are easily blocked or deleted.
While fingerprinting can have legitimate uses, such as fraud prevention and bot detection, it is often used to build unique profiles for long-term tracking, even in incognito mode. Firefox stated that its built-in protections prevent WebAudio from being used for tracking. "AliExpress tried to track users secretly, but was thwarted by Firefox's anti-fingerprinting technology," the browser's X account stated. Firefox privacy engineer Tom Ritter added: "Fingerprinting is a too-common method for monitoring users, but when it comes to WebAudio, it is not very effective. Firefox blocked this vector three years ago."
The privacy-focused browser Brave confirmed it has offered protections against such techniques for over six years: "Brave injects random information into the browser's output to create a different fingerprint on different sites. Fingerprints are reset with every visit. For additional protection, we block the code AliExpress used for this tracking method by default for all users."
