[REVISION HISTORY]

AliExpress device fingerprinting via audio signals

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-08-25 06:07 UTC → 2026-08-26 00:58 UTC · added ~~removed~~

AliExpress, owned by the Alibaba Group, has been identified as using silent Web Audio API processes to perform device fingerprinting. This technique involves generating inaudible audio signals to measure how a user’s specific hardware, such as the CPU and sound card, processes waveforms. By analyzing these minute variations, the platform can create a unique digital signature to track devices and returning visitors without relying on traditional cookies. Reports indicate that the process is highly stealthy, utilizing audio-processing graphs set to zero volume so that the activity remains active even if a user mutes their browser tab. This has ~~also~~ been noted to interfere with hardware ~~functionality, such as causing issues with~~ functionality; for instance, one developer observed that Bluetooth ~~multipoint~~ headphones would stop playing audio ~~switching.~~ from a phone whenever the AliExpress website was open on a computer. This suggests the scripts maintain an active audio connection to the system. While the practice may serve legitimate security purposes like bot detection and fraud prevention, it has raised significant privacy concerns. In addition to audio signals, the scripts reportedly collect data regarding canvas rendering, WebGL, ~~and~~ hardware ~~configurations~~ configurations, screen dimensions, and network information to build detailed device profiles. In response to these findings, privacy-focused browsers like Brave have implemented protections to block these specific fingerprinting scripts. As of late August 2026, Alibaba has not issued an official response to these findings.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.