Researchers say the shopping site ran a hidden Web Audio API script to track visitors even without cookies.
AliExpress was running a hidden audio-based tracking script on its site that could fingerprint visitors' devices without their knowledge, researchers reported this week. The discovery came about almost by accident, after a developer noticed the site was interfering with their Bluetooth headphones.
How it was discovered
A developer troubleshooting Bluetooth multipoint headphone-switching problems noticed the issue only occurred while an AliExpress tab was open, and stopped as soon as the tab was closed. Digging into the site's code turned up a Web Audio API implementation that was keeping an audio path active in the background.
How the tracking worked
The script created silent audio-processing graphs set to zero volume, then measured subtle, device-specific variations in how each visitor's processor, sound hardware, operating system, browser and drivers handled the audio signal, generating a distinct fingerprint. Muting the tab had no effect, since the processing ran in the background regardless. Researchers say AliExpress combined this audio signal with canvas rendering, WebGL data, display settings, hardware configuration and WebRTC behavior to build a fuller device profile, one that works even when a visitor blocks cookies.
What's unconfirmed
AliExpress has not publicly explained the purpose or scope of the audio fingerprinting, and it is not confirmed how widely the technique may be used elsewhere across the company's sites or apps. Reporting so far is based on independent researcher findings, not a company disclosure.
Why it matters
Device fingerprinting is a known industry tool for fraud and bot detection, and companies generally defend its use on those grounds. But researchers note this kind of tracking typically runs without clear notice or consent from visitors, and as browsers and regulators crack down on cookies, techniques like audio fingerprinting are becoming a more common way for sites to keep identifying devices anyway.
Why you can trust this article
Written and edited in-house by the THRYV Tech Desk. We do not republish or reword agency copy, and we do not invent quotes, statistics, testimonials or ratings. Where figures move frequently, we point you to the primary release rather than printing a number that will be out of date. Advertising and affiliate partnerships have no influence on our reporting — see our editorial standards, fact-checking policy and affiliate disclosure. Spotted an error? Write to newsroom@thryv-news.com.
General information only. Not personalised financial, medical or legal advice.
