AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev’s headphones
Developer Matt Callaghan says he caught AliExpress, part of Alibaba, running hidden audio-based fingerprinting scripts that track visitors even though the sound is silenced to zero gain. He discovered the issue after noticing his Bluetooth headphones kept cutting audio from his phone whenever he opened AliExpress in Firefox or Chrome, tracing the cause to obfuscated WebAudio scripts that generate and analyse an inaudible sawtooth waveform, a technique that can also be combined with other device data to build a detailed fingerprint of a user's browser and hardware.
Callaghan found the scripts sat within AliExpress's browser security and anti-abuse tooling, alongside code collecting screen dimensions, device memory, browser plugins, WebGL rendering and mouse events, all of which he says amounts to a "fairly comprehensive" fingerprint that appears to be encrypted and sent to Alibaba's telemetry services. Firefox says its anti-fingerprinting protections, introduced in version 118 back in September 2023, neutralise such WebAudio tricks by grouping 99.24 percent of users into just three hardware-based "buckets" so they look identical, though engineer Tom Ritter noted 48 users worldwide fall outside these groups and remain more exposed to tracking. The Register has approached Alibaba for comment.
- AliExpress accused of using silent audio scripts to fingerprint browsers
- Trick also disrupted a developer's Bluetooth headphone switching
- Firefox says its 2023 anti-fingerprinting update blocks the technique for most users
New here? Start with this
AliExpress is an online shopping site owned by Chinese technology company Alibaba. Websites sometimes use browser and device details to help detect fraud or abuse, but the same details can also be used to recognise visitors across visits without relying on cookies.
Audio fingerprinting analyses tiny differences in how a device processes sound, which can vary between computers and browsers. Matt Callaghan, a developer, says AliExpress’s scripts tested this in a way that muted audio on his headphones; he also found code gathering other device and browser details.
Firefox includes protections designed to make many users’ audio processing appear alike, limiting how useful it is for tracking. The issue matters because combining several device details may make a browser easier to recognise, while users may not realise this is happening.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Major e-commerce platforms require robust anti-fraud systems, and browser fingerprinting is a standard industry practice for detecting automated attacks and account takeovers. Collecting device data is fundamental to identifying malicious patterns, and whilst transparency matters, security sometimes necessitates less visible measures that prevent circumvention by bad actors. Users concerned about privacy can employ Firefox's anti-fingerprinting protections.
The case against
Users deserve informed consent before being tracked, yet AliExpress employed secret, deliberately obfuscated fingerprinting scripts operating without opt-out options—an unacceptable violation of privacy rights. The hidden nature, using inaudible audio and code obfuscation, indicates intentional concealment that undermines legitimate security claims, and such systems demonstrably cause unintended harms like muting headphones. Most concerning is the opacity around data flows, particularly given Alibaba's corporate ties, raising questions about whether collected fingerprints are repurposed beyond stated security aims.