SKN | AliExpress Privacy Controversy Raises New Questions Over Browser Fingerprinting and User Tracking

Key Points:

• AliExpress was reportedly found running two hidden Web Audio scripts that kept a computer’s audio system active at zero volume while users browsed the platform.
• The scripts reportedly collected multiple device signals, including canvas data, screen dimensions, memory, mouse behavior, and WebRTC information, potentially creating a detailed browser fingerprint.
• The discovery highlights growing privacy and regulatory risks for global technology platforms as browser-based tracking becomes increasingly sophisticated and less visible to users.

AliExpress is facing renewed scrutiny over browser-based tracking after a developer reportedly discovered hidden scripts running in the background while browsing the e-commerce platform. The investigation found two separate scripts that activated the computer’s audio-processing system at zero volume, raising broader questions about how digital platforms collect device information without an obvious user interaction or disclosure.

The incident is relevant beyond e-commerce because browser fingerprinting has become an important tool for identifying devices, detecting automated activity, and preventing fraud. For investors, the episode also illustrates how privacy practices, regulatory exposure, and cybersecurity architecture can become material risks for large technology companies operating across multiple jurisdictions.

Hidden Audio Processing Creates an Unusual Tracking Mechanism

The investigation reportedly identified two hidden scripts operating in the background. Rather than playing conventional audio through a visible media player, the scripts generated an inaudible signal and maintained an active audio-processing path while the computer remained at zero volume.

The technique is based on the principle that computers process audio slightly differently depending on their hardware, operating system, browser, and other technical characteristics. Those small differences can potentially be measured and combined with other signals to create a distinctive device fingerprint.

The reported behavior also created an unexpected hardware effect. A developer using Bluetooth headphones with multipoint functionality found that audio stopped switching normally between a computer and phone while an AliExpress tab remained open. Closing the tab restored the expected behavior, providing the initial clue that led to the investigation.

Fingerprinting Extends Beyond Audio Data

The privacy concerns extend beyond the audio system. According to the attached source, the scripts also collected canvas information, screen size, device memory, mouse behavior, and WebRTC signals, creating multiple layers of technical information that can potentially distinguish one browser environment from another.

Importantly, the reported investigation found no evidence that AliExpress was recording conversations or accessing the computer’s microphone. The concern instead centers on silent browser fingerprinting and the collection of device characteristics without clear user awareness or disclosure.

That distinction matters for investors and regulators. Fingerprinting can operate without traditional cookies and may remain effective even when users take conventional steps to limit tracking. As privacy rules become stricter, technology companies could face increasing scrutiny over whether such techniques are adequately disclosed and whether users have meaningful control over them.

Privacy Risk Becomes a Business and Regulatory Issue

The controversy also highlights the broader tension between fraud prevention and user privacy. Large e-commerce platforms face significant risks from automated accounts, bots, payment fraud, and abusive activity, making sophisticated device identification commercially valuable.

However, increasingly complex tracking systems can create reputational and regulatory exposure when users are unaware of the data being collected. Mozilla reportedly flagged similar AliExpress behavior nearly two years ago, while the latest discovery suggests that browser fingerprinting remains an active area of concern.

For institutional investors, the issue illustrates why cybersecurity and privacy governance increasingly form part of technology-sector risk analysis. Regulatory investigations, changes in browser protections, or restrictions on fingerprinting techniques could force platforms to redesign anti-fraud systems and potentially increase compliance costs.

Looking ahead, investors will watch for responses from Alibaba, browser developers, privacy regulators, and consumer-protection authorities. The central question is whether platforms can maintain effective fraud detection without relying on tracking methods that operate largely outside the user’s visibility. Any regulatory or technical shift toward greater transparency could reshape how large digital marketplaces collect and process device-level information.