AliExpress Web Audio Code May Be Tracking Your Device Without Sound

What the investigation revealed

A software engineer noticed a strange delay when using Bluetooth headphones on a popular online marketplace. The delay disappeared after disabling the site's audio features. Further debugging exposed a hidden JavaScript module that creates a silent Web Audio context the moment a page loads. The code runs even if the user never clicks a video or audio element.

The researcher shared the findings on a public forum, sparking a discussion about whether the script is a legitimate performance tool or an attempt to collect a unique device fingerprint.

How Web Audio can be used for fingerprinting

The Web Audio API gives scripts low‑level access to a device's audio hardware. By generating a short sound wave and analysing the output, a script can infer characteristics such as sample rate, channel count, latency and even the shape of the speaker or headphone drivers. Those parameters differ from one device to another, creating a reliable identifier.

Because the API works without user interaction, a page can gather the data silently. When combined with other signals – screen size, font list, canvas rendering – the result is a highly accurate fingerprint that persists across sessions.

Typical fingerprinting workflow

1. Create an AudioContext object.
2. Generate an oscillator node that produces a tone.
3. Route the tone through a script processor node.
4. Read back the processed buffer and measure timing anomalies.
5. Combine the measurements with other browser data.

Each step can be performed in a few milliseconds, making it difficult for users to notice any performance impact.

Technical details of the hidden script

The script discovered on AliExpress is minified but follows a recognizable pattern. It creates an AudioContext as soon as the DOM is ready, then connects an oscillator to a AnalyserNode. The oscillator is set to a frequency of 440 Hz – the standard pitch for musical tuning – but the output is never sent to the speakers. Instead, the analyser reads the frequency spectrum and extracts the following values:

• Sample rate reported by the audio hardware.
• Latency measured from oscillator start to analyser read.
• Channel count detected by the context.
• Precision of the floating‑point buffer.

These numbers are packed into a JSON object and transmitted to an endpoint on the same domain. The request includes a random identifier that matches the session cookie, allowing the server to link the audio fingerprint with the user's browsing history.

Potential privacy implications

If the data is used for tracking, it could bypass traditional privacy tools that block cookies or limit third‑party scripts. Audio fingerprinting does not rely on storage, so clearing cookies or using private browsing mode would not erase the identifier.

Regulators in the European Union consider fingerprinting a form of personal data under the General Data Protection Regulation. The practice may require explicit consent, which is not evident on the AliExpress checkout pages.

Security researchers have warned that combining audio fingerprints with location data, purchase history and device identifiers could enable highly targeted advertising or even surveillance.

Data points that can be inferred

• Operating system version based on audio driver signatures.
• Hardware brand when certain latency patterns match known models.
• Presence of Bluetooth headphones if the latency matches wireless profiles.
• Potential user preferences for audio quality.

How users can protect themselves

There are several practical steps to reduce exposure to silent audio fingerprinting.

1. Use a browser extension that blocks the Web Audio API on unknown sites. Extensions such as uBlock Origin offer custom filters for this purpose.
2. Enable the built‑in “Do Not Track” setting, which signals a preference to opt out of profiling.
3. Browse with a privacy‑focused browser that isolates audio contexts per tab, for example Brave.
4. Turn off autoplay for media in the browser settings. While the script does not rely on user‑initiated playback, disabling autoplay reduces the chance that audio hardware is activated.
5. Consider using a virtual machine or a separate profile for shopping activities, limiting the amount of persistent data that can be linked.

Industry response and next steps

AliExpress has not issued an official statement regarding the hidden audio code. In similar cases, major e‑commerce platforms have either updated their privacy policies or removed the offending scripts after public scrutiny.

Privacy watchdogs such as Privacy International have called for clearer disclosure of any audio‑based tracking. The European Data Protection Board is expected to review the practice under GDPR guidelines.

Developers interested in the technical side can consult the MDN Web Docs on the Web Audio API for a deeper understanding of how the API works and how it can be sandboxed.

Meanwhile, standards bodies like the W3C Web Audio specification are discussing optional permission prompts for silent audio contexts. If adopted, browsers may ask users before any audio processing occurs, even without audible output.

For consumers, staying informed about the hidden ways websites can profile users remains the most effective defense. Regularly reviewing browser permissions, using reputable privacy extensions and keeping software up to date can mitigate many of the risks associated with silent fingerprinting techniques.