The e-commerce platform AliExpress is at the center of a controversy after a developer uncovered an unconventional tracking technique. According to the research, the website generates inaudible audio signals from the browser to identify visitors' devices, a method that has raised concerns among digital privacy experts. The finding, which has already been reported by several specialized media outlets, highlights how large platforms are seeking new ways to track users beyond traditional cookies.
It all started when developer Matt Callaghan noticed that his Bluetooth headphones would stop playing music from his phone whenever he had an AliExpress tab open on his computer. Closing the page immediately resolved the issue. Intrigued, Callaghan decided to analyze the website's code and discovered that the platform kept an audio processing system running in the background, even when no media was being played. He documented his findings on his personal blog, and they quickly became a topic of discussion within the tech community.
This is how the audio fingerprint used by AliExpress works
The technique used by AliExpress is based on browser Web Audio technology. The scripts responsible, identified as collina.js and fireyejs.js, create an oscillator that generates a sawtooth sound wave. This signal is sent through an AnalyserNode and a ScriptProcessorNode before reaching a GainNode set to zero volume. In this way, the sound is completely inaudible to the user, but the browser actively processes it at all times.
The goal of this process is to measure the subtle differences in signal processing that occur depending on the device. Each computer, operating system, browser, or audio library processes the waveform slightly differently, and these variations become a kind of unique fingerprint. This technique, known as fingerprinting, allows a device to be recognized without relying on cookies, making it difficult for the user to avoid being identified by deleting their browsing history or conventional tracking files.
Audio isn't the only element used to build this identification. The analyzed scripts also collect information about hardware characteristics, WebGL graphics, screen resolution, available RAM, installed plugins, and even user behavior with the mouse and scroll wheel. All this data is combined and sent encrypted to the telemetry servers of Alibaba, AliExpress's parent company.
The lack of transparency, the main problem
The most worrying aspect of this finding is not so much the technique itself, but AliExpress's lack of transparency. Users receive no specific notification that a digital fingerprint of their device is being generated while they browse the web. Neither the platform nor its parent company, Alibaba, has issued an official statement explaining the use of this technology, which has drawn criticism from privacy advocates.
This type of fingerprinting can have legitimate applications, such as fraud detection, preventing fake accounts, or controlling the misuse of promotional coupons. However, the fact that it is carried out silently and without explicit consent raises serious concerns about compliance with data protection regulations, especially in the European context where the General Data Protection Regulation (GDPR) requires transparency in the processing of personal information.
The investigation also revealed that this behavior wasn't entirely new. An open ticket on Bugzilla, Mozilla's incident management system, had already documented for approximately two years that AliExpress was keeping the audio device active and preventing Windows from automatically suspending. This suggests that the practice may have been in place longer than initially thought.
Brave and Firefox have already protected themselves against this tracking.
In response to this situation, some browsers have already taken action. Brave announced that its browser specifically blocks identified AliExpress scripts and inserts random data into the audio output to hinder tracking, a measure it has implemented by default for over six years. Firefox, for its part, has neutralized this technique since version 118, released in September 2023, thanks to its own mathematical audio processing libraries that reduce the amount of useful information that can be extracted from the device to almost zero.
For users who want to strengthen their privacy, there's also the option of using extensions like uBlock Origin, adding custom filter rules for the collina.js and fireyejs.js paths under the assets.aliexpress-media.com domain. However, experts warn that there's no completely simple way to block all identification methods used online, as these techniques rely on combining numerous small technical details of the device.
The AliExpress case serves as a reminder that online tracking has evolved far beyond cookies. Companies are constantly seeking new ways to identify users, and many operate in a legal gray area. As European authorities intensify their oversight of data collection practices, consumers should be aware that their digital footprint extends far beyond what they type or buy online.
The controversy is brewing, and so far, AliExpress hasn't offered any explanation. What is clear is that online privacy remains a battleground where users have increasingly less control over their own information. Meanwhile, the experts' recommendation is clear: keep browsers updated, use tracking-blocking tools, and be aware that, on the internet, nothing is free or invisible.
