An Inaudible Sound, AliExpress's Hidden Cookie

It all started with an annoying little detail. Someone is listening to music on their phone, using Bluetooth headphones that can stay connected to two devices at once (the handy multipoint mode). As long as they don't touch anything, everything is fine. But the moment they open the AliExpress homepage on their computer, the music cuts out. Close the tab, and the sound comes back. Mute the tab, the browser, Windows: nothing helps. And yet there's no video, no music, and no visible player anywhere on the page.

Intrigued, they decided to look under the hood. What they found is a fine example of how sound can now be used to track you.

A Sound No One Can Hear

A few seconds after the page loads, it quietly creates two audio contexts (two AudioContext objects, in browser terms). They come from two deliberately unreadable scripts, collina.js and fireyejs.js, which belong to the anti-fraud toolkit of Alibaba, the parent company of AliExpress.

The setup is simple to describe: an oscillator produces a known waveform (a sawtooth, the kind you can generate yourself with the site's Generator), the signal runs through an analyzer, then through a volume control set to zero, before being sent to the audio output. The zero volume is the trick: you hear nothing, but the browser keeps processing that little stream continuously. Enough, it seems, to keep the Bluetooth channel busy and stop the headphones from switching cleanly back to the phone. Since there's no ordinary video player, the tab's mute button does nothing.

Rest assured: no one is listening to your room. The sound is created and then measured inside the browser, purely digitally. No microphone is involved.

Sound as an Invisible Cookie

Why generate a sound no one hears? To build a signature. This is where the comparison with a cookie becomes useful.

A classic cookie is a small marker a site drops in your browser to recognize you on your next visit. Its weakness, from a tracker's point of view: you can erase it, block it, or replace it.

Here, nothing is dropped on your end. The site recognizes you another way: by how your machine renders that sound. Depending on your browser, your system, and above all your processor, the calculation produces tiny differences. Boil them down into a fingerprint (a single number), and you get an identifier. It's a bit like recognizing someone by their voice rather than by a card they happen to carry.

This sonic fingerprint is just one piece of the puzzle. The same scripts also measure the graphics rendering, the screen size, the memory, the number of processor cores, mouse movements, and plenty of other details, before sending it all to Alibaba's servers. Put together, these signals paint a portrait precise enough to follow you from page to page, without a single cookie. Turning an inaudible sound into a measuring tool is nothing new, by the way: I already wrote about it with the inaudible signal that measures who's listening in radio and TV.

Why Go Through Sound

You might wonder why reach for sound to do this, when other measurements exist. The answer comes down to a small quirk: audio processing is a calculation, and that calculation never turns out quite the same from one machine to the next. The browser's audio engine, the version of the operating system, and the processor's instruction set all leave faint traces on the waveform that comes out. A sawtooth that starts out perfectly identical ends up slightly different depending on the device. Measure that gap, and you have a signature. Sound becomes a kind of fingerprint, except it isn't a finger but a way of computing.

A Fingerprint That's Going Quiet

Oddly enough, this little trick works less and less well. A Firefox developer, Tom Ritter, took a close look at this exact fingerprint: on his browser, it barely tells anyone apart anymore. Since version 118, Firefox forces the audio calculation to return the same result for everyone. In his data, more than 99 percent of users land on just three values, and the rare differences come down to processor details. Here, the sound has become too uniform to give much away.

That's the real paradox of the story: a sound no one can hear, meant to recognize a device, gave itself away not because it identified people too well, but because it cut off the music. The ear, at least, wasn't fooled.

That an inaudible sound can serve as an ID card and annoy a pair of headphones at the same time says a lot about everything sound quietly does inside our machines, out of earshot. Do you know of other uses of sound designed to stay, precisely, completely silent?