SINGAPORE, 26 AUG 2026 — AliExpress has been running a silent audio routine in visitors' browsers that measures how each device processes a fixed waveform, producing an identifier that works without cookies. Researchers and the browser maker Brave identified the scripts, and Brave now blocks them.
A great deal of the coverage has called this ultrasonic tracking. It is not, and the difference is worth getting right, because a genuinely nastier technique goes by that name.
What the script actually does
The routine builds a small processing graph using the browser's Web Audio API: an oscillator producing a fixed waveform, an analyser node reading the result, and a gain stage set to zero.
The audio is then processed and the resulting numbers are examined. Those numbers are not identical from one machine to the next. Tiny, consistent variations from the browser, the operating system, the processor's floating-point behaviour, the audio hardware and its drivers combine into a signature stable enough on a given device to act as part of an identifier.
Nothing is played. The gain is zero, and the entire exercise happens as arithmetic inside the browser.
It is not ultrasound, and that matters
Ultrasonic tracking is a real and separate thing. In that technique a device emits a high-frequency tone through its speaker which another nearby device picks up through its microphone, letting an advertiser link a phone to a television, or one person's devices to another's, by physical proximity. It requires a speaker, a microphone and two devices in the same room.
What AliExpress did requires none of those. No sound leaves the machine, no microphone is involved, and no second device is linked. It is a measurement of how one browser performs a computation.
The conflation is wrong in two directions. It makes this incident — a familiar type of fingerprinting — sound like covert acoustic surveillance. It also debases the term for genuine cross-device audio beaconing, leaving no accurate word for that when it appears.
The glitch that gave it away
The discovery has a satisfyingly physical explanation. A developer noticed their Bluetooth headphones behaving oddly on the site.
Although the gain is zero, the processing graph stays connected to the system's audio output. To the operating system that looks like a page holding an active audio route open, and a machine with Bluetooth headphones responds accordingly, keeping the connection alive or switching audio profile in the way it would for a video about to play.
So a technique designed to be inaudible was betrayed by an audible consequence of staying attached to the speakers. It is the only part of this that leaves the browser, and it is what got the script found.
Why muting the tab does not help
The instinct on hearing that a site is doing something with audio is to mute it. That does nothing here.
Muting a tab silences output. The fingerprint comes not from the output but from the numbers generated during processing, which are read from the analyser node inside the page. Silencing the speakers removes a sound that was never audible and leaves the measurement untouched.
The same is true of turning the volume down, unplugging headphones, or using a device with no speakers at all. The computation does not need any of them.
Audio is one signal among several
Taken alone, an audio fingerprint is not especially identifying. Many machines of the same model with the same browser version produce similar results, so it narrows a population rather than naming a person.
The value comes from combination. The reporting describes the audio measurement being paired with canvas rendering, WebGL characteristics, display settings, hardware configuration and WebRTC data. Each signal is weakly identifying on its own, but together they form a stable signature that persists across sessions without anything being stored on the device.
That last property is the point of the whole exercise. A cookie can be deleted, blocked or expired, and consent frameworks are built around the assumption that the identifier lives in storage the user controls. A fingerprint assembled at page load lives nowhere. There is nothing to clear.
The use nobody mentions is fraud
Device fingerprinting has a legitimate application that gets left out of coverage like this, and leaving it out makes the practice look more straightforwardly sinister than it is.
Every large marketplace runs continuous fraud detection, and device identity is central to it. Fingerprints are how a platform notices that four hundred new accounts were opened from one machine, that a login is arriving from a device never associated with the account, or that a refund abuser who was banned last week is back with fresh credentials. That work protects sellers and buyers, and a marketplace that stopped doing it would be overrun.
Which is precisely why this is difficult rather than obvious. The same measurement supports anti-fraud and behavioural advertising, and from the outside they are indistinguishable — the script looks the same either way, and only the operator knows where the identifier is sent afterwards.
A user cannot know, but a regulator could ask, what the resulting identifier is joined to and how long it is kept. The fact of the fingerprinting matters less than its use. AliExpress has said nothing about either, and until it does, a reader has no basis for assuming the benign reading over the other one.
Where this sits legally
Under the European regime, storing or reading information on a user's device generally requires consent, and regulators have taken the view that fingerprinting falls within that requirement even though nothing is written to disk. Singapore's Personal Data Protection Act and the region's other frameworks approach it through the definition of personal data and the consent obligations attached to collecting it.
Whether any of that has been breached here is not something this report can determine, and no regulator has published a finding. What can be said is that the technique is specifically designed to sit outside the storage-based controls those frameworks were built around, and that a user declining cookies would have no reason to expect it.
Neither AliExpress nor Alibaba has commented publicly on the scripts.
What a reader can actually do
The defences are unglamorous and partial, and it is better to say so than to offer a checklist that implies the problem is solved.
A browser that blocks the scripts is the most effective step, and Brave does this specifically. Content blockers help where the script is on a list. Keeping a browser current matters because fingerprinting surfaces are narrowed by vendors over time, which is a slow arms race rather than a fix.
The most useful habit is separation. Doing your shopping in a browser profile that is not signed into anything else limits what a persistent identifier can be joined to. That link is what turns a device fingerprint into a profile of a person. The fingerprint still forms; it just has less to attach itself to.
The broader point for anyone reading this in the region is that consent banners are answering a question that this technique does not ask. The same architecture appeared when an assistant plugin requested full disk access to read a user's messages: the disclosure regime addresses a mechanism, and the mechanism moved.
View author profile → · Editorial policy
