AliExpress Used Inaudible Audio to Fingerprint Visitors
The e-commerce giant employed ultrasonic signals to track users, bypassing traditional privacy settings and cookies.
AliExpress has been caught using a highly invasive browser fingerprinting technique that employs inaudible sounds to track visitors. This method allows the company to uniquely identify users even after they clear cookies or enable privacy-enhancing settings.
According to Ars Technica, the company utilized inaudible audio signals—a process known as WebAudio fingerprinting—to create unique identifiers for its visitors. The technique works by playing a silent sound and measuring exactly how a specific device's hardware and software process that audio. Because different devices handle audio processing with slight variations, these measurements create a unique digital signature. The discovery came to light after the technique interfered with a researcher's Bluetooth headphones, exposing the hidden audio signals.
The Mechanics of Fingerprinting
Browser fingerprinting is a tracking method that collects a variety of device and browser data, such as screen resolution, installed fonts, and hardware specifications, to build a unique ID. While many sites use basic fingerprinting, using audio hardware is a more aggressive approach. By leveraging the WebAudio API, companies can bypass traditional cookie-based blocking entirely, as the tracking is tied to the hardware's behavior rather than a stored file on the user's machine.
Privacy Implications
This incident highlights the escalating conflict between e-commerce giants and user privacy. By utilizing hardware-level signals, companies can maintain persistent tracking of users who believe they have opted out of surveillance. Security experts describe the technique as outdated, yet its application remains invasive. The use of such methods raises significant ethical and legal concerns regarding transparency and informed consent, as users are typically unaware that their audio hardware is being used to track them.
What's Next
The discovery puts further pressure on browser developers to limit the precision of hardware APIs that can be exploited for fingerprinting. While AliExpress has been identified, it remains to be seen if other major platforms are employing similar ultrasonic tracking methods. Privacy advocates are likely to push for stricter regulations on hardware-based identification to prevent companies from circumventing user-defined privacy boundaries.