AliExpress Ran Inaudible Audio Through Visitors' Speakers to Fingerprint Their Devices. It Only Got Caught Because It Broke Someone's Bluetooth Headphones.
In August 2026, a developer's Bluetooth headphones started misbehaving. They wouldn't switch cleanly between his laptop and his phone anymore — the multipoint pairing that's supposed to be seamless kept glitching, and only when he had an AliExpress tab open. Most people would have blamed the headphones. He opened the site's source code instead.
What he found was two obfuscated scripts, quietly running on AliExpress's homepage, that build a silent audio signal in the browser and measure exactly how the visitor's specific combination of processor, sound chip, and drivers renders it — a fingerprint precise enough to re-identify a device without a single cookie. The volume is set to zero. Muting the tab doesn't stop it. And it was sitting on one of the ten most-visited shopping sites in the world, unnoticed, until a set of headphones gave it away.
A Broken Headset and a Very Loud Silence
The researcher, publishing under the handle m-c-tech (also known as emctech on Hacker News), wrote up the discovery on August 20, 2026, after tracing his headphone problem back to an active audio connection AliExpress's homepage was holding open in the background. Nothing played. Nothing was audible. But the browser registered the tab as consuming audio hardware anyway, which was enough to interfere with his headset's multipoint switching logic — the accidental tell that exposed the whole mechanism.
- Two scripts were involved:
collina.js(version 1.140.0) andfireyejs.js(version 1.231.67) - Both were served from
assets.aliexpress-media.com, under a path associated with AWSC — Alibaba's internal web-security and anti-abuse tooling - Both were heavily obfuscated, making the behavior invisible to a casual read of the page source
How You Fingerprint a Device With Sound Nobody Hears
The technique uses the Web Audio API, a legitimate browser feature meant for things like music production tools and games. The scripts build a small processing chain: a sawtooth oscillator generates a predictable waveform, that waveform passes through an AnalyserNode and a ScriptProcessorNode, then into a GainNode set to zero — silence — and finally out to AudioContext.destination, the system's actual audio output.
No sound ever reaches a speaker. But the numbers the fingerprint is built from are generated during that computation, not during playback — tiny, consistent variations in how a specific processor, sound chip, operating system, and browser combination processes the identical signal. Those variations are stable enough, across enough visits, to re-identify a device the way a cookie would, except a user can't see it, delete it, or opt out of it through any cookie banner.
The Mute Button That Doesn't Mute
The part that turned this from a clever ad-tech trick into a genuine browser bug is that standard privacy controls didn't stop it. Muting the AliExpress tab through the browser's own UI had no effect — the audio graph kept processing regardless, because gain was already at zero and muting a tab doesn't tear down an active AudioContext.
Firefox developer Tom Ritter confirmed the underlying issue is a genuine defect, not intended behavior, tracked as Mozilla bug 1863193. Brave said on X on August 22 that it had been blocking the scripts responsible, and that its browser has shipped default protections against audio fingerprinting "for more than six years" — which is a polite way of saying the technique long predates this particular use of it, and that the industry has known how to stop it for years without every browser bothering to.
Audio Was Just One Layer
The audio fingerprint wasn't running alone. Alongside it, AliExpress's page was pulling in a standard stack of fingerprinting signals that, combined, build a device profile far more specific than any single data point:
- Canvas and WebGL rendering signatures
- Screen resolution and display configuration
- CPU core count and device memory
- Installed plugin inventory
- WebRTC behavior
- Performance-timing characteristics
- User interaction patterns and, per some of the reporting, sensor data
Individually, most of these are common enough on the modern web that regulators have mostly tolerated them. Stacked together with an inaudible, un-mutable audio channel that keeps working even when a user thinks they've silenced the page, the result is a tracking method that doesn't ask permission, can't be turned off by any control the browser exposes for it, and doesn't show up anywhere a user would think to look.
A Company Already Under the EU's Microscope
Neither AliExpress nor its parent Alibaba has issued any public statement about the fingerprinting since the discovery went public. That silence is consistent with how the company has handled scrutiny elsewhere.
Under Article 5(3) of the EU's ePrivacy Directive, accessing information on a person's device — which fingerprinting does, audio-based or otherwise — requires prior, informed, unambiguous consent, with narrow exceptions. The Article 29 Working Party classified fingerprinting under this rule back in 2014, and the European Data Protection Board reaffirmed that reading as recently as October 2024. A script quietly building a fingerprint on AliExpress's homepage, before any consent banner is interacted with, sits squarely inside what that rule was written to prevent.
It's also not AliExpress's only open file with EU regulators:
- In July 2025, the privacy group noyb filed GDPR complaints against Alibaba's Singapore e-commerce entity with data protection authorities in Belgium, Greece, and the Netherlands, after AliExpress's "download your data" tool returned a broken file that could only be opened once — and follow-up questions were met with generic privacy-policy text instead of actual answers. noyb is asking for a fine of up to 4% of global revenue, which it calculates at roughly €147 million.
- In July 2026, the European Commission fined AliExpress €550 million — the largest penalty ever issued under the Digital Services Act — for failing to properly assess and mitigate the risk of illegal, unsafe, and counterfeit products being sold on its platform, following formal proceedings opened in March 2024.
Different regulation, different harm, same company, same pattern: obligations treated as negotiable until a fine, a complaint, or a broken pair of headphones forces the issue into public view.
Filed from public reporting:
- heise online — "AliExpress trackt Nutzer via unhörbarem Audio-Fingerprinting"
- heise online — "Browser-Tracking per Web-Audio: Das verborgene Tonstudio"
- TechSpot — "AliExpress was silently running audio in your browser to fingerprint and track your device"
- The Register — "AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones"
- gHacks — "AliExpress Ran Silent Browser Audio to Fingerprint and Track Devices"
- Malwarebytes — "AliExpress caught using silent audio to fingerprint visitors' browsers"
- Cybernews — "Alibaba's AliExpress leverages user audio systems for fingerprinting"
- PPC Land — "Hidden AliExpress audio tracking"
- noyb — "How TikTok, AliExpress & WeChat ignore your GDPR rights"
- European Commission — "Commission fines AliExpress €550 million for breaching the Digital Services Act"
- The Register — "Europe slams online tat bazaar AliExpress for dodging obligation to stop dodgy traders"
