AliExpress accused of using audio to fingerprint users
Chinese e-commerce platform AliExpress has reportedly been using users’ audio systems as part of a browser fingerprinting technique capable of distinguishing devices, according to an investigation by the Brave browser team, reports a Qazinform News Agency correspondent.
Brave said the technique does not involve recording users through their microphones. Instead, AliExpress allegedly uses the browser’s Web Audio API to generate an inaudible sound and measure how individual devices process it.
“Alibaba's AliExpress was caught using users' audio systems to track them,” Brave said in a post on X. “AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them.”
Researchers reportedly identified the activity in two obfuscated scripts, collina.js and fireyejs.js, loaded through Alibaba infrastructure. The scripts create audio-processing components, including an oscillator and analyzer, while setting the gain to zero so that users hear no sound.
Differences in browsers, operating systems, processors and audio hardware can affect how the signal is processed, potentially producing a distinctive digital fingerprint that can help identify a device across browsing sessions.
The activity was reportedly discovered after a user noticed that opening AliExpress interfered with multipoint Bluetooth headphones switching back to a phone. Closing the AliExpress tab restored normal operation.
Investigators also found that the scripts collected other device characteristics, including Canvas and WebGL data, hardware concurrency and WebRTC information.
The findings do not suggest that AliExpress was secretly listening to users or recording conversations, but raise concerns over device fingerprinting performed without users being aware of the process.
Earlier in July, Qazinform News Agency reported that the European Commission had fined AliExpress €550 million for failing to properly assess and mitigate risks related to the sale of illegal, unsafe and counterfeit products on its platform.
