AliExpress, the global retail platform owned by Alibaba, has been caught using a sophisticated browser fingerprinting technique that relies on inaudible audio tones, according to a report published Monday by researcher Matthew Callaghan.
Callaghan noticed that every time he loaded the AliExpress homepage, audio from his phone stopped playing over his multipoint Bluetooth headphones. The headphones are configured to accept connections from multiple devices but prioritize audio from a PC. Closing the AliExpress tab restored phone audio immediately, prompting him to investigate.
He found two highly obfuscated JavaScript scripts embedded in the site. Together, they rendered a graph that acted as an oscillator generating sawtooth waves — a common waveform in digital audio output. The scripts analyzed the WebAudio readings from each visiting browser, converting subtle variations in how different devices render the sound into a unique fingerprint.
The technique is not new to privacy researchers but is rarely detected in the wild. The WebAudio API gives developers access to low-level audio processing, and its output can differ slightly depending on hardware, drivers, and browser configuration — enough to create a tracking identifier without cookies.
"This is a particularly stealthy form of fingerprinting because the user is completely unaware it is happening," said Callaghan in a blog post detailing his findings. "The sound is inaudible to human ears, but the browser processes it."
AliExpress has not publicly commented on the discovery. The company has faced scrutiny in the past over data privacy practices, particularly from European regulators. The use of such fingerprinting could potentially violate GDPR and similar laws that require user consent for tracking.
When reached for comment, a spokesperson for AliExpress said the company takes user privacy seriously and is reviewing the findings. The scripts in question appear to be part of a third-party analytics service, the spokesperson added, without naming the provider.
Privacy advocates argue this case highlights the need for stricter regulation of fingerprinting techniques that circumvent browser privacy protections. "Browser fingerprinting is an arms race," said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation. "As browsers block cookies and third-party trackers, companies turn to more invasive methods. Users have no control over this."
The discovery comes as regulators worldwide tighten rules around online tracking. The European Data Protection Board has previously warned that audio-based fingerprinting may require explicit consent under GDPR.