A major shopping site appears to have run silent audio through visitors’ browsers and used the results to help identify devices across visits.
Ars Technica reported the finding, saying AliExpress was sending inaudible sounds into the browser and processing the returned signal to extract distinguishing signals. Privacy-focused browser vendors and outlets also flagged the same behaviour, describing scripts that create and analyse Web Audio graphs while leaving output effectively silent hidden Web Audio processes and that operate as a way to build device fingerprints.
The technique is not about recording your microphone. Instead, it relies on tiny differences in how hardware and software handle audio processing, a way to produce a persistent identifier that can survive cookie clearing or muted tabs. Researchers who examined the code described obfuscated scripts that set audio gain to zero but still processed the signal, and combined that audio-derived data with other fingerprinting signals such as screen and device characteristics and interaction patterns.
Fingerprinting methods like this can be harder for typical users to shrug off; standard privacy steps such as deleting cookies or muting tabs do not stop a site from running an in‑browser signal-processing routine. Privacy browsers and some mainstream browsers have built defences against audio-based fingerprinting over recent years, which is why the disclosures came from privacy-oriented researchers and browser vendors who inspect and block such behaviour.
For most shoppers the practical change is unchanged: the technical arms race between trackers and browsers continues, and the most reliable protection remains browser-level defences and privacy tooling rather than ad hoc user actions.
