AliExpress runs JavaScript on its storefront that keeps your browser’s audio engine permanently active. The goal is fingerprinting — building a unique identifier for your device from the way its audio hardware renders sound. The side effect is stranger than the intent: on many phones, this constant audio activity disrupts Bluetooth multipoint, the feature that lets one pair of headphones stay connected to two devices at once.
TL;DR: AliExpress has been quietly running WebAudio fingerprinting scripts that keep the browser’s audio pipeline active, which can interfere with Bluetooth multipoint audio on phones and headphones. The technique generates a device-unique audio signature without consent, raising questions under EU privacy rules that already target covert tracking.
What Is AliExpress Doing With WebAudio in Your Browser?
AliExpress loads scripts that use the Web Audio API — a standard browser feature intended for music players, games, and audio editors — to probe the audio stack of your device. Instead of playing sound for the user, the script generates an inaudible test signal, routes it through the audio processing chain, and captures the numeric output. Because that output differs slightly on every combination of hardware, drivers, and browser build, it produces a stable identifier.
That identifier is the point. Cookies can be cleared, and browsers increasingly block third-party trackers by default. A fingerprint survives all of that, because it is derived from the device itself rather than stored on it. Nothing is visibly played, no permission prompt appears, and the browser treats the operation as ordinary JavaScript.
The problem extends beyond privacy. To compute the fingerprint, the script initializes and holds open an AudioContext, the core object of the Web Audio API. An active AudioContext signals the operating system that the page is using audio. On mobile devices, that signal has consequences for how the system manages audio sessions — and by extension, Bluetooth audio routing.
How Does WebAudio Fingerprinting Actually Work?
The mechanics are well documented in browser fingerprinting literature. A script creates an AudioContext, then builds an oscillator — a signal generator producing a simple tone at a fixed frequency. That tone feeds into a DynamicsCompressorNode, a component that alters the signal in nonlinear ways depending on its internal parameters and the platform’s floating-point behavior.
The script then reads back the processed samples using an AnalyserNode and converts them into a hash or a summed numeric value. Here is the essential part: the exact floating-point arithmetic used to compute compression varies across CPUs, audio libraries, and browser engines. Two machines running the same code get slightly different numbers. Those tiny differences, concatenated, form a fingerprint that can be stable for months.
Why not just use cookies? Because cookies are losing the arms race. Safari blocks third-party cookies outright, Firefox follows close behind, and Chrome continues to restrict them. Fingerprinting sidesteps consent dialogs entirely — there is no storage, no prompt, and no visible trace. The user never knows it happened.
That invisibility is precisely why regulators care. Under the EU’s ePrivacy framework, accessing information stored on a user’s device — which courts and regulators have interpreted to include fingerprinting techniques — generally requires consent. A silent fingerprint computed on an e-commerce page fits awkwardly, at best, with that requirement.
Why Does This Fingerprinting Break Bluetooth Multipoint Connections?
Multipoint is a Bluetooth feature that lets headphones maintain two simultaneous connections — say, a laptop and a phone — and switch between them automatically. To manage this, the headphones and the phone negotiate audio focus: when one device starts playing, the other is expected to release or pause its stream. The protocol depends on devices signaling their audio state honestly.
A lingering AudioContext muddles those signals. Because the fingerprinting script keeps an audio session open in the background, the phone’s operating system may treat the browser as continuously audio-active. Android, in particular, manages audio focus as a shared resource — when one app holds it, others get paused or routed elsewhere. A phantom audio session can therefore cause the phone to grab the Bluetooth channel, forcing the headphones to drop or mute the laptop.
The symptoms users report are consistent with this mechanism. Music playing on a computer cuts out when an AliExpress tab is merely open on a nearby phone. Headphones announce a connection switch that nobody requested. Calls get routed to the wrong device. None of it looks like a bug in the shop’s code from the user’s perspective — it looks like flaky Bluetooth.
Closing the tab, or blocking the script, restores normal behavior. That is the tell. Multipoint itself works fine; it is simply reacting to a device that claims, falsely, to be playing audio around the clock.
Which Devices and Browsers Are Affected?
