Audio fingerprinting is a device identification technique that instructs a browser to generate a sound in software, reads back the numbers produced after the browser has processed that sound, and hashes them into a short string. The string stays the same for one machine and differs across machines, because processors, sound hardware, drivers, operating systems and browser builds each handle floating point arithmetic slightly differently. No microphone is involved. No audio file is downloaded. In most implementations nothing audible reaches the speakers. The technique exists for the same reason canvas fingerprinting does: it yields an identifier without storing anything on the device, which places it outside the visible machinery that cookie regulation was built around.

How the measurement is built

The Web Audio API supplies the raw material. Introduced by Google in Chrome in 2011 and elevated to a W3C Recommendation in June 2021, it lets a page assemble an audio graph, a directed chain of AudioNode objects. Sources generate signal, modifiers alter it, analyzers measure it, and destinations either play it through the speakers or write it into a memory buffer.

Fingerprinting scripts use a handful of those nodes. An OscillatorNode produces a periodic waveform in one of four shapes: sine, square, sawtooth or triangle. A DynamicsCompressorNode reduces the loudest parts of the signal, a routine borrowed from music production that differs measurably between audio stacks. An AnalyserNode exposes a Fast Fourier Transform, converting the waveform into frequency bins. A GainNode set to zero silences everything before it reaches the output.

Steven Englehardt and Arvind Narayanan of Princeton University documented two configurations in the wild in their 2016 census of the top one million sites. In the first, an OscillatorNode generating a sine wave feeds a DynamicsCompressorNode, whose output lands in the buffer of an OfflineAudioContext, a context that renders faster than real time and never touches the sound hardware. The script sums the buffer values and hashes them with MD5. Two scripts used it, one served from js.ad-score.com. In the second, a triangle wave passes through an AnalyserNode and a ScriptProcessorNode, then a GainNode with gain set to zero, and finally to the AudioContext destination, meaning the computer speakers. The FFT output is captured through an onaudioprocess handler and hashed with SHA1. That configuration came from cdn-net.com.

The distinction matters. The offline variant is invisible by construction. The real-time variant creates a live audio context wired to the output device, silenced only by a volume setting, which is why it can interfere with other audio on the machine and why browser mute controls do not reliably stop it.

Speed is no constraint. Researchers at the University of New Orleans measured an average of 0.14 seconds per vector, with a full stack of seven completing in roughly one second.

What the signal is actually worth

The most detailed public measurement comes from Shekhar Chalise, Hoang Dai Nguyen and Phani Vadrevu, who ran a 76 day study between March and May 2021 with 2,093 participants across 57 countries and presented the results at the ACM Internet Measurement Conference in Nice on October 25 to 27, 2022. Their headline finding cuts against the technique.

Seven audio vectors combined produced only 95 distinct fingerprints across 2,093 people, 49 of which belonged to a single user. Canvas rendering produced 352 distinct values over the same population, font enumeration 690, and the plain User-Agent header 427. In Shannon entropy, the audio combination reached 2.803 bits against 6.109 for canvas, 6.466 for User-Agent and 7.146 for fonts.

The additive value is where the case for audio sits. Layering audio onto a canvas fingerprint lifted normalized entropy from 0.554 to 0.607, a rise of 9.6 percent. Layering it onto a User-Agent fingerprint produced 9.7 percent. Small gains, but hard to defend against, since unlike fonts or the User-Agent string they cannot be neutralized by swapping a header.

Two figures for audio entropy circulate and they do not agree. The Princeton demonstration page collected 18,500 distinct cookies that hashed to 713 fingerprints, from which the authors estimated 5.4 bits. The New Orleans study measured 2.803 bits. The populations differ sharply, one self-selected from privacy-interested visitors and one recruited and paid through Amazon Mechanical Turk, and neither figure should be read as settled.

Stability behaves oddly. The Dynamics Compressor vector returned exactly one fingerprint for every user across all 30 iterations. The FFT based vectors did not: one participant produced 26 different fingerprints in 30 attempts. The researchers resolved this by treating each user and each observed fingerprint as nodes in a graph and reading connected components as identities, which restored match scores above 0.99 even when only three iterations were available. Browser choice drove the difference. Fewer than 0.2 percent of Chrome based browsers returned a single amplitude modulation fingerprint across 30 runs, against more than 97.5 percent of Firefox browsers.

