I can think of a solution that's VERY VERY anti-consumerish. Being a SaaS provider, create an extensions that you have to install (something consumers want...)

I can think of a solution that's VERY VERY anti-consumerish. Being a SaaS provider, create an extensions that you have to install (something consumers want...). This extension should have the permissions to read history / or urls visiting. Have a blacklist transmitted of urls (so you don't need to transfer the user's data back to the server) and match with it. If it matches...you have to work on that consumer a lot more.