The interference primarily affects Android phones, because Android’s audio-focus system actively arbitrates between competing audio sessions and propagates that state to Bluetooth peripherals. iPhones are less exposed, since iOS suspends background audio contexts in Safari more aggressively and gates AudioContext resumption behind user interaction. Desktop browsers are largely immune to the multipoint symptom — a laptop holding an audio session does not typically steal focus from a phone — though the fingerprinting itself works there too.
On the browser side, Chrome and its derivatives on Android are the main vector, since Chromium’s implementation keeps an AudioContext running once resumed and reports audio activity to the OS. Firefox on Android behaves similarly in this respect. Safari’s stricter autoplay policies limit how long a page can hold an audio session without user gesture, which narrows the window for both fingerprinting and interference.
The hardware side matters as well. Multipoint implementations vary between headphone manufacturers, and cheaper chipsets handle focus-switching events less gracefully than premium ones. Users with flagship earbuds may notice only a brief stutter; users with budget multipoint headphones report full dropouts and manual reconnection. The common denominator is always the same: an e-commerce tab, silently insisting it is playing sound.
How Was the Silent Fingerprinting Discovered?
The discovery followed a classic pattern of user-driven debugging rather than a formal security audit. Shoppers noticed that after visiting AliExpress, their Bluetooth headphones would drop the multipoint connection — the feature that keeps earbuds paired to a phone and a laptop at the same time. The breakage happened without any visible prompt, audio playback, or permission request. Nothing asked for consent.
Tracing the problem led researchers and curious users to the Web Audio API, a browser interface that lets websites generate and process sound in JavaScript. The key detail is that this API can run entirely silently. A page can create an audio context, feed a test signal through it, and read back the processed output without a single audible tone. Because every device renders that signal slightly differently, the output doubles as an identifier.
What made the case unusual was the side effect. On some systems, activating the audio stack also wakes up the Bluetooth audio path, which forces the headphones to renegotiate their active connection. The fingerprinting script never intended to break anything. It just did.
What Does AliExpress Gain From Audio-Based Tracking?
Audio fingerprinting gives a merchant a durable identifier that survives the tools users rely on for privacy. Cookies can be cleared, and browser sessions reset, but the audio stack of a given laptop or phone stays the same. A hash of its rendering output behaves almost like a serial number for the device. That is the entire appeal.
For a marketplace operating at AliExpress scale, cross-session identity has direct commercial value. It links browsing behavior to purchases, supports fraud detection on accounts that rotate identities, and helps measure whether an ad shown on one device led to a sale on another. Attribution is the money question in e-commerce. Fingerprinting answers it quietly.
There is also a competitive context worth understanding. Since July 1, 2026, the European Union removed the customs exemption for packages valued under 150 euros, and Chinese retailers responded by moving part of their logistics operations into the EU, as reported by Business Insider Polska. Tighter margins make conversion optimization more valuable, and better tracking feeds exactly that machinery.
Is This Kind of Browser Fingerprinting Legal in the EU?
The short answer is that covert fingerprinting sits on very shaky legal ground in Europe, even if enforcement lags behind. Under the GDPR, any technique that singles out a device or user — and an audio fingerprint does precisely that — processes personal data. That means it requires a legal basis, typically consent. Consent buried in a terms-of-service document does not qualify, because EU rules demand consent that is freely given, specific, informed, and unambiguous. A silent audio probe meets none of those conditions.
The ePrivacy framework reinforces this position. European regulators have repeatedly stated that techniques like canvas or audio fingerprinting fall under rules requiring prior consent, since they access information on the user’s device. The problem is practical, not theoretical. Fingerprinting leaves no file to inspect, and enforcement against platforms headquartered outside the EU moves slowly.
There are signs the environment is hardening. An EU regulation entering into force now makes it easier for investigators and courts to obtain electronic evidence from digital platforms regardless of where they operate, as reported by Rzeczpospolita. Rules like that narrow the space where covert tracking can hide.
How Can You Detect or Block WebAudio Fingerprinting Yourself?
Detection starts with observation. If your Bluetooth headphones lose multipoint every time you open a particular store, that is a strong signal the site is touching the audio stack. From there, browser developer tools let you watch for calls to AudioContext, OfflineAudioContext, and AnalyserNode — the typical building blocks of an audio fingerprint. A page calling these without playing any sound deserves suspicion.
