Is AudD® Music Recognition safe?
AudD Music Recognition sends tab URL, page title, and a persistent device ID to api.audd.io on every song recognition request.
When a user initiates a song recognition, the extension collects the current tab URL, page title, and browser UI language, and transmits them to api.audd.io alongside the audio sample. A pseudonymous device ID generated on first install is also included in every request, enabling the API provider to correlate a user's recognition history across sessions. Free-tier requests additionally include an RC4-obfuscated hidden form field whose purpose is unclear.
Who publishes itAudD, LLC - no other listings under this identity, 2 shared hostnames
AudD, LLC - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Device identifier is sent to AudD API on each recognition
When you start music recognition, AudD Music Recognition sends a persistent device identifier to api.audd.io.
The identifier is stored locally and reused across recognition requests, so requests can be linked to the same browser profile.
What actually happens
Starts a music recognition request.
Retrieves a persistent device_id and sends it to api.audd.io with the recognition request.
Captured request
Fields in the request
- Persistent device identifier0.4839201745123451699812345678 (illustrative)
Links recognition requests from the same browser profile across sessions.
Tab URL and page title sent to AudD API during song recognition
When you start a song recognition request, the extension sends the current tab URL and page title to api.audd.io along with the audio file.
This links the recognition request to the page you had open at that moment.
What actually happens
You start a song recognition request.
The extension adds the current tab URL and page title to the recognition request.
Captured request
Fields in the request
- Current tab URLhttps://example.com/song-page (illustrative)
The page address can reveal what site or specific page is open when recognition starts.
- Current page titleExample Song Page (illustrative)
The page title can provide additional context about the current page.
What it can do
Permissions this extension asks for, as declared in version 3.2.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.audd.io
https://api.audd.io/
Read and change your data on www.googleapis.com
https://www.googleapis.com/
Read and change your data on every site you visit
<all_urls>
Sign you in with your Google account
identity
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
See every page you navigate to, as you navigate to it
webNavigation
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Show you desktop notifications
notifications
Where it sends data
Destinations our analysis observed AudD® Music Recognition contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.audd.io
AudD® Music Recognition sends data to api.audd.io. One other extension we have analyzed sends data here.