A developer noticed his Bluetooth headphones kept cutting out whenever he loaded AliExpress. That small, annoying glitch is what led researchers to a tracking technique most shoppers have never heard of: the site was running an inaudible audio signal through visitors’ browsers, at zero volume, purely to fingerprint their devices. No cookie was involved. No consent banner covered it. It didn’t need one, because nothing was ever recorded and nothing was ever heard, which is exactly what makes it worth understanding if you shop online regularly.
How Silent Audio Becomes a Tracking Tool
The mechanism, confirmed by researchers and the Brave browser team, works entirely inside the Web Audio API, a legitimate browser feature built for things like games and music apps, not tracking. AliExpress’s scripts generated a digital audio signal, processed it through the browser’s audio pipeline with the output volume set to zero, then measured tiny, repeatable differences in how that specific device and browser handled the signal. Different combinations of hardware, drivers, and browser versions render audio with microscopic, consistent variations, differences too small to hear but stable enough to work as an identifier, the same way a fingerprint doesn’t need to be visible to be unique. The output never reached a speaker. Nothing was recorded through a microphone. The “sound” existed only as data moving through the browser’s internal processing chain, which is precisely why it evaded the protections most people already have in place.
That distinction matters, because early reactions to this story compared it to ultrasonic beacon tracking, a real but different technique from a few years ago where near-inaudible tones were played through actual speakers and picked up by nearby microphones to link a TV ad to a phone in the same room. This is not that. It’s quieter than that, in the most literal sense: no audio ever left the device at all.
It Wasn’t Working Alone
The audio signal was one layer among several. The same scripts also pulled in canvas rendering data, WebGL output, display and hardware configuration details, and WebRTC behavior, the standard toolkit of browser fingerprinting, with an audio-based signal added to make the resulting profile more precise. Any one of those signals alone is a fairly weak identifier; a display resolution or GPU model is shared by millions of devices. Combined, they narrow down to something close to a unique device profile, persistent across visits, invisible to a user checking their cookie settings, and untouched by clearing your cache or opening a new tab.
Why a Marketplace Would Bother Building This
Browser fingerprinting solves a specific problem for large retailers: cookies are easy to block, easy to delete, and increasingly restricted by browser vendors and regulation. A fingerprint isn’t stored on your device at all; it’s derived, fresh, every time you load the page, from characteristics of the hardware and software you’re already using. That makes it far more resistant to the privacy tools people reach for by default. For a marketplace the size of AliExpress, that persistent identity serves the ordinary reasons any large retailer wants to recognize returning shoppers: fraud detection, personalized pricing or promotions, and building a profile of browsing behavior that doesn’t depend on being logged in or having accepted a cookie banner. None of that requires anything sinister to be a real privacy problem. The issue is that it happens without a mechanism for users to see it, consent to it, or opt out of it the way they can with a cookie prompt.
It’s also worth being clear about what this doesn’t prove. A single site being caught doesn’t mean audio fingerprinting is running on every marketplace in use; it means the technique exists, works, and was deployed at least once by a major retailer without disclosure, which is enough reason to treat “I checked my cookie settings” as an incomplete privacy checklist rather than assuming this specific exploit is everywhere.
Why a Random Headphone Glitch Was the Thing That Caught It
The discovery path here is worth sitting with, because it reveals something about how this category of tracking gets found at all. Nobody caught this by reading AliExpress’s privacy policy or auditing its cookie banner; a developer noticed his headphones behaving oddly, got curious, and traced it back to a script nobody was supposed to notice in the first place. That’s a fundamentally different discovery mechanism than how cookie violations usually surface, which tends to be through automated compliance scanners built specifically to look for tracking cookies. There’s no equivalent automated scanner routinely checking whether a site is quietly running the Web Audio API at zero volume, because almost nobody expected that to be a viable tracking surface until this case demonstrated it. That gap between what compliance tools check for and what’s technically possible is exactly where a technique like this can operate undetected for a long stretch before an accidental side effect gives it away.
What Protects You, and What Doesn’t
Most of the standard shopping-safety advice doesn’t touch this. Clearing cookies does nothing, since no cookie is set. Private or incognito windows don’t help either, since the fingerprint is derived from your hardware and browser configuration, not stored state. A VPN changes your IP address, which is a separate signal entirely from an audio or canvas fingerprint and does nothing to mask either one.
What does help:
- A browser with built-in fingerprinting resistance. Brave’s own reporting on this specific case noted its browser blocks these exact scripts by default, by restricting what a page can read back from the Web Audio API. Firefox’s Enhanced Tracking Protection has comparable, though not identical, fingerprinting defenses available in its strict mode.
- A dedicated browser profile for shopping. Using a separate profile, or a separate browser entirely, for marketplaces you don’t fully trust limits how much of your broader browsing history and configuration is available to be fingerprinted in the first place, and keeps a flagged shopping profile from cross-contaminating your main one.
- Content-blocking extensions built specifically for fingerprinting, not just ad-blocking. Standard ad blockers are tuned to block known ad-serving domains; fingerprinting scripts often run from the retailer’s own first-party domain, which a typical ad blocklist won’t touch. Extensions built around canvas and audio fingerprinting defenses specifically are a different category of tool from a general-purpose ad blocker.
- Keeping your browser current. Fingerprinting-resistance features, where they exist, ship as ongoing updates as researchers document new techniques like this one. An outdated browser is missing whatever countermeasures have been added since it was last updated, which matters more here than in most security contexts since this entire category of defense is reactive by nature.
Why This Is Hard to Regulate Compared to Cookies
Cookie tracking has a fairly mature regulatory response by now, disclosure requirements, consent banners, opt-out mechanisms baked into most major markets’ privacy law. Fingerprinting is harder to regulate for a structural reason: a cookie is a discrete file sitting on your device that a regulator can point to and require disclosure for. A fingerprint is a computed value, derived on the fly from ordinary browser behavior that has entirely legitimate uses elsewhere. The same Web Audio API being used here to fingerprint a shopper is the identical API a completely unrelated site might use to run a genuine audio game or music tool. That dual-use nature is exactly why this kind of tracking tends to get caught by independent researchers stumbling onto side effects, like a developer’s headphones cutting out, rather than through disclosure requirements or routine compliance audits.
The Part Worth Remembering
This site has covered how to shop online safely before, mostly in terms of payment security and scam avoidance. Audio fingerprinting is a different category of risk entirely: nothing is stolen, nothing is breached, and there’s no moment where you’d notice anything happened. That’s what makes it worth knowing about rather than something you’d only look up after the fact. There’s no error message, no odd charge, and no leaked-password notification to prompt you to go looking. The only signal, in the case that exposed this, was a random hardware side effect nobody expected to matter. Most shoppers won’t get even that much warning.