Blocking is easier than detecting. The main options:
- Disable JavaScript on sites you do not trust, though this breaks most modern stores
- Use hardened browsers such as Tor Browser, which returns identical audio output for every user
- Install anti-fingerprinting extensions like Privacy Badger or CanvasBlocker
- Enable Firefox’s built-in resistFingerprinting mode, which normalizes audio rendering
- Route audio through a virtual device so the fingerprint reflects the virtual stack, not your hardware
- Use a separate browser profile or container just for shopping
- Keep Bluetooth headphones unpaired from the browsing machine while you shop
- Check sites with EFF’s Cover Your Tracks tool to see how unique your browser appears
The blunt tools work best. A fully normalized browser makes your audio output identical to thousands of others, which strips the fingerprint of value. The tradeoff is convenience, since hardened setups often degrade site functionality.
Have Other Shopping Sites Used Similar Techniques?
Yes. Fingerprinting is an industry-wide practice, and AliExpress is simply the case that surfaced because of an audible side effect. Academic surveys of the web’s tracking ecosystem have documented audio fingerprinting alongside canvas fingerprinting, font enumeration, and WebGL probing for years. The techniques spread because they work around cookie restrictions that regulators imposed first in Europe and later elsewhere.
Retail is far from the only sector involved. Fingerprinting vendors sell their scripts to banks for fraud prevention, to streaming platforms for enforcing device limits, and to advertisers for cross-device attribution. The same code that protects a payment flow can quietly profile a shopper. Intent is invisible from the outside.
What distinguishes the AliExpress case is the collateral damage. Most fingerprinting is imperceptible by design, and users never learn it happened. Here, the interaction between the Web Audio API and Bluetooth multipoint turned an invisible probe into a visible malfunction. That visibility is rare. It is also the only reason the story spread at all, because broken headphones generate complaints that silent hashes never do.
Frequently Asked Questions
Does AliExpress’s WebAudio fingerprinting collect personal data?
Yes, in the legal sense used by the GDPR. An audio fingerprint is a hash derived from how your specific hardware renders a test signal, which makes it capable of singling out your device. European regulators treat any such identifier as personal data requiring a legal basis, and silent collection without a clear consent prompt does not satisfy that requirement.
Can WebAudio fingerprinting identify me across different browsers?
Partially. The fingerprint reflects your audio hardware and drivers, so two different browsers on the same machine can produce similar outputs. However, browser-level differences in the audio stack also affect the result, which is why trackers combine audio with other signals like canvas and fonts. Hardened browsers that normalize audio output defeat this by making every user look identical.
Does disabling JavaScript stop the Bluetooth multipoint problem?
Yes, because the Web Audio API is a JavaScript interface and cannot run without it. With JavaScript off, the site cannot create an AudioContext, so nothing touches your audio stack and the headphones stay connected. The cost is steep for a marketplace, though — product listings, carts, and checkout all depend on JavaScript, so this works better as a diagnostic step than a daily workaround.
Are EU rules enough to stop covert browser fingerprinting?
The rules are strong on paper but slow in practice. The GDPR and ePrivacy framework clearly require consent for device-accessing tracking techniques, yet enforcement against platforms based outside the EU takes years. The direction is tightening, though — a new EU regulation now makes it easier for prosecutors and courts to obtain electronic evidence from digital platforms regardless of location, as Rzeczpospolita reported, which reduces the shelter cross-border operators once enjoyed.
Summary
- AliExpress’s silent use of the Web Audio API created device fingerprints without any audible sound or consent prompt, and the side effect broke Bluetooth multipoint connections for many shoppers.
- Audio fingerprinting survives cookie clearing because it derives identity from hardware behavior, which makes it attractive for fraud detection, attribution, and cross-session tracking.
- In the EU this practice requires informed consent under the GDPR and ePrivacy rules, and a silent audio probe does not come close to meeting that standard.
- Users can fight back with hardened browsers, anti-fingerprinting extensions, normalized audio rendering, or simply disabling JavaScript, though each option trades away some convenience.
- The case only surfaced because invisible tracking produced a visible malfunction — a reminder that most fingerprinting happening right now goes entirely unnoticed.