Alibaba’s AliExpress caught tracking user audio systems

A developer using Bluetooth headphones has accidentally exposed a sophisticated fingerprinting technique that AliExpress, a massive online retailing platform owned by Alibaba, uses to track users.

The developer, “laserphile,” wrote on their blog that they recently ran into some weird issues with their Bluetooth headphones.

They couldn’t play music via their phone when, at the same time, the AliExpress website was open on their PC.

The headphones, laserphile explained, support multipoint Bluetooth audio so they can be connected to the PC and phone at the same time, for instance, playing music on the phone and announcing notifications through the PC.

“Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately,” the developer said in the blog post.

“Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate.”

It turns out that Alibaba has been secretly leveraging AliExpress users’ audio systems to track them and build detailed fingerprints of them.

Fingerprinting is a way for websites to identify users without cookies – it’s widely used, if secretly. But in this case, the technique is unique.

Users aren’t being recorded: AliExpress plays a silent sound and measures how users’ devices process it to fingerprint them.

Laserphile found this out after inspecting the website’s hidden code and discovering background scripts holding his computer’s audio pipeline wide open.

The AliExpress site was using the browser’s WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices – without user knowledge or consent.

The secret audio path froze the developer’s Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background.

The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba’s telemetry servers.

“Audio fingerprinting works because small differences in browser versions, operating systems, audio libraries, and hardware can produce slightly different results from the same generated signal,” says laserphile.

“It is not necessarily enough to uniquely identify a device by itself, but it becomes much more useful when combined with canvas, WebGL, hardware, timing, and interaction data.”

Alibaba and its AliExpress platform may have plenty of reasons to apply this sort of sophisticated fingerprinting to their users.

They need to deal with fake accounts, fraud, and coupon abuse – but they can also use large datasets of user behavior to better market products and services.

“But personally, I do not want a shopping homepage silently exercising my graphics, audio, WebRTC, hardware, and motion APIs, etc, to track my behaviors, especially if it has such an annoying effect as blocking my music. Perhaps if AliExpress wasn’t blocking my music, I never would’ve looked into what the site was doing,” said laserphile.

What now seems to be the only reliable and straightforward way to stop audio fingerprinting is using privacy-centric browsers like Firefox or Brave.

Brave, for instance, injects random data into the browser's output so you show a different fingerprint to different sites. In this case, Brave has also blocked the scripts AliExpress uses for tracking.