Many browsers have specifically disabled background-image, or anything with side effects, on :visited selectors - https://hacks.mozilla.org/2010/03/privacy-rela

Many browsers have specifically disabled background-image, or anything with side effects, on :visited selectors - https://hacks.mozilla.org/2010/03/privacy-related-changes-coming-to-css-vistited/ https://hacks.mozilla.org/2010/03/privacy-related-changes-co... You can still trick users into clicking on overlays on top of visited links (e.g. with a fake captcha that says "click all the things that are purple"). But because this requires manual actions, it's less critical than something like the session resumption attack above, which could run all night and enumerate the RTT of every single banking site and niche mature-content site out there.