Is AudD® Music Recognition safe?

Medium risk

AudD Music Recognition sends tab URL, page title, and a persistent device ID to api.audd.io on every song recognition request.

When a user initiates a song recognition, the extension collects the current tab URL, page title, and browser UI language, and transmits them to api.audd.io alongside the audio sample. A pseudonymous device ID generated on first install is also included in every request, enabling the API provider to correlate a user's recognition history across sessions. Free-tier requests additionally include an RC4-obfuscated hidden form field whose purpose is unclear.

AudD, LLCv3.2.5Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Device identifier is sent to AudD API on each recognition

When you start music recognition, AudD Music Recognition sends a persistent device identifier to api.audd.io.

The identifier is stored locally and reused across recognition requests, so requests can be linked to the same browser profile.

01EvidenceCAUSE EFFECT
What actually happens
You did this

Starts a music recognition request.

The extension did this

Retrieves a persistent device_id and sends it to api.audd.io with the recognition request.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.audd.io/
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Persistent device identifier
0.4839201745123451699812345678 (illustrative)Links recognition requests from the same browser profile across sessions.
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Tab URL and page title sent to AudD API during song recognition

When you start a song recognition request, the extension sends the current tab URL and page title to api.audd.io along with the audio file.

This links the recognition request to the page you had open at that moment.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start a song recognition request.

The extension did this

The extension adds the current tab URL and page title to the recognition request.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.audd.io/
03EvidenceFIELD TABLE
Fields in the request
FieldValueWhy it matters
Current tab URL
https://example.com/song-page (illustrative)The page address can reveal what site or specific page is open when recognition starts.
Current page title
Example Song Page (illustrative)The page title can provide additional context about the current page.

Data recipients

api.audd.io
Updated 17 September 2026amo-2784913