Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
Security researcher Matthew Callaghan discovered that AliExpress fingerprints visitors using an outdated "soundprinting" technique that sends inaudible audio signals to browsers to help identify individual devices. He stumbled upon the tracking by accident, noticing that his multipoint Bluetooth headphones stopped playing phone audio whenever the AliExpress homepage was loaded, and resumed once the tab was closed, prompting him to investigate further.
Callaghan found two obfuscated scripts that generated inaudible Sawtooth waveforms via the WebAudio API, then measured tiny variations caused by differences in browsers' audio-processing math libraries to create a unique signature for each visitor, with the volume muted so users couldn't hear anything. The method has largely been neutralised since Firefox 118 (2023) began using its own consistent audio libraries rather than the operating system's, while Chrome and likely Safari are also unaffected because they ship their own libraries. However, Callaghan noted AliExpress also uses more than a dozen other fingerprinting techniques, suggesting the audio trick may simply be an unnoticed legacy method, and that similar tracking is probably widespread across thousands of other websites.
- AliExpress caught using inaudible sound to fingerprint website visitors
- Researcher found it via headphone audio glitches, then obfuscated scripts
- Firefox, Chrome and likely Safari have already blocked the technique
New here? Start with this
Browser fingerprinting identifies a device by measuring details about how its browser behaves, such as how it processes sound. Unlike cookies, these measurements can help recognise a visitor without storing a small file on their device.
AliExpress is an online shopping site owned by Chinese technology company Alibaba. Security researcher Matthew Callaghan said he found scripts on its homepage that used inaudible audio signals to build a browser fingerprint; differences in audio processing could make one device’s result distinct from another’s.
The technique has become less effective as browsers increasingly use their own audio-processing software. The case matters because fingerprinting can be difficult for visitors to spot or avoid, and the reported audio method may be one of several tracking techniques used by websites.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Browser fingerprinting is a standard practice across e-commerce necessary to combat genuine fraud and bot attacks. The audio method here has been completely neutralised by modern browser design and appears to be non-functional legacy code. Singling out this now-defunct technique may overstate the privacy risk and distract from the substantive debate about how to balance legitimate security needs with user privacy rights.
The case against
AliExpress deliberately embedded undetectable, inaudible audio signals specifically designed to hide user identification from detection, violating informed consent. Combined with a dozen other fingerprinting techniques, this reveals systematic covert tracking designed to evade disclosure. Users deserve fundamental agency over their data and transparency about identification methods; hidden surveillance cannot be justified by fraud prevention needs, which should be addressed through disclosed methods giving users actual choice.