Investigations

AliExpress Ran Inaudible Audio Through Visitors' Speakers to Fingerprint Their Devices. It Only Got Caught Because It Broke Someone's Bluetooth Headphones.

In August 2026, a developer's Bluetooth headphones started misbehaving. They wouldn't switch cleanly between his laptop and his phone anymore — the multipoint pairing that's supposed to be seamless kept glitching, and only when he had an AliExpress tab open. Most people would have blamed the headphones. He opened the site's source code instead.

What he found was two obfuscated scripts, quietly running on AliExpress's homepage, that build a silent audio signal in the browser and measure exactly how the visitor's specific combination of processor, sound chip, and drivers renders it — a fingerprint precise enough to re-identify a device without a single cookie. The volume is set to zero. Muting the tab doesn't stop it. And it was sitting on one of the ten most-visited shopping sites in the world, unnoticed, until a set of headphones gave it away.

A Broken Headset and a Very Loud Silence

The researcher, publishing under the handle m-c-tech (also known as emctech on Hacker News), wrote up the discovery on August 20, 2026, after tracing his headphone problem back to an active audio connection AliExpress's homepage was holding open in the background. Nothing played. Nothing was audible. But the browser registered the tab as consuming audio hardware anyway, which was enough to interfere with his headset's multipoint switching logic — the accidental tell that exposed the whole mechanism.

Two scripts were involved: collina.js (version 1.140.0) and fireyejs.js (version 1.231.67)
Both were served from assets.aliexpress-media.com, under a path associated with AWSC — Alibaba's internal web-security and anti-abuse tooling
Both were heavily obfuscated, making the behavior invisible to a casual read of the page source

How You Fingerprint a Device With Sound Nobody Hears

The technique uses the Web Audio API, a legitimate browser feature meant for things like music production tools and games. The scripts build a small processing chain: a sawtooth oscillator generates a predictable waveform, that waveform passes through an AnalyserNode and a ScriptProcessorNode, then into a GainNode set to zero — silence — and finally out to AudioContext.destination, the system's actual audio output.

No sound ever reaches a speaker. But the numbers the fingerprint is built from are generated during that computation, not during playback — tiny, consistent variations in how a specific processor, sound chip, operating system, and browser combination processes the identical signal. Those variations are stable enough, across enough visits, to re-identify a device the way a cookie would, except a user can't see it, delete it, or opt out of it through any cookie banner.

The Mute Button That Doesn't Mute

The part that turned this from a clever ad-tech trick into a genuine browser bug is that standard privacy controls didn't stop it. Muting the AliExpress tab through the browser's own UI had no effect — the audio graph kept processing regardless, because gain was already at zero and muting a tab doesn't tear down an active AudioContext.

Firefox developer Tom Ritter confirmed the underlying issue is a genuine defect, not intended behavior, tracked as Mozilla bug 1863193. Brave said on X on August 22 that it had been blocking the scripts responsible, and that its browser has shipped default protections against audio fingerprinting "for more than six years" — which is a polite way of saying the technique long predates this particular use of it, and that the industry has known how to stop it for years without every browser bothering to.

Audio Was Just One Layer

The audio fingerprint wasn't running alone. Alongside it, AliExpress's page was pulling in a standard stack of fingerprinting signals that, combined, build a device profile far more specific than any single data point:

Canvas and WebGL rendering signatures
Screen resolution and display configuration
CPU core count and device memory
Installed plugin inventory
WebRTC behavior
Performance-timing characteristics
User interaction patterns and, per some of the reporting, sensor data

Individually, most of these are common enough on the modern web that regulators have mostly tolerated them. Stacked together with an inaudible, un-mutable audio channel that keeps working even when a user thinks they've silenced the page, the result is a tracking method that doesn't ask permission, can't be turned off by any control the browser exposes for it, and doesn't show up anywhere a user would think to look.

A Company Already Under the EU's Microscope

Neither AliExpress nor its parent Alibaba has issued any public statement about the fingerprinting since the discovery went public. That silence is consistent with how the company has handled scrutiny elsewhere.

Under Article 5(3) of the EU's ePrivacy Directive, accessing information on a person's device — which fingerprinting does, audio-based or otherwise — requires prior, informed, unambiguous consent, with narrow exceptions. The Article 29 Working Party classified fingerprinting under this rule back in 2014, and the European Data Protection Board reaffirmed that reading as recently as October 2024. A script quietly building a fingerprint on AliExpress's homepage, before any consent banner is interacted with, sits squarely inside what that rule was written to prevent.

It's also not AliExpress's only open file with EU regulators:

In July 2025, the privacy group noyb filed GDPR complaints against Alibaba's Singapore e-commerce entity with data protection authorities in Belgium, Greece, and the Netherlands, after AliExpress's "download your data" tool returned a broken file that could only be opened once — and follow-up questions were met with generic privacy-policy text instead of actual answers. noyb is asking for a fine of up to 4% of global revenue, which it calculates at roughly €147 million.
In July 2026, the European Commission fined AliExpress €550 million — the largest penalty ever issued under the Digital Services Act — for failing to properly assess and mitigate the risk of illegal, unsafe, and counterfeit products being sold on its platform, following formal proceedings opened in March 2024.

Different regulation, different harm, same company, same pattern: obligations treated as negotiable until a fine, a complaint, or a broken pair of headphones forces the issue into public view.

Filed from public reporting:

AliExpress Ran Inaudible Audio Through Visitors' Speakers to Fingerprint Their Devices. It Only Got Caught Because It Broke Someone's Bluetooth Headphones.

A Broken Headset and a Very Loud Silence

How You Fingerprint a Device With Sound Nobody Hears

The Mute Button That Doesn't Mute

Audio Was Just One Layer

A Company Already Under the EU's Microscope

Read more

Apeel's Grape Seed Coating Once Kept Six in Ten American Supermarket Avocados From Spoiling. Then the Internet Found the Safety Data Sheet for a British Degreaser Also Called Apeel.

A Texas Power Company Charged $9.99 a Month to Let Customers Pay Exactly What the Wholesale Market Paid. In February 2021 the Market Paid $9,000 a Megawatt-Hour, and Griddy Drafted It Straight From Their Accounts.

Australia Paid Up to $1,600 a Home in 2009 to Insulate a Million Ceilings in a Year, Using Installers Who Signed Up Online. Its First Industry Meeting Heard New Zealand Had Tried This and Three People Electrocuted Themselves.

Subway Told Australian Customers Its Footlong Was a Trademark Name, Not a Measurement of Length. The US Trademark Board Ruled It Was a Measurement of Length and Refused Subway the Trademark.