Your Device Could Be Identified Silently

smartphone screen showing a red microphone recording button — Photo: ninefotostudio / Shutterstock

A hidden audio process on AliExpress quietly profiled visitors’ devices, raising fresh alarms about covert tracking online.

Story Highlights

Researchers and a developer found AliExpress running silent Web Audio processing that can fingerprint devices.
The scripts set volume to zero while still sending audio through the system output to gather unique device traits.
The technique did not record from microphones but can help track users across sessions without cookies.
Experts say browser fingerprinting is spreading across major websites, making it harder for users to avoid tracking.

What Investigators Found On AliExpress

Researchers and the Brave browser team reported that AliExpress pages used the Web Audio feature to run sound processing in the background with volume set to zero. The code created audio chains that still reached the system output. That setup can measure tiny differences in how each device handles sound. Those differences can serve as a digital fingerprint that helps identify a user without cookies or pop-ups asking for consent.

Reports say the scripts drove an inaudible signal through the browser’s audio path. Developers observed “gain set to zero,” meaning users could not hear it, yet the browser continued to process the audio graph. This behavior is consistent with known audio fingerprinting methods, which rely on hardware and software quirks to mark a device. The approach does not use the microphone and does not record speech, but it can still enable tracking across visits.

How Silent Audio Fingerprinting Works

Audio fingerprinting generates a simple test tone in the browser and runs it through the device’s audio system. The site then reads the output for small changes caused by the operating system, sound card, drivers, and browser version. These shifts are too small for people to hear but clear to a computer. Combined with other signals, the result can be a stable identifier for the device, even after clearing cookies or using private mode.

Researchers have studied this method for years. Academic work shows audio fingerprints can vary and may change over time, but sites can still build reliable profiles by combining multiple readings and other data points. This makes audio a useful piece of a larger tracking puzzle. When tied to login sessions or purchase history, it can link visits and habits to a single person with high confidence.

Why This Moment Matters For Everyone Online

Digital tracking has shifted as cookie rules tighten and ad systems evolve. Groups that study privacy report that browser fingerprinting now appears on a large share of top sites. One recent survey tied to the Electronic Frontier Foundation said the practice was present on about 78 percent of the 10,000 most visited websites tested. That scale means fewer practical ways for regular users to avoid being profiled as they browse.

People across the political spectrum worry about quiet data collection and power without oversight. Many feel large platforms and government agencies set the rules while citizens carry the risk. This case highlights that fear in a simple, concrete way: a shopping page used an obscure browser feature to tag visitors without telling them. That is not how trust is built in a free society that values consent and transparency online.

What Users Can Do Right Now

Privacy-focused browsers and add-ons can block some fingerprinting vectors, including audio. Some browsers change Web Audio outputs to reduce uniqueness. Content blockers can stop third-party scripts that build hidden audio graphs. None of these steps is perfect, because sites can mix many signals to identify a device. Still, using strict privacy settings, limiting extensions you do not need, and avoiding unknown scripts can reduce exposure meaningfully.

Your "what-the-serious-fuck" moment for today:

AliExpress was caught fingerprinting shoppers with silent audio tones -inaudible frequencies embedded in pages that can identify devices by their speaker signature.

A developer discovered it only because the process kept hijacking…

— Paul Schleifer (@PaulSchleifer) August 25, 2026

Lawmakers and regulators face a hard trade-off between fraud defense and user rights. Companies say they need tools to spot bots and scams. Users want clear notice and real choice when sites collect data that can follow them around the web. Clear rules that separate narrow anti-fraud checks from broad tracking would help. Until then, cases like this will keep surfacing, and public trust will keep fraying.