Perhaps I am missing something, but I am just learning javascript.
My understanding of Single Origin Policy is that Google Analytics should not be able to send data back to Google.
How is it able to transmit send data to Google without violating the policy?
From what I can tell, a webpage includes the JavaScript file from Google, then that script dynamically adds an image to the page (http://www.google-analytics.com/__utm.gif) which contains the information required for logging.
SOP does not apply to scripts, images or CSS files that are dynamically added to a page. This is why you much trust whatever JavaScript files you include in your webpages, as they will have complete control over the page.
Ryan Doherty is correct. The Google Analytics javascript code draws a transparent 1px-by-1px gif image name __utm.gif on your page. When the request (which is located on Google's servers) for this image is made, information is appended as GET parameters. Google captures this data and begins processing it. Usually within 3-6 hours, you'll see the data show up in your GA reports.
