AliExpress Accused of Secretly Fingerprinting Users Through Hidden Audio Tracking

Privacy focused browser Brave has alleged that AliExpress uses hidden audio processing techniques on its homepage to fingerprint user devices without relying on cookies or requiring consent.

How the Tracking Method Works

According to Brave, the technique generates a silent audio signal and analyzes subtle variations in how a device processes it, differences that can depend on a system’s processor, sound hardware, browser, and other software characteristics. These variations can then be combined into a broader device fingerprint. The issue was first discovered after a researcher noticed multipoint Bluetooth headphones failing to switch audio properly while an AliExpress tab remained open, a problem that disappeared once the tab was closed.

Investigation Uncovers Hidden Audio Processing

A technical analysis published around August 20 found that AliExpress scripts created audio processing graphs connected to the system’s audio output, despite running at zero volume. Because the process didn’t rely on standard media elements, typical browser mute controls did not stop it. Researchers say this audio data was combined with other signals, including canvas rendering and WebGL information, and reportedly transmitted to Alibaba’s servers.

Legitimate Uses Versus Privacy Concerns

Device fingerprinting is commonly used across e-commerce platforms for fraud detection and bot prevention, especially as users increasingly block or delete cookies. However, privacy advocates note concerns arise when such techniques operate without clear visibility or meaningful user control. Brave said its browser has defended against audio fingerprinting and similar techniques by default for more than six years, using randomized data outputs that reset each session, and confirmed it blocks the specific scripts linked to this AliExpress method.

Broader Implications for Web Privacy

The case highlights an ongoing tension between anti-fraud tools used by online platforms and privacy-focused browsers working to limit tracking. Users on other browsers may attempt to block similar scripts using content blocking extensions, though this could affect certain website functions.