A developer’s Bluetooth headphones exposed a silent browser fingerprinting system on AliExpress that used Web Audio processing to help identify devices without cookies. The site was not reported to be recording conversations, but the discovery shows how invisible tracking can move through ordinary computer features users never think to police.
NEW YORK | Filed at 5:05 p.m. ET
The AliExpress privacy story began with a pair of headphones acting strangely.
A developer, Matthew Callaghan, was using multipoint Bluetooth headphones that could switch audio between a phone and a computer. The setup was ordinary enough. When the computer produced sound, the headphones would focus on the computer. When the computer stayed quiet, the phone should play through them instead. Then AliExpress entered the picture.
Each time Callaghan opened the AliExpress homepage, his phone audio stopped. No video was playing. No song was playing. No visible media player was active. The browser did not behave as if the user had intentionally started audio. But the headphones acted as though the computer had taken control of the sound path. When he closed the AliExpress tab, the phone audio returned.
That small failure became a public window into one of the internet’s most uncomfortable truths: a website does not need to ask for a microphone to use a person’s audio system as part of a tracking operation.
The reporting and technical analysis that followed showed that AliExpress, the Alibaba owned global shopping platform, was running hidden Web Audio processes that could help fingerprint visitors’ devices. The technique did not appear to record people talking. It did not require microphone permission. It did not mean AliExpress was listening to conversations in the room. Instead, the site generated or processed silent audio signals inside the browser and measured how the user’s device, browser, operating system and hardware handled that processing. The user heard nothing. The browser still did the work.
That distinction is important because the public reaction to the story can easily go in two wrong directions. One mistake is to assume AliExpress was secretly recording private speech. The current public reporting does not show that. The other mistake is to dismiss the finding because there was no microphone recording. That would also be wrong. Tracking does not need to be audible or verbal to be invasive.
Browser fingerprinting works by collecting many small details about a device and combining them into a signature. Screen size, graphics rendering, installed fonts, browser behavior, hardware capacity, audio processing quirks and other signals can become a way to recognize a returning user even when cookies are deleted or blocked. A single detail may not identify a person. A bundle of details can become powerful. The Web Audio piece is one more signal in that bundle.
Here is the simplified version. The site runs an audio processing graph inside the browser. It produces a known signal, sets the gain to zero so the user cannot hear it, then measures the output after the signal passes through the device’s audio and browser processing stack. Different systems may handle the same calculation in slightly different ways. Those differences can produce a fingerprinting clue.
In older versions of browsers and operating systems, those differences could be more useful for identifying devices. Browser makers have spent years trying to reduce that kind of entropy. Firefox introduced protections beginning with version 118 in 2023. Brave says it has long defended against audio fingerprinting by adding randomization to outputs so that sites do not receive a stable identifier. Chrome and Safari are also believed to limit the usefulness of this specific audio method through their own implementation choices. But the AliExpress case still matters because the code ran at all.
The user did not click a play button. The site did not need to show a media indicator in a way a normal person would recognize. Muting a tab might not stop the processing, because the work occurred inside the Web Audio graph rather than through a conventional song or video player. In Callaghan’s case, the only reason anyone noticed was that the hidden process interfered with Bluetooth audio switching.
That is the privacy problem in one sentence: the tracking became visible only because it broke something. That should make regulators, browser makers and consumers uneasy.
AliExpress can argue, or may argue if it responds publicly, that this type of signal belongs to anti fraud or anti bot technology. Online marketplaces face real abuse. They fight stolen accounts, payment fraud, automated scraping, fake reviews, coupon abuse, credential stuffing, scam listings and high speed bot activity. Device fingerprinting can help platforms detect suspicious behavior when ordinary cookies are cleared or accounts are recycled. A retailer with millions of users and sellers has legitimate security reasons to distinguish human shoppers from automated attackers. But legitimate security goals do not erase consent concerns.
Consumers shopping for phone chargers, shoes, home goods or beauty tools do not expect the website to quietly activate audio processing in the background for identification. They do not expect their headphones to reveal a tracking system. They do not understand that a sound feature built for games, music tools and web apps can be used as a sensor. Most users are trained to look for cookie banners, microphone prompts and location requests. They are not trained to inspect Web Audio contexts. That asymmetry is the real scandal.
AliExpress and other major platforms understand the browser at a technical depth ordinary consumers do not. They can use APIs in ways that are legal at the software level but invisible at the human level. The browser allows the call. The user sees no meaningful prompt. The company gets another telemetry signal. Everyone can say the system functioned as designed, while the person being tracked never had a practical choice.
This is how privacy erodes now. Not only through dramatic breaches, but through quiet features that become surveillance inputs.
The AliExpress finding also arrives at a difficult moment for Alibaba’s global e-commerce business. In July, the U.S. Justice Department said Alibaba Group and its U.S. based payment processor had agreed to pay $600 million to resolve allegations that they failed to prevent merchants from selling illegal pharmaceuticals, controlled substances, listed chemicals and pill press equipment through Alibaba.com and AliExpress.com. The European Union also fined AliExpress $629 million under the Digital Services Act over alleged failures to tackle illegal, unsafe and counterfeit products on its platform. AliExpress said it would appeal the EU fine and has argued that regulators failed to recognize its compliance efforts.