Configuration properties carry far less. Only five distinct sample rates appeared, 48 kHz on 76.8 percent of machines and 44.1 kHz on 22.7 percent.

Who deploys it, and why

Audio fingerprinting is not bought or sold as a media product. It sits inside script bundles operated by fraud detection vendors, verification firms and platform security teams, reaching publishers and advertisers indirectly through tags those parties place.

Deployment has always been thin. In the March 2016 crawl the most common script, from the video advertising firm Liverail, appeared on 512 sites and merely checked whether AudioContext and OscillatorNode existed, contributing a single bit to a wider fingerprint. Scripts performing real signal processing were found on as few as six sites each. Canvas fingerprinting appeared on 14,371 sites in the same crawl, with DoubleVerify scripts alone accounting for 7,806 of them.

Blocking tools have never caught up. Disconnect blocked 11.1 percent of the audio fingerprinting scripts identified, covering 53.1 percent of affected sites. The EasyList and EasyPrivacy combination blocked 5.6 percent of scripts and just 1.6 percent of sites. Manually curated lists struggle with code that neither renders visibly nor originates from a recognized advertising domain.

Disambiguation

Acoustic fingerprinting, also called automatic content recognition, shares the vocabulary and inverts the object. It identifies the content rather than the device, matching a captured segment against a reference database. This is the technology behind music identification apps and behind smart television measurement, where Nielsen uses audio fingerprints to identify programming across distribution platforms. Trade coverage of ACR data licensing uses the phrase in this sense routinely.

Canvas fingerprinting applies the same logic to the graphics stack, asking the browser to render an image and hashing the pixels. It is more discriminative and more widely deployed.

Ultrasonic cross-device tracking does involve real sound: inaudible tones emitted by one device and captured by a microphone on another to link the two. Audio fingerprinting needs no microphone permission and emits nothing intended to be heard.

Audio watermarking embeds an identifier into a recording before distribution, rather than deriving one from machine behavior.

Limitations and disputes

The specification itself became the subject of an argument. The Web Audio API security and privacy section asserted that audio fingerprinting merely allowed deduction of information already available by easier means, naming the User-Agent string. The New Orleans researchers tested that claim directly and refuted it: of 143 User-Agent strings shared by more than one participant, 90 spanned multiple audio fingerprint clusters, with one Chrome and Windows string associated with ten different fingerprints.

Browser vendors have disagreed among themselves. Brave shipped randomization defenses in 2020, adding modifications under one percent to signal amplitudes so that each run differs. Chrome and Firefox developers questioned whether the exposure justified the cost, and Brave's own issue tracker records rendering breakage attributed to similar protections. According to Fingerprint, a commercial vendor whose account is self-reported, Safari 17 began injecting random noise into Web Audio signals in private browsing mode, and the company responded by sampling repeatedly and rounding to recover a stable value. Tom Ritter, a Firefox platform developer, stated in an August 2026 discussion that the technique is largely mitigated in Firefox.

Legally the classification is old and stable. The Article 29 Working Party placed device fingerprinting inside Article 5(3) of the ePrivacy Directive in Opinion 9/2014, requiring prior consent unless the processing is strictly necessary for a service the visitor requested. The European Data Protection Board reaffirmed that reading in Guidelines 2/2023, adopted October 16, 2024, and the ICO published final guidance covering device fingerprinting on April 29, 2026.

Recent developments

The technique returned to public attention on August 20, 2026, when a developer documented two obfuscated scripts on the AliExpress homepage creating running audio contexts connected to the system speakers, discovered because they interrupted music playing through paired Bluetooth headphones. No consent prompt, browser indicator or working mute control accompanied the process.

Litigation has moved ahead of regulation. A class action filed in April 2026 alleged that LinkedIn assembled canvas output, WebGL characteristics and audio-context features into a single signature without disclosure, an argument set out at length in the BrowserGate investigation.

Engine policy is now the operative constraint. Safari 26 activated Advanced Fingerprinting Protection for all browsing sessions in September 2025, restricting Web Audio processing details for classified scripts, and Safari 27 extended the approach to IP level blocking. Firefox 145 cut trackability by close to half in November 2025. Google, meanwhile, removed its own prohibition on fingerprinting for advertising effective February 16, 2025, and began serving IP based ads to EEA publishers on August 3, 2026.

