AliExpress allegedly tracks users via browser audio without cookies

AliExpress is allegedly monitoring its users through a discreet technique that could allow it to avoid relying on cookies. The entire process reportedly uses audio in your browser.

AliExpress may have found an ideal way to track you without your knowledge. The online marketplace reportedly runs audio scripts in your browser to identify your device without obtaining your consent. The matter was discovered entirely by chance by an internet user.

On 20 August, an anonymous blogger using the name mc-tech published an account of the experience on their blog. In the post, they claimed that AliExpress tracks its users through sound. The finding came about accidentally:

“I recently encountered a strange issue with my Bluetooth headset. It supports multipoint audio, allowing it to be connected to both my PC and my phone at the same time. Normally, the PC has priority for audio output, and my phone can only play sound when nothing is playing on the PC. (…) Shortly after the AliExpress homepage loads, the sound from my phone stops. Closing the AliExpress tab immediately fixes the problem. Muting the tab, Firefox or Windows makes no difference, and no video, music or other media content is playing on the page.”

This unusual bug prompted mc-tech to investigate. They first checked that no audio file was being played. They then noticed that the issue occurred only after several minutes of inactivity on an AliExpress page. After examining the webpage’s code, they eventually found two carefully concealed scripts called collina.js and fireyejs.js.

An audio method for tracking AliExpress visitors

The scripts play an inaudible audio track in visitors’ browsers. This track differs for every user because an oscillation varies according to the PC being used. Put simply, the track changes depending on your configuration, operating system, screen specifications and browser, potentially allowing AliExpress to collect data easily, even without cookies.

But why use this type of surveillance? mc-tech put forward their own theory in the article:

“AliExpress has many reasons to distinguish legitimate shoppers from automated or suspicious clients, and to monitor users’ browsing habits. The site needs to combat account takeovers, fake accounts, web scraping, automated purchases, payment fraud, review manipulation, and the abuse of coupons or new-customer promotions. In addition, like most large companies, AliExpress uses substantial volumes of data on user behaviour to optimise the marketing of its products and services. Cookies are not especially reliable for this purpose, as they can be deleted, copied or replaced.”

In any case, the practice has drawn a response from some technology companies. Brave, for example, criticised this surveillance in a post on X and said it automatically blocks Alibaba’s audio script. Whether the data collection is anonymous or not, nobody wants to be monitored without their consent.