AliExpress, a platform owned by Alibaba, was found running hidden audio-processing and browser-probing scripts that can fingerprint a visitor’s device. A developer discovered the behavior when his Bluetooth headphones kept switching away from music whenever he opened the shopping site, which led to a deeper look at scripts that generate inaudible audio, measure how the browser handles it, and harvest many other device characteristics. The operation combined audio, graphics, WebRTC, performance, and hardware probes to assemble a persistent fingerprint, raising privacy concerns about how a Beijing-linked service treats data on American shoppers’ machines. This piece walks through what was observed, why it matters, and how these techniques differ from simple cookie tracking.

Chinese-Owned AliExpress Caught Fingerprinting Americans’ Devices

A routine glitch set off an investigation that uncovered a broad browser and device fingerprinting effort tied to AliExpress. The developer noticed his headphones would drop audio playback on his phone every time he opened the AliExpress page on his computer, even when no audible content was present. That odd interaction pushed him to inspect the page’s JavaScript and follow the trail to hidden WebAudio code and a suite of telemetry probes.

Under the hood, two deeply obscured scripts created a silent audio oscillator and used a browser analyser to read back frequency data. The code set volume to zero so nothing was audible to the user, but the waveform still flowed through the browser’s audio stack. “The oscillator generates a known waveform. The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it.”

Those audio measurements are useful because tiny differences in hardware, drivers, operating systems, and browser implementations alter the waveform’s signature. When combined with other signals, the result can be a highly distinguishing device fingerprint. This is not microphone spying or recording; it is the page producing a signal and measuring how that signal is processed by the visitor’s machine.

The audio probe was only one element in a much larger collection of signals. The scripts also queried canvas rendering, WebGL information, screen and viewport dimensions, device memory, browser plugins, WebRTC behavior, browser timing and performance, input events, and device motion. The code included routines to encrypt and transmit the collected metrics back to telemetry endpoints, turning local quirks into remote identifiers.

That difference between cookies and fingerprints is critical. Cookies are visible and removable, but fingerprints use inherent characteristics of a machine that persist across sessions and tab states. The developer could not determine from the page code how long the data are retained, whether the fingerprints are correlated across different properties, or what downstream systems in Alibaba or its telemetry services do with the profiles once they leave a user’s device.

Browser makers have taken steps to blunt some of these techniques, but defenses are uneven. Firefox implemented protections against the specific audio-based method years ago, and Chrome’s audio stack reduces its reliability, yet modern browsers still expose a variety of APIs that can be probed. Even if one vector is mitigated, the fingerprinting suite runs multiple simultaneous checks and can still assemble identifying data from the remaining surfaces.

Blocking or filtering the offending scripts is the most reliable user-side remedy short of switching browsers. Some privacy-focused browsers and extensions can blunt or stop the probes entirely, while simply clearing cookies or using incognito mode does not prevent a site from examining a machine’s hardware and software fingerprints. The developer who found the behavior reported stopping the hidden audio by adding filter rules to his content blocker, after which the audio processes stopped appearing.

The political stakes are obvious to anyone concerned about foreign-linked platforms handling American data. Congress has previously grappled with banning or restricting apps and services over national security worries, and the discovery that a Beijing-linked platform can quietly profile devices will likely intensify those discussions. For shoppers, the immediate takeaway is that a familiar retail homepage can be probing far more of their device than they might expect.

“Personally I do not want a shopping homepage silently exercising my graphics, audio, WebRTC, hardware, and motion APIs, etc, to track my behaviours, especially if it has such an annoying effect as blocking my music.”