Chinese retailer AliExpress is running an outdated audio fingerprinting technique on its homepage that no longer works—but continues to use it anyway, alongside over a dozen other tracking methods, according to researcher Matthew Callaghan.
Callaghan discovered the stealthy tracking when it interfered with his multipoint Bluetooth headphones. Each time he loaded AliExpress on his PC, audio from his phone stopped playing. The audio resumed once he closed the browser tab, prompting him to investigate.
His analysis uncovered two obfuscated scripts that work together to fingerprint visitors. The system generates a known audio waveform through an oscillator, measures it after it passes through the browser's audio implementation, and reads frequency data to create a unique device signature. The scripts set audio gain to zero, making the sounds inaudible, but the browser continues processing the data and transmits it back to AliExpress.
Early versions of audio soundprinting exploited variability in math libraries across browsers, CPUs, and system components to generate unique fingerprints. Browser makers have since patched this vulnerability. Firefox introduced its own math libraries starting with version 118 in 2023, reducing the entropy enough to render the technique ineffective. Google confirmed Chrome is immune because it ships with its own libraries. Safari likely offers the same protection.
Despite being rendered obsolete, AliExpress continues deploying the audio method as part of a broader data collection infrastructure. Callaghan identified over a dozen concurrent fingerprinting techniques including Canvas API, WebGL, font rendering, hardware concurrency, device memory, battery status, screen dimensions, browser plugins and installed fonts.
The persistence of dead tracking code alongside active methods suggests legacy components embedded in a comprehensive surveillance system. While individual techniques may become ineffective, the sheer volume of redundant methods reflects a business model built on collecting identity signals regardless of their current efficacy. The economics reward breadth over precision—if one method fails, a dozen others remain available.
