Nobody visiting the AliExpress homepage was told that two scripts would generate an inaudible tone, measure how their machine rendered it, and transmit the result to Alibaba servers alongside dozens of other device readings. No prompt appeared. No browser indicator appeared. The mute control did not work. Documented on 20 August 2026, the case is a clean illustration of processing that European law has treated as consent-bearing since 2014.

The behaviour surfaced through a hardware fault rather than a privacy review. A developer publishing as m-c-tech on the laserphile blog uses Bluetooth headphones paired to a PC and a phone at once. Music ran from the phone until an AliExpress page was open, at which point it stopped and stayed stopped until the tab was closed.

That symptom was the only notice any visitor received.

Four layers of invisibility

The absence of disclosure here is not a single omission. It operates at four separate levels, and each one matters differently under European law.

No consent prompt. Nothing on the page asked permission before the measurement began, and nothing described it after the fact.

No browser indicator. Tabs playing audio normally display a speaker icon. This page did not trigger one, because the volume was set to zero before the signal reached the output.

No working control. Muting the tab, the browser and the operating system all failed. A tab mute acts on media playback objects, and no such object existed. The page was performing live audio processing, a different category of activity the control has nothing to grip. The behaviour is filed as Mozilla bug 1863193, which Tom Ritter, a Firefox platform developer, confirmed in the discussion thread in four words: "Yes, it is a bug."

No readable code. Both files are heavily obfuscated. Establishing what they did required wrapping the browser's own audio constructor to log every creation event with a stack trace, which is not a step available to an ordinary visitor.

The mechanism, briefly

Browsers ship with the Web Audio API so that web applications can generate and shape sound. The two scripts use it to build a four-step chain: a sawtooth tone generated in software, a measuring component that reports what the tone looks like after processing, a volume control set to zero, and a connection to the system speakers.

Two machines given identical instructions do not produce identical output. Processor, sound hardware, driver, operating system and browser version each introduce small differences. Reading those back and hashing them yields a short string, stable for one machine and different across machines.

According to the post, no audio file is downloaded. Writing on Hacker News as emctech, the author described it: "the scripts generate audio at runtime using a sawtooth oscillator."

The instrumentation returned two audio contexts, both running, both connected to the speakers, both appearing several seconds after load. The traces named collina.js at version 1.140.0 and fireyejs.js at version 1.231.67, served from assets.aliexpress-media.com under a path marked AWSC, associated with Alibaba's browser security and anti-abuse tooling.

Audio is a fraction of what the bundles read. The same code queries canvas rendering output, WebGL renderer strings and shader precision, screen and viewport dimensions, device pixel ratio, processor core count and device memory, installed plugins, supported media formats, WebRTC behaviour, performance timing, mouse, touch, focus and scroll events, device motion and orientation, and properties indicating automated browsing. Separate routines serialise and encrypt the results before sending them to Alibaba telemetry endpoints.

Why this sits inside Article 5(3)

Article 5(3) of the ePrivacy Directive governs storing information on a person's device or gaining access to information already stored there. It requires prior consent that is freely given, specific, informed and unambiguous, with one exemption: processing strictly necessary to provide a service the person explicitly requested.

Fingerprinting was placed inside that provision by the Article 29 Working Party in Opinion 9/2014, and the European Data Protection Board reaffirmed the position in Guidelines 2/2023, adopted on 16 October 2024. The ICO published final guidance covering device fingerprinting alongside cookies and pixels on 29 April 2026. The legal classification has not been seriously contested for a decade.

Two facts in the source material bear directly on the exemption.

The first is timing. The scripts run on the general shopping homepage, before any login, any payment step or any other sensitive action. Whatever the security rationale, it is being applied to visitors who have not yet asked for anything beyond a page of product listings.

The second is the blocking test. With both requests blocked by custom filter rules, the homepage rendered normally and ordinary product browsing continued to work. A fresh capture recorded no audio contexts at all. The service the visitor explicitly requested was delivered without the processing.

That combination is the standard test regulators apply to strict necessity, and it is the same reasoning applied in the analysis of Chrome's silent installation of a four gigabyte model file, where the argument turned on the browser remaining functional without it.

