Perhaps I am missing something, but I am just learning javascript.
My understanding of Single Origin Policy is that Google Analytics should not be able to send data back to Google.
How is it able to transmit send data to Google without violating the policy?
See Question&Answers more detail:os
From what I can tell, a webpage includes the JavaScript file from Google, then that script dynamically adds an image to the page (http://www.google-analytics.com/__utm.gif) which contains the information required for logging.
SOP does not apply to scripts, images or CSS files that are dynamically added to a page. This is why you much trust whatever JavaScript files you include in your webpages, as they will have complete control over the page.
