AliExpress Tracks Users Through Audio Systems
WebAudio API used to create unique device fingerprints without consent.
1Tracking with Inaudible Sound Waves
A developer discovered that AliExpress uses the browser's WebAudio API to track users through fingerprinting. The site sends inaudible sound waves and measures tiny differences in how each device processes these signals. This creates a unique digital fingerprint for each device without user knowledge or consent. This method raises significant privacy concerns and is considered a potential violation of data protection laws.
2Bluetooth Connection Disruption
The developer 'laserphile' noticed that their Bluetooth headphones stopped playing music when the AliExpress website was open. Despite supporting multipoint Bluetooth, audio from their phone was interrupted while the AliExpress tab was active. Closing the tab immediately resolved the issue, indicating that the site was accessing the audio system and scanning hardware memory in the background without user awareness.
3Extensive Data Collection
AliExpress doesn't limit itself to audio systems; it also measures canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All this data is used to build a comprehensive device fingerprint, which is then sent to Alibaba's telemetry servers. The lack of transparency about how this data is stored and shared raises serious privacy concerns among users.
4Privacy-Focused Browsers as a Solution
To limit or block such fingerprinting techniques, users can switch to privacy-focused browsers like Firefox or Brave. Brave goes a step further by randomizing fingerprint data and blocking AliExpress's tracking scripts. These browsers provide an additional layer of protection, helping users reduce the risk of being tracked without their knowledge or consent.
5Data Collection Without Consent
AliExpress's practice highlights the issue of extensive data collection without user consent. This approach may violate data privacy regulations like GDPR, which require explicit user consent for data collection and processing. The lack of transparency and user control over their own data is a growing concern in the digital age.
6Uses of Device Fingerprinting
The collected device fingerprints can be used for purposes such as ad targeting, user behavior analysis, and fraud prevention. However, the lack of clarity about how this data is stored and shared creates privacy risks. There is also potential for misuse, as the data could be exploited beyond its intended purposes without user knowledge.
7Similar Practices in the Industry
AliExpress's method reflects the growing use of digital fingerprinting techniques by major tech companies. While these practices are common, they frequently spark debates about ethical and legal boundaries. Users need to be aware of such tracking methods to make informed decisions about their online privacy and security.
8The Importance of Privacy Awareness
This incident underscores the critical need for privacy awareness among internet users. Understanding what data is collected and how it is used is essential for protecting personal information. Using privacy-focused browsers and tools can help mitigate tracking risks. Additionally, companies must be transparent about their data collection practices to build trust with users.
Original article: Slashdot — AliExpress Kullanıcıları Ses Sistemleriyle İzliyor