Can a website identify your device without playing any audible sound? A recent discovery involving AliExpress shows that, technically, it can.

A researcher noticed something unusual while visiting AliExpress: his Bluetooth headphones stopped switching properly between his computer and phone. Closing the AliExpress tab immediately fixed the problem. Further investigation revealed scripts using the browser’s Web Audio API to generate and analyze audio signals.

The signal was processed with the gain set to zero, meaning users could not hear anything. However, the browser was still performing audio calculations. Small differences in how systems process audio could then be used to create a kind of “fingerprint” of the browser or device, a technique known as browser fingerprinting.

Was AliExpress listening to users?

No. The technique did not use the microphone or record conversations. Instead, it worked with audio generated and processed inside the browser. And today, this specific fingerprinting method is much less effective: browsers such as Firefox and Chrome have introduced protections that reduce the differences that could previously be used to identify devices this way.

But there is another interesting part of the story: audio fingerprinting was only one of several tracking techniques found on the site. Other methods involved Canvas, WebGL, screen dimensions, device information and more.

Fun fact

The discovery didn't start with a privacy investigation. It started because a pair of Bluetooth headphones suddenly stopped behaving normally. A small technical glitch ended up exposing what was happening behind the scenes of a website.

What about my privacy?

Online privacy is about more than cookies. Browsers can reveal many technical characteristics about a device, and when several signals are combined, they can create a surprisingly detailed profile.

As browsers continue improving privacy protections, understanding what websites can collect simply from a visit is becoming increasingly important.