Silent Audio Fingerprinting Lets Websites Track Users Without Anything Playing
What Happened — Researchers highlighted a technique where a web page emits inaudible audio tones that can be captured by nearby devices (e.g., Bluetooth headphones) and used to create a unique “audio fingerprint.” The page itself shows no media, yet the hardware can hear the signal, enabling cross‑site tracking without visible cookies or scripts.
Why It Matters for Trust & Control Assurance
- The practice sidesteps traditional consent mechanisms, challenging the control objective of transparent data collection and user consent that continuous‑control programs must evidence.
- Organizations that rely on “no visible tracking” claims may lack defensible audit evidence under privacy frameworks, exposing them to regulatory scrutiny.
- Verisq’s CookiePLUS Privacy capability can automatically discover hidden audio‑fingerprinting scripts, generate consent artifacts, and provide the evidence needed for a trustworthy privacy posture.
Who Is Affected
- Digital publishers, ad‑tech platforms, and any SaaS that serves web content (Tech / SaaS).
Recommended Actions
- Inventory all third‑party scripts and media assets for hidden audio‑emitting code.
- Map findings to your privacy control objective (e.g., GDPR’s consent and transparency requirements) and capture evidence in a continuous‑monitoring repository.
- Update consent dialogs and privacy notices to explicitly cover audio‑based tracking techniques.
Source: Smashing Security Podcast #484 – “How Websites Are Tracking You With Silence”
Technical Notes
- The technique leverages the Web Audio API to generate ultrasonic tones (≈18‑22 kHz) that are inaudible to humans but detectable by Bluetooth audio hardware.
- No known CVE; the risk stems from design‑level misuse of legitimate browser APIs.
Source: Podcast transcript