The security argument, and its limit

There is a real counterweight. A marketplace of this size faces account takeover, fake accounts, scraping, automated purchasing, payment fraud, review manipulation and abuse of coupons or new-customer promotions. A device identifier resists those in a way cookies do not, since cookies can be cleared, copied or replaced. Interaction data helps separate a person from automation, which lets trusted visitors past a CAPTCHA.

Security processing occupies different legal ground from advertising identification, and the AWSC directory placement is genuine evidence that fraud prevention is at least part of the intent. An academic study by Jordan S. Queiroz and Eduardo L. Feitosa, published in The Computer Journal on 22 January 2019, noted that browser fingerprinting "can also be used to enhance security", including as a factor in two-factor authentication.

The limit is that strict necessity is assessed against the service requested, not against the operator's general interests. A security purpose does not automatically clear the exemption if the same page functions without the processing, and nothing in the client code confines the data to a fraud score. The author of the post was explicit that retention periods, identity linkage and any reuse across other Alibaba properties are invisible from a browser.

Brave reached a firmer conclusion. In a thread posted on 22 August 2026 that drew around two million views, the company stated that AliExpress "was caught using users' audio systems to track them". Brave is a browser vendor competing on privacy, and that is a characterisation rather than a demonstration.

What GDPR adds on top

Where personal data is processed, ePrivacy consent is only the first requirement.

Article 6 requires a lawful basis. Where consent was not obtained, the fallback in commercial practice is legitimate interests, which demands a documented balancing test weighing the operator's interest against the rights of the person, including whether the processing falls within their reasonable expectations. A silent audio measurement on a shopping homepage is a difficult fit for reasonable expectations by construction, since the whole design goal is that nobody notices.

Articles 13 and 14 require transparent disclosure at the point of collection. Absence of any reference in a privacy policy is a separate breach from absence of a legal basis, a distinction set out in the BrowserGate investigation into LinkedIn's covert extension scanning, where the same two-track argument was made.

Article 5(1) requires processing to be lawful, fair and transparent. Deliberate obfuscation of the code performing the measurement is relevant to fairness in a way that is hard to argue away.

The penalty ceiling under Article 83(5) is 20 million euros or 4% of global annual turnover, whichever is higher.

The ICO set out the practical threshold in December 2024, when it responded to Google's decision to lift its own prohibition on fingerprinting for advertising. Organisations using these techniques were told they must demonstrate transparency, freely given consent, fair processing and workable erasure rights. The regulator described that as a high bar given how fingerprinting works. It has not withdrawn the assessment, though it advised the UK government on 18 May 2026 that blanket consent requirements were blocking investment in lower-risk advertising models.

AliExpress arrives with a record

The platform is already inside European enforcement machinery. The European Commission fined AliExpress 550 million euros in July 2026 over systemic risk failures under the Digital Services Act, following proceedings opened on 14 March 2024 that examined, among other things, the transparency of its advertising and recommender systems.

On data protection specifically, privacy campaigners filed GDPR complaints against Alibaba's Singapore e-commerce entity in July 2025 after the AliExpress copy-of-personal-data tool returned a file that could be opened once, and a follow-up access request was answered by pointing back at the same tool.

No complaint has been filed over the audio measurement, and neither AliExpress nor Alibaba has commented on it.

Proportionality cuts against the design

The measured value of the signal is relevant to any balancing test, and it is public.

Shekhar Chalise, Hoang Dai Nguyen and Phani Vadrevu of the University of New Orleans presented the first systematic study of Web Audio fingerprinting at the ACM Internet Measurement Conference in Nice in October 2022, drawing on 2,093 participants across 57 countries over 76 days in 2021. The authors report that "audio fingerprints are much less diverse than other vectors". Seven audio techniques combined produced 95 distinct fingerprints across all 2,093 people, against 352 for canvas rendering, 427 for the plain User-Agent header and 690 for font enumeration.

Adding audio to a canvas fingerprint lifted entropy from 6.109 bits to 6.699 bits, a gain of 9.6%. Adding it to a User-Agent fingerprint produced 9.7%.

A balancing test weighs the operator's benefit against the intrusion. Here the benefit is a tenth of an identifier that already exists, obtained by covertly commandeering an audio path in a way that changed how external hardware behaved.

