AliExpress Caught Creating Unique Audio Fingerprints of Your Devices

AliExpress has implemented a hidden digital tracking technology that even affects Bluetooth headphones. If you have noticed that your Multi-point headset stops switching correctly between devices while a marketplace tab is open, this is a direct result of the site’s algorithms in action.

AliExpress Tracking Exposed

The issue was discovered by developer Matt Callaghan. He noticed that when opening AliExpress, the computer forcibly “captures” the headphone audio channel, even if no content is playing on the page. This occurs via the Web Audio API. The activity is driven by two hidden scripts: collina.js and fireyejs.js. Officially, they are stated to be security and fraud prevention tools, but in practice, they collect technical user data.

How Audio Fingerprinting Works

The process runs without the device owner’s knowledge as follows:

• Scripts activate the AudioContext and launch an oscillator inaudible to the human ear.
• The signal passes through the browser’s audio system.
• An analyzer reads unique frequency characteristics resulting from the specific hardware, drivers, and OS settings.

This is how an audio fingerprint is generated. Since no two audio processing systems are identical, AliExpress obtains a high-precision device identifier, allowing the platform to track users without using traditional cookies.

The Scale of Data Collection

Analysis revealed that identification is not limited to audio alone. The site gathers comprehensive information about the browser and computer:

• Screen resolution and WebGL characteristics.
• RAM capacity.
• Installed extensions and plugins.
• List of supported video formats.
• Behavioral metrics (mouse movements).

This data is sent to Alibaba servers using fetch() or sendBeacon() functions.

How to Protect Yourself

Modern browsers have already anticipated this threat. For instance, Firefox introduced anti-fingerprinting protections back in version 118. The Brave browser has opted for a “noise injection” strategy: it adds random adjustments to audio data during every session, making the creation of a persistent device profile impossible.

The use of audio fingerprints demonstrates how sophisticated modern digital tracking methods have become. While these technologies can officially be used to fight fraud and abuse, they also raise concerns about data collection transparency and user privacy. In response, browser developers continue to implement security tools that make it harder to create persistent digital device profiles.