Alibaba’s AliExpress e-commerce platform ran hidden Web Audio processes on its homepage to fingerprint users’ devices. Privacy-focused browser Brave disclosed the practice on August 22 in a thread on X. The method played a silent sound and measured how individual devices processed it, creating a persistent digital identifier that did not rely on cookies.
How the Tracking Came to Light
A developer noticed that multipoint Bluetooth headphones failed to switch audio properly from a computer to a phone while an AliExpress tab stayed open. Closing the tab restored normal behavior. Investigation showed that two obfuscated Alibaba anti-fraud scripts—collina.js and fireyejs.js—kept the computer’s audio pipeline active at zero volume. The finding first appeared in a blog post around August 20 and later surfaced in discussion on Hacker News.
Brave stated on X: “Alibaba’s AliExpress was caught using users’ audio systems to track them.” The company added that AliExpress was not recording users. Instead it played a silent sound and measured how each device processed the signal in order to fingerprint it.
How the Audio Fingerprinting Technique Operates
The scripts used the Web Audio API to build audio processing graphs connected to the system audio destination at zero volume. No audible sound played, and browser mute controls had no effect. Small variations in how different CPUs, sound cards, and browsers handle identical audio signals produce measurable differences that can distinguish one device from another. The resulting data was combined with canvas rendering, WebGL, hardware details, and other signals before being sent to Alibaba servers.
Because the silent audio path remained active at the operating system level, it blocked Bluetooth headphones from cleanly switching connections. That side effect triggered the original discovery.
Protections Against Audio Fingerprinting
Brave has protected users against audio fingerprinting for more than six years. It injects random data into browser outputs so that different sites see different fingerprints, which reset across sessions. The browser also blocks the specific scripts AliExpress used. Firefox blocks WebAudio fingerprinting through its own anti-fingerprinting technology.
Large e-commerce platforms commonly rely on device fingerprinting for fraud detection and bot prevention. Users of other browsers can block the identified scripts with content blockers such as uBlock Origin, though doing so may affect site functionality.
EU Rules on Fingerprinting
Under EU law, fingerprinting falls within the scope of the ePrivacy Directive’s rules on terminal equipment access. The European Data Protection Board reaffirmed that position in guidelines adopted in October 2024.