Those matters are different from audio fingerprinting. They involve product safety and illegal goods, not browser privacy. But together they create a broader trust crisis for one of the world’s biggest online marketplaces.
Trust is not category specific. A platform accused of failing to stop illegal goods, fined over unsafe products and then caught running silent tracking code faces a harder job convincing users that it handles risk responsibly. The public does not separate trust into neat compliance departments. Consumers ask a simpler question: can this company be trusted when no one is watching? That is the question AliExpress now has to answer.
To be fair, the technical facts do not prove every worst case scenario. Public analysis cannot establish from the outside exactly how AliExpress used the audio signal after collection, how long it retained it, whether it tied it to accounts, whether it used it only for fraud scoring or whether it combined it with broader advertising or behavioral profiles. Some of the reporting suggests the audio signal was part of a larger anti abuse stack tied to Alibaba infrastructure. That context matters. But uncertainty is not exoneration. It is exactly why transparency is needed.
AliExpress should explain what scripts were running, why Web Audio was used, what data were collected, where they were sent, how long they were retained, whether the information was tied to user accounts, whether it was shared across Alibaba properties and whether users in Europe, the United States and other regions received legally adequate notice. The company should also say whether it has removed or modified the code. A serious answer cannot be limited to “fraud prevention.”
Fraud prevention is a purpose, not a blank check. Companies still need proportionality, notice and controls. If a platform can quietly use an audio system for fingerprinting in the name of fraud prevention, it can use other obscure system signals the same way. That is the slippery part. The more sites normalize invisible device probing, the less privacy law based on notice and consent makes sense. The browser makers are now part of the story.
The Web Audio API is useful. It powers music creation tools, audio visualizers, web games, accessibility features, voice effects and rich browser based applications. It should not be crippled because one company used it in a creepy way. But browsers need stronger signals, permissions or mitigations when pages create persistent or destination connected audio graphs that are silent to the user. A site that activates the audio path without user visible media creates a trust problem, even if no sound is heard.
At minimum, users should not need a debugging script to learn that a shopping website has grabbed the audio stack.
The technical defenses are improving. Brave says its protections neutralize this kind of fingerprinting by default. Firefox has taken steps to reduce Web Audio fingerprinting usefulness. Content blockers can sometimes stop known scripts, although blocking security and anti bot scripts can break parts of a retail site. Users can shop in a separate browser profile, keep browsers updated, use privacy focused browsers, disable unnecessary permissions, and avoid staying signed in across unrelated services while browsing high tracking websites.
Those steps help. They are not a complete solution. Consumer privacy should not depend on every shopper knowing how browser audio graphs work.
Regulators need to ask harder questions about fingerprinting because cookie rules no longer capture the full tracking economy. Many privacy laws and consent banners were built around stored identifiers, cookies and obvious categories of personal data. Fingerprinting is different. It often gathers small technical signals that may seem harmless individually, then combines them into a persistent identity layer. It can survive cookie deletion. It can operate without a login. It can happen before a user has meaningfully consented. That makes it especially difficult for consent systems.
A cookie banner that asks whether a user accepts tracking is meaningless if a site already fingerprints the device before consent, or if users are never clearly told that browser audio processing, graphics rendering and hardware details are part of the data collection. The European Union’s privacy regime is likely to scrutinize such behavior more aggressively than many other jurisdictions, but even there, enforcement often trails technical practice. The United States remains more fragmented.
A shopper in California may have rights under state privacy laws. A shopper elsewhere may have fewer clear protections. Federal privacy legislation remains stalled. The Federal Trade Commission can challenge deceptive or unfair practices, but case by case enforcement cannot keep pace with every hidden browser technique. The result is a privacy landscape where the most sophisticated platforms can move faster than rules written for an earlier internet. The AliExpress case should become a teaching moment.
It shows that privacy harms are no longer limited to forms, cookies, location prompts or app permissions. They can emerge from the physics of a sound system, the math of a browser engine, the quirks of a graphics card, or the timing of a device event. Every capability exposed to a web page can become a measurement. Every measurement can become a signal. Every signal can become part of a profile. That is the modern web’s bargain, and most users never knowingly accepted it.
For AliExpress, the immediate damage may be reputational. Privacy focused users will avoid the site or use hardened browsers. Cybersecurity publications will keep the story alive. Regulators may ask questions. Browser developers may strengthen defenses. But the larger impact may be on the idea that online retail tracking has become too opaque for ordinary consent to mean anything.
A shopping site should not feel like a lab instrument pointed at the customer’s machine.
AliExpress was not reported to be recording people’s conversations. That fact should be stated plainly to prevent panic. But the absence of microphone recording does not make the behavior acceptable. The company still used a hidden audio process to measure a device in a way most users would not understand and could not meaningfully approve.
The internet has trained people to watch for the camera light, the microphone prompt and the location pop up. This story shows the next tracking fight is harder. The signal may be silent. The fingerprint may be invisible. The only warning may be your headphones suddenly going quiet.
Reporting and sourcing transparency note: This article is based on current public reporting and technical analysis from Ars Technica, Malwarebytes, InfoQ, Brave Community discussions, The Register, Tom’s Hardware, Reuters, the U.S. Department of Justice and European Union regulatory reporting.
Privacy and cybersecurity information note: This article is for news and public information only.