There is a further wrinkle. Ritter's own assessment, posted in the same thread, is that Web Audio fingerprinting is largely mitigated in Firefox, and a second Mozilla-affiliated commenter stated that it does not work there at all. If that holds, Firefox visitors bore the interruption without the operator gaining the measurement.

What this changes for marketers

Fingerprinting deployed for security runs first-party, escapes default blocklists and is frequently excluded from consent inventories on the assumption that it is strictly necessary. Neither script here appeared on default blocklists, matching the finding in PPC Land's reference piece on canvas fingerprinting that running a crawl with Adblock Plus and uBlock Origin installed reduced extracted canvases by only about 5%. Consent management platforms scan for cookies and tags. They do not generally scan for audio contexts.

The disclosure wording has already been rewritten

IAB Europe renamed TCF Special Feature 2 from active device scanning to identification based on information actively requested, with compliance due in web environments by mid-October 2026 and in app and connected television environments by mid-February 2027. Any vendor performing client-side measurement inherits that language and those dates.

Litigation is arriving before regulation

The class action filed against LinkedIn in April 2026 alleged that a system named in inspected materials as Anti-fraud Platform Features Collection assembled canvas output, WebGL characteristics, audio-context features and automation indicators into a single signature without disclosure. Private claims move faster than supervisory authorities, and the architecture at issue is the same one described here.

Browser vendors are enforcing what regulators have not

Brave 1.93 collapsed WebGL vendor and renderer strings to a single generic value on 14 August 2026. Firefox 145 cut trackability by close to half in November 2025. Safari 26 switched Advanced Fingerprinting Protection on for all browsing sessions in September 2025, restricting canvas, WebGL and Web Audio for classified scripts, and Safari 27 extends the approach to IP-level blocking. Meanwhile Google removed its own fingerprinting prohibition effective 16 February 2025 and began serving IP-based ads to EEA publishers from 3 August 2026. Engine policy, not platform policy, is now the operative constraint.

The finding itself is narrow. A measurement worth a fraction of a bit ran on a shopping homepage with no prompt, no indicator, no working control and no readable code, and it was discovered because it interrupted somebody's music. European law has classified that category of processing as requiring consent since 2014. Whether anything follows from the classification is a question for a supervisory authority that has not yet been asked.

Timeline

Summary

Who: A developer publishing as m-c-tech on the laserphile blog and as emctech on Hacker News documented the behaviour. The scripts belong to Alibaba and run on AliExpress. Tom Ritter, a Firefox platform developer, confirmed the mute failure as a Mozilla bug. Brave characterised the technique as tracking. Supporting research comes from Shekhar Chalise, Hoang Dai Nguyen and Phani Vadrevu of the University of New Orleans, and from Jordan S. Queiroz and Eduardo L. Feitosa.

What: Two obfuscated scripts, collina.js version 1.140.0 and fireyejs.js version 1.231.67, create running audio contexts on the AliExpress homepage several seconds after load. Each generates an inaudible tone, measures how the machine renders it, routes it through a volume control set to zero and connects it to the system speakers. No consent prompt, browser indicator or working mute control accompanies the process. The same bundles read canvas, WebGL, hardware, WebRTC, timing, interaction and motion signals, then encrypt and transmit the results to Alibaba endpoints.

When: Published on 20 August 2026. The Hacker News discussion reached 1,031 points the same week. Brave posted its thread on 22 August 2026. The legal classification of fingerprinting under Article 5(3) dates to Opinion 9/2014 and was reaffirmed on 16 October 2024.

Where: On the AliExpress homepage, with scripts served from assets.aliexpress-media.com under an AWSC path, observed in Firefox and Chrome on Windows. The legal exposure is sharpest in the European Economic Area and the United Kingdom.

Why: Article 5(3) of the ePrivacy Directive requires prior, freely given, specific, informed and unambiguous consent for accessing information on a person's device, unless the processing is strictly necessary for a service the person explicitly requested. Two facts pull against that exemption: the scripts run on the homepage before any login or payment, and blocking them left the homepage rendering and ordinary browsing intact. Where personal data is processed, GDPR adds requirements for a lawful basis under Article 6, transparent disclosure under Articles 13 and 14, and fair processing under Article 5(1), with penalties reaching 20 million euros or 4% of global annual turnover. No complaint has been filed over the measurement, and neither AliExpress nor Alibaba has commented.