Disclosure obligations are tightening in parallel. IAB Europe renamed TCF Special Feature 2 from active device scanning to identification based on information actively requested, with compliance due in web environments by mid October 2026 and in app and connected television environments by mid February 2027. Any vendor running client side audio measurement inherits that language and those dates.

Timeline

  • 2011: Google introduces the Web Audio API in Chrome, enabling sound synthesis and processing through chains of audio nodes
  • May 2012: Keaton Mowery and Hovav Shacham publish work on canvas fingerprinting, establishing the pattern audio fingerprinting later follows
  • January and March 2016: Steven Englehardt and Arvind Narayanan crawl the top one million sites with OpenWPM and identify AudioContext fingerprinting in the wild
  • May 2016: The findings are published, showing the most common script on 512 sites and the processing scripts on as few as six
  • February 2018: A privacy issue is opened against the Web Audio API specification asking it to acknowledge the DynamicsCompressor and OscillatorNode risk
  • January 22, 2019: Jordan S. Queiroz and Eduardo L. Feitosa publish a Web Audio fingerprinting study in The Computer Journal, volume 62, issue 8
  • April 2020: Brave ships randomization based audio fingerprinting defenses
  • March to May 2021: University of New Orleans researchers run a 76 day study with 2,093 participants across 57 countries
  • June 2021: The Web Audio API becomes a W3C Recommendation
  • October 25 to 27, 2022: Results are presented at the ACM Internet Measurement Conference in Nice, reporting 95 distinct audio fingerprints and a 9.6 percent entropy gain over canvas alone
  • October 16, 2024: The European Data Protection Board adopts Guidelines 2/2023, reaffirming that fingerprinting falls within Article 5(3) of the ePrivacy Directive
  • November 5, 2024: The W3C publishes the first public working draft of Web Audio API 1.1
  • February 16, 2025: Google's revised platform policy permitting fingerprinting for advertising takes effect
  • September 2025: Safari 26 activates Advanced Fingerprinting Protection for all browsing sessions
  • November 2025: Firefox 145 completes a second phase of anti-fingerprinting defenses
  • April 2026: A United States class action alleges an anti-fraud stack combining canvas, WebGL and audio-context features
  • April 29, 2026: The ICO publishes final guidance on storage and access technologies covering device fingerprinting
  • August 14, 2026: Brave 1.93 collapses WebGL vendor and renderer strings by default
  • August 20, 2026: Two audio contexts running on the AliExpress homepage are documented publicly

Summary

Who: Steven Englehardt and Arvind Narayanan of Princeton University identified the technique in the wild in 2016. Shekhar Chalise, Hoang Dai Nguyen and Phani Vadrevu of the University of New Orleans conducted the first systematic effectiveness study. Jordan S. Queiroz and Eduardo L. Feitosa published an earlier method paper. Operators are fraud detection vendors, verification firms and platform security teams rather than media buyers. Brave, Mozilla and Apple have shipped countermeasures.

What: A device identification method that generates a waveform through the Web Audio API, routes it through processing nodes such as a dynamics compressor or an analyser, reads the resulting numbers and hashes them into an identifier. Seven vectors combined yielded 95 distinct fingerprints among 2,093 users, against 352 for canvas, and added 9.6 percent to canvas entropy when layered on top.

When: The Web Audio API arrived in 2011. Fingerprinting use was first measured in 2016. The definitive effectiveness study ran in 2021 and was published in 2022. Deployment remains a live issue, most recently through a case documented on August 20, 2026.

Where: In browser JavaScript, running client side on any page that loads a script performing the measurement. Legal exposure is sharpest in the European Economic Area and the United Kingdom, where Article 5(3) of the ePrivacy Directive has covered fingerprinting since 2014.

Why: The technique produces an identifier that survives cookie deletion and private browsing without storing anything on the device. Its standalone discriminating power is weak, but it is hard to defend against without accepting compatibility risk, which makes it useful as a supplementary signal inside anti-fraud and identity stacks. That same property makes it difficult to reconcile with consent rules written around visible storage.