AliExpress Accused of Using Silent Audio Fingerprinting to Track Users
The e-commerce giant allegedly leverages the Web Audio API to create unique device identifiers that bypass traditional privacy controls.
AliExpress is facing allegations of using a hidden browser-based technique to fingerprint users' computers via their audio systems. This method allows the platform to create a unique identifier for a device, enabling tracking that persists even when users attempt to maintain anonymity.
According to reports and subsequent findings highlighted by browser makers like Brave, AliExpress utilized the browser's Web Audio API to generate these fingerprints. The process occurs silently in the background, meaning the code runs and collects data even when no sound is playing or audible to the user. By analyzing how specific hardware and drivers process audio signals, the platform can derive a signature unique to that specific machine.
The Mechanics of Audio Fingerprinting
Browser fingerprinting is a sophisticated tracking method that collects a combination of hardware and software configurations to identify a user. While many sites collect basic data like screen resolution or installed fonts, audio fingerprinting is more invasive. It leverages the minute differences in how various audio chips and software drivers handle signal processing. Because these variations are tied to the physical hardware and specific driver versions, they create a highly stable and unique identifier for the device.
Why It Matters for Privacy
This practice is particularly concerning because it allows companies to track users across different sessions and potentially across multiple accounts. Unlike traditional tracking methods, audio fingerprinting does not rely on cookies or local storage. Consequently, standard privacy measures—such as clearing browser cookies, using incognito mode, or employing private browsing windows—are ineffective at stopping this form of identification. This creates a persistent link between a user's physical hardware and their online activity without their explicit knowledge or consent.
The Industry Response
The discovery of these techniques has put additional pressure on browser developers to tighten permissions around the Web Audio API. While the behavior has been identified by researchers and flagged by privacy-focused browsers, the industry continues to struggle with the balance between allowing legitimate web functionality and preventing covert tracking.
As the community monitors whether AliExpress or other platforms implement more transparent tracking disclosures, users are encouraged to adopt browsers with enhanced fingerprinting protection. The shift toward more restrictive API access reflects a broader trend in cybersecurity to mitigate the risks of hardware-level identification, which remains one of the most difficult tracking vectors for the average consumer to detect or disable.