The popular online shopping platform AliExpress has been identified using background audio processing techniques to monitor user activity and create hardware profiles. The mechanism keeps an audio stream active in the browser even when the volume is muted, effectively building an accurate device fingerprint of the visitor’s machine.
The behavior was uncovered by a software developer experiencing connectivity issues with multipoint Bluetooth headphones. The device failed to switch between a computer and a smartphone whenever an AliExpress tab was open, returning to normal functionality only after closing the page.
Alibaba's AliExpress was caught using users' audio systems to track them.
AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them.
But don't worry because Brave stops this.
— Brave (@brave) August 22, 2026
An inspection of the website source code revealed the implementation of the Web Audio API to generate audio processing graphs:
- The script establishes an active route to the operating system audio output, keeping the channel occupied in the background.
- Native browser features, such as the mute tab button, fail to terminate this low-level API activity.
- A standardized, silent audio signal is processed to measure minute execution differences.
Audio Fingerprinting and User Profiling
The primary purpose of this technique is browser fingerprinting rather than recording ambient sound. Because the output signal varies based on the processor, sound card, audio drivers, and browser build, it creates a unique machine signature.
This audio metric is paired with additional data points, including:
- WebGL data and screen resolution parameters.
- WebRTC connection behaviors and network states.
- Hardware configurations, mouse movement trajectories, and user click patterns.
Privacy Implications and Industry Response
Online platforms frequently adopt fingerprinting as a persistent alternative to third-party cookies, primarily for fraud prevention and bot detection. However, privacy advocates criticize the practice because it operates silently without explicit user consent and bypasses standard cache-clearing methods.
How To Protect Yourself
Following the disclosure, privacy-oriented browsers such as Brave and Mozilla Firefox highlighted their built-in defenses against audio-based tracking scripts.
AliExpress’s parent company, Alibaba, has not officially modified the tracking deployment following the report.