AliExpress has been caught using an outdated audio fingerprinting technique to track visitors without their knowledge. Researcher Matthew Callaghan discovered the stealthy tracking by accident when his multipoint headphones kept pausing his phone audio every time he loaded the AliExpress homepage. The site was sending inaudible sounds to browsers and measuring the unique audio signature of each device—a method that should have been neutralized years ago.
This discovery matters because it reveals a persistent gap between browser protections and the tracking industry's determination. While modern browsers like Firefox, Chrome, and Safari have largely blocked this specific technique, AliExpress's use of it—alongside more than a dozen other fingerprinting methods—shows that the arms race is far from over. For business owners, this is a wake-up call: if a major retailer is still using obsolete tracking, what are other sites doing?
What Happened: The Hidden Audio Fingerprint
AliExpress embedded two heavily obfuscated scripts that generated a graph analyzing WebAudio readings from each visitor's browser. The scripts set the gain to zero, so users heard nothing, but the browser still processed the audio and sent the data back to AliExpress. The technique exploits variations in math libraries across operating systems and CPUs to create a unique fingerprint—like a digital voiceprint for your device.
This method was once powerful, but it's now largely ineffective. Firefox fixed it in version 118 (released in 2023) by using its own constant math libraries, reducing the entropy enough to break the fingerprint. Chrome ships with its own libraries, making it resistant, and Safari is likely safe too, though Apple hasn't confirmed. So why is AliExpress still using it? The likely answer: it's a leftover from years past, and no one noticed until now.
Does This Affect Your Business?
If you run an e-commerce site or any business that tracks user behavior, this story is a cautionary tale. It shows that even major players rely on questionable tracking methods, and it highlights the risks of using outdated or invasive techniques. For most small businesses, audio fingerprinting isn't something you're likely to use—but you might be using other fingerprinting methods without realizing it. Canvas fingerprinting, WebGL rendering, and device memory checks are common in analytics tools, and they all carry privacy risks.
More importantly, this news could signal a shift in consumer and regulatory expectations. As privacy laws tighten and browsers add more protections, businesses that rely on covert tracking may face legal and reputational damage. The FTC and EU regulators are increasingly cracking down on deceptive tracking practices, and being caught could mean fines and loss of customer trust.
What This Means for Your Business
For most small and mid-sized businesses, this specific technique is not a direct threat—you're probably not using audio fingerprinting, and your customers are likely on modern browsers that block it. However, the broader lesson applies to everyone: audit your tracking methods. If you use analytics tools that collect device data, you could be inadvertently violating privacy laws or browser policies.
Start by reviewing your analytics and marketing scripts. Are you using any fingerprinting techniques? If so, consider switching to privacy-friendly alternatives like cookieless tracking or consent-based analytics. Not only will this reduce legal risk, but it can also improve customer trust—a competitive advantage in today's privacy-conscious market.
Another takeaway: this story underscores the importance of staying current with browser updates. If your customers use older browsers, they may be more vulnerable to tracking. Encourage them to update, and ensure your own team uses up-to-date browsers to protect their own data.
Bottom Line for Executives
The AliExpress case is a reminder that the tracking industry is constantly evolving, and even obsolete techniques can resurface. For your business, the key is to stay ahead of the curve by prioritizing transparency and consent. Not only is it the right thing to do, but it's also becoming a legal requirement in many jurisdictions.
In the short term, you don't need to panic about audio fingerprinting—it's unlikely to affect your bottom line. But use this as a prompt to review your data collection practices. If you're relying on any form of covert tracking, now is the time to clean house. Your customers will thank you, and so will your legal team.
FAQ
No, modern browsers block it, but it's a reminder to audit your own tracking methods for outdated or invasive practices.
Remove them immediately and switch to privacy-friendly analytics that rely on consent and first-party data.
