Alibaba's global marketplace AliExpress has been accused of deploying hidden audio fingerprinting scripts that silently generate waveforms using a user's browser to collect device characteristics, even when no sound is playing. The discovery, made by developer Matt Callaghan and detailed in a blog post, revealed that the practice interferes with multipoint Bluetooth audio and raises new privacy concerns about browser-based tracking.
Developer Matt Callaghan stumbled upon the behavior while troubleshooting an issue with his wireless headphones. After loading the AliExpress homepage, his phone's audio would abruptly stop playing through his multipoint Bluetooth headphones, even though no media was playing on his computer. Closing the tab instantly resolved the issue, but muting the tab, browser, or Windows did not.
Investigating further, Callaghan found that AliExpress loads two scripts—named collina.js and fireyejs.js—which appear to be part of Alibaba's browser security and anti-abuse toolkit. These scripts construct a Web Audio graph using a sawtooth oscillator to generate a waveform. An analyzer then measures how the waveform is altered by the browser's audio stack. Crucially, the volume gain is set to zero, so no audible sound is produced, but the browser continues actively processing audio. This keeps the Bluetooth audio path active and prevents multipoint headphones from switching between devices.
Beyond audio, the scripts also collect information about screen dimensions, device memory, browser plugins, WebGL rendering, supported audio and video formats, browser performance, and mouse events. The data is serialized, encrypted, and sent to Alibaba's telemetry services via fetch() or sendBeacon() functions.
Browser vendors have responded. Firefox noted on X that its browser includes built-in fingerprinting protections and pointed to a feature introduced in Firefox 118 (September 2023) that specifically mitigates Web Audio-based fingerprinting. Brave also claims to block audio fingerprinting by default by injecting randomized data into the audio output, making the fingerprint appear different each time.
The discovery highlights an increasingly sophisticated arms race between websites seeking to uniquely identify users for fraud prevention or advertising, and browser makers working to preserve privacy. Audio fingerprinting exploits subtle hardware and software differences in how a device processes sound, creating a highly stable fingerprint that is difficult to spoof.
Analysis
Why This Matters
- User privacy: Audio fingerprinting can create a persistent, hard-to-detect identifier that tracks users across sessions even when cookies are cleared, undermining existing anti-tracking measures.
- Tangible inconvenience: The technique interferes with Bluetooth multipoint functionality, causing real-world usability problems for users who browse AliExpress while using headphones.
- Escalating tracking arms race: This case shows that fingerprinting is moving beyond traditional vectors like screen resolution and canvas drawing, exploiting deeper browser APIs with no user-facing benefit.
Background
Browser fingerprinting has been a privacy concern for over a decade. Traditional methods collect screen dimensions, installed fonts, timezone, and language settings to create a unique profile. The Electronic Frontier Foundation (EFF) first popularized the concept with the Panopticlick project in 2010. in response, browser vendors added protections: Firefox has fingerprinting resistance since version 67, Brave blocks fingerprinting by default, and Safari strips many detectable attributes. However, sites fighting fraud or abuse have turned to more obscure APIs. The Web Audio API, designed for in-browser audio processing and music synthesis, turned out to be an excellent fingerprinting vector because audio output depends on the specific hardware and drivers, creating a device-specific signature. Researchers have demonstrated Web Audio fingerprinting before, but this is the first documented case of a major commercial site deploying it at scale.
Key Perspectives
Alibaba (AliExpress parent company): The scripts are part of their browser security and anti-abuse tooling. From their vantage, identifying returning users without cookies is essential to combat fake accounts, scalping, and other fraud without relying on third-party cookies that are increasingly blocked by browsers.
Privacy advocates and users: Unilaterally deploying a hidden audio process that consumes resources and degrades Bluetooth headphone functionality without consent is deceptive and invasive. Even if the data is encrypted and not used for ad targeting, the very act of building a persistent fingerprint undermines user control over their digital identity.
Browser vendors (Firefox, Brave): Their response shows a proactive stance. Firefox already had protections, and Brave goes further by randomizing audio output. However, the fact that the AliExpress script still managed to trigger audio processing—even if the resulting fingerprint is obfuscated in some browsers—indicates that protections are not perfect and that the scripts still cause the Bluetooth interference problem.
What to Watch
- Alibaba's response: Will they remove the audio fingerprinting code, modify it to avoid Bluetooth interference, or publicly defend the practice as necessary security? Publishers, regulators, and users are watching.
- Browser vendor patches: Expect updates from Chrome and other browsers to block or warn about silent audio context creation. Firefox's existing protections may need to be made more aggressive.
- Regulatory scrutiny: The EU's ePrivacy Directive and GDPR require consent for non-essential tracking. If a complaint is filed, regulators may investigate whether audio fingerprinting constitutes hidden tracking requiring opt-in consent.
- Spread of similar techniques: Other major e-commerce or social media sites may be testing similar fingerprinting. Audits by security researchers could reveal more cases, potentially triggering a broader industry response.