The AliExpress platform has found itself at the center of a technical investigation into the covert collection of data about users' devices. According to information reported by TechSpot, the site appears to use an audio tracking mechanism that allows it to gather unique device characteristics directly through the browser. To do this, audio processes are launched that operate without any audible sound signal, and the data obtained may be combined with other parameters to form a persistent digital fingerprint of the device. The investigation began with an everyday glitch that a developer noticed while working with the site.
How a Headphone Glitch Exposed the Hidden Tracker
The trigger for the investigation was a problem with Bluetooth headphones: with the AliExpress tab open, the devices could not correctly switch from the computer to the smartphone, whereas after closing the page the issue disappeared. After analyzing the site's source code, the developer found that the site uses the Web Audio API to create so-called audio graphs operating at zero volume. The user hears no sound, but the browser continues to process the audio signal and connects to the computer's system audio subsystem — which, according to experts, is exactly what affected the Bluetooth headphones.
The Mechanism: Invisible Sound and a Digital Fingerprint
The detected activity is not related to ordinary multimedia playback. Because the audio graph operated at a zero gain level and was connected directly to the system audio output, simply muting the tab was not enough to stop signal processing. The same mechanism, experts note, can be used for audio fingerprinting — a technology that identifies a device based on small differences in how the same audio signal is processed. The result is influenced by the processor, audio hardware, operating system, browser, and drivers, and the combination of these characteristics can form a persistent device identifier.
Not Just Audio: The Full Set of Collected Data
The audio data, judging by the detected code, turned out to be only part of the information that AliExpress scripts may have been collecting. The list also included information related to Canvas and WebGL rendering, display settings, hardware configuration, WebRTC activity, and user actions. The combination of these parameters allows building a more detailed device profile than would be possible using any single feature alone. Fingerprinting is widely used by internet services for fraud prevention, bot detection, and assessing suspicious activity; however, the problem is that users are generally unaware of such data collection and have virtually no way to control it.
Brave's Response and Ways to Protect Yourself
The company Brave drew attention to what was happening: on August 22, it announced on the social network X that its browser, which protects users from fingerprinting by default, had detected and begun blocking AliExpress scripts responsible for audio tracking. Users of other browsers can also block such scripts using content filtering tools, such as the uBlock Origin extension; however, as TechSpot notes, this may affect the operation of certain site features. No official comment from AliExpress regarding the detected mechanism is provided in the available sources.
