AliExpress Was Playing Silent Audio in Your Browser to Track You

A developer noticed his Bluetooth headphones wouldn't hand off from his laptop to his phone. He closed a browser tab and the problem vanished. The tab was AliExpress. What he found digging through the site's code is one of the more inventive tracking techniques to surface in a while: silent audio, played at zero volume, running purely to identify his machine.

It's called audio fingerprinting, and it doesn't need a single cookie to work.

How it works

Browser fingerprinting identifies a device by combining signals: hardware, software, screen properties, rendering quirks. The audio version uses the Web Audio API to generate a fixed waveform, push it through the browser's audio processing, and measure the numbers that come back out. Tiny variations from your CPU, drivers, operating system, and audio hardware make those numbers slightly different on nearly every machine.

The AliExpress implementation connected its audio graph to the actual audio output with the volume set to zero. You would never hear it. But the browser treats the tab as playing media, which is exactly why the Bluetooth handoff broke. The tracking was invisible. The side effect was not.

Why this is worse than cookies

Cookies live on your device, so you can inspect them, block them, and delete them. A fingerprint stores nothing at all. Clearing your browser doesn't change it. Neither does a private window. The entire appeal of the technique, for whoever deploys it, is that the usual user controls simply don't apply.

The scripts appear connected to Alibaba's security systems, which suggests fraud detection is at least part of the purpose. That's a legitimate use. Recognizing a returning device helps block bots and fake accounts and lets real customers skip endless CAPTCHAs. AliExpress hasn't publicly explained the scope or intent.

A legitimate purpose and inadequate disclosure can both be true at the same time. In Europe, the ePrivacy Directive and GDPR require consent for fingerprint-based tracking unless it's strictly technically necessary, and fingerprinting every homepage visitor without notice is a hard thing to justify under that standard.

What you can do about it

Brave says it blocks the AliExpress scripts responsible, and has shipped audio fingerprinting defenses for more than six years. Its approach is to slightly randomize the outputs so sites get an inconsistent signature instead of a stable identifier. Brave has since extended the same treatment to GPU fingerprinting.

On other browsers, a content blocker like uBlock Origin can stop these scripts, though it may also break parts of the site that share the same code for fraud checks. Keeping your browser current helps, since vendors update these defenses as techniques evolve. Using a separate browser profile for shopping, signed in to nothing else, limits what can be tied back to you.

The bigger pattern

Every time browsers close a tracking door, the industry finds a window. Third-party cookies got restricted, so fingerprinting got better. Canvas fingerprinting drew scrutiny, so audio and GPU signals picked up the slack. None of these individually identifies you with certainty. Combined, they build a profile that follows you around without ever storing anything you could find and delete.

The takeaway isn't to panic about AliExpress specifically. It's that clearing your cookies stopped being a meaningful privacy action a while ago, and the only real lever most people have left is which browser they choose to trust.