As cookies become less reliable for online tracking, AliExpress appears to be using another method to identify devices. A developer found code on the site’s homepage that performs silent audio processing in the browser. The scripts are connected to Alibaba’s security systems and use the device’s audio hardware to generate and analyze a signal, creating a device-specific fingerprint that doesn’t depend on cookies. The activity is largely invisible to users.
The issue was first noticed when multipoint Bluetooth headphones couldn’t switch properly between devices when an AliExpress tab remained open. After closing the tab, the headphones worked as expected again.
After examining the site’s code, the developer found that it was using the Web Audio API to create audio-processing chains with the volume set to zero. While the process produced no audible output, it kept a connection to the system’s audio hardware in the background, which appears to have disrupted the headphones’ ability to switch between devices.
This behavior was different from typical audio activity generated by a media player. Since the processing graph operated at zero gain and remained connected to the system’s audio output, muting the browser tab had no effect. The browser continued handling the audio process despite producing no audible sound.
The same technology can also be used for browser fingerprinting, a method that gathers unique device characteristics to identify users over time. In this case, the scripts analyzed small variations in how each device processed the same audio signal, differences influenced by factors such as the processor, audio hardware, operating system, browser, and drivers.
Audio analysis was just one component of the reported data collection. The scripts also gathered details from canvas rendering, WebGL, display settings, hardware configuration, WebRTC activity, and user interactions. Combined, these signals could create a more complete device profile than any single data point could reveal on its own.
Online platforms commonly use fingerprinting to support fraud prevention, bot detection, and risk evaluation. By analyzing device characteristics, companies can identify suspicious behavior even after cookies are deleted or account information changes. Privacy groups have raised concerns because this type of tracking can happen without clear user awareness or control.
Brave was among the first to report on the activity. The company writes on an X post that its browser blocks the AliExpress scripts involved in audio fingerprinting and has provided built-in protections against this type of tracking for more than six years. These protections modify certain browser outputs, preventing websites from receiving a consistent device identifier.
Brave has also added protections against GPU fingerprinting, which looks at graphics hardware and driver details to identify a device. The company expects these tracking techniques to keep changing as websites find new ways to recognize users.
Users of other browsers may be able to block these scripts with content-blocking tools such as uBlock Origin. However, doing so may affect AliExpress functions that rely on the same scripts for security measures or fraud detection.
The situation shows the difficult balance behind online security today. Companies want better tools to spot fraud and suspicious activity, but users and browser makers want more control over tracking methods that work quietly in the background.
Maybe you would like other interesting articles?