AliExpress, the online marketplace operated by Alibaba Group, has been identified by researchers and the browser developer Brave as utilizing silent Web Audio processing to potentially fingerprint visitors' browsers. This technique does not involve recording users through their microphones but instead generates and processes an inaudible audio signal. By measuring subtle, consistent differences in how a browser and device handle this signal, a unique signature can be created.
Browser fingerprinting enables websites to identify devices and recognize repeat visitors without relying on traditional cookies. It operates by compiling various pieces of information about a device and its browser to form a distinctive digital signature. The AliExpress website was observed processing a fixed audio waveform and analyzing the resulting numerical values. Minute variations in these values can stem from differences in the browser, operating system, CPU behavior, audio hardware, and drivers. When combined with other data points, these audio measurements contribute to a more comprehensive browser or device identifier.
Analysis of the page's code reportedly revealed audio-processing graphs configured for zero volume, yet still connected to the system audio output. This explains why users would not hear anything, and why muting a browser tab would not necessarily prevent the processing, as all relevant operations occurred within the Web Audio graph rather than through a conventional media player.
The audio measurements were reportedly just one component of a broader data collection effort. The scripts also gathered information related to canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior, and user interactions. Collectively, these signals can construct a more detailed profile of a device than any single signal could provide alone.
While fingerprinting can serve legitimate purposes such as fraud prevention, bot detection, and risk assessment—helping companies identify suspicious transactions or automated activity even when cookies are deleted or accounts changed—it also raises significant privacy concerns. Users may be unaware that such tracking is occurring and have limited control over it. Previous studies have indicated that user choices regarding cookie consent are often disregarded, and fingerprinting further complicates privacy by allowing websites to recognize visitors without any reliance on cookies.
Brave has stated that its browser blocks the AliExpress scripts responsible for this audio-based tracking. Other protective measures users can take include employing content blockers and anti-tracking extensions to restrict the information websites collect, keeping browsers updated to benefit from evolving privacy defenses, and using a separate browser or profile for shopping, ideally without logging into other services within the same profile.
