Chinese e-commerce giant AliExpress has been caught using an advanced technique to fingerprint visitors, exploiting the WebAudio API to measure inaudible sounds sent directly to their browsers. The method, discovered by researcher Matthew Callaghan, impeded his ability to use Bluetooth headphones as he navigated the site.

The researcher stumbled upon this tracking mechanism after noticing that audio from his phone stopped playing over multipoint headphones whenever the AliExpress homepage was loaded. By setting the headphones to play sounds only when not connected to a PC, Callaghan found that each time he accessed the site, the phone audio would unexpectedly stop, revealing an underlying script that analyzed browser responses.

The technique works by rendering a graph that measures Sawtooth waves from WebAudio readings. These waves are generated as known waveforms and then measured after passing through the browser’s audio implementation to extract frequency data. The scripts set the gain to zero to prevent audible output, but the site continues to process and send this information back to AliExpress.

This method of tracking is particularly sneaky because it operates inaudibly, allowing the company to gather detailed user data without alerting them. It underscores the ongoing arms race between privacy-conscious users and tech-savvy marketers.