Security researcher Matthew Callaghan discovered that AliExpress fingerprints visitors using an outdated "soundprinting" technique that sends inaudible audio signals to browsers to help identify individual devices. He stumbled upon the tracking by accident, noticing that his multipoint Bluetooth headphones stopped playing phone audio whenever the AliExpress homepage was loaded, and resumed once the tab was closed, prompting him to investigate further.

Callaghan found two obfuscated scripts that generated inaudible Sawtooth waveforms via the WebAudio API, then measured tiny variations caused by differences in browsers' audio-processing math libraries to create a unique signature for each visitor, with the volume muted so users couldn't hear anything. The method has largely been neutralised since Firefox 118 (2023) began using its own consistent audio libraries rather than the operating system's, while Chrome and likely Safari are also unaffected because they ship their own libraries. However, Callaghan noted AliExpress also uses more than a dozen other fingerprinting techniques, suggesting the audio trick may simply be an unnoticed legacy method, and that similar tracking is probably widespread across thousands of other websites.