Uh, if a website has a standard google analytics script in it, where does that actually happen? I mean the webpage just spits out html code and your browser interprets it, right? So it's the individual browsers that execute those scripts and communicate with google analytics, right? Not the webpage? I'm not a programmer.

Welcome.

Yes, the inividual browsers execute the scripts. The scripts then might take further communication with Google Analytics or other sites, I haven't bothered to read them and let NoScript or ScriptBlock do the work.

The script in that context is run on your machine inside your browser, if you have allowed it to happen. Regardless of whether the script is run or not, the mere act of fetching it via HTTP or HTTPS allows the source site to observe that you have visited if they wish to track such things. When combined with cookies and / or web bugs (such as the FB "Like" button) and / or browser fingerprints, an individual user can be tracked and profiled in great detail.

If you want to see what the page is pulling in and what load it puts on your connnection, you can do that easily in Firefox or Chromium using the "Inspect Element" function. Either right-click on the page and choose "Inspect" or "Inspect Element" or press ctrl-shift-i for the same result. That will pull up an information panel and one of the tabs is "Network". Select that and then reload the page. It will show you what (unnecessary) pieces are being pulled, from where they are coming, and how long they took to get into your browser.

Then couldn't we copy the google analytics script from a website and put in on other websites? I mean if that scripts is executed on people's personal browsers and not at www.whatever.com, then couldn't any website send out an identical script with the same ID number or whatever and google analytics wouldn't know the difference?

You could just "sell your web-browser statistics data to Google," if they wanted it, but they actually want to spy on your end-user, to learn his IP-address and so on. So, Google Analytics consists of encoded JavaScript programming which will be executed by the end-user's browser.

I don't know Google Analytics well, but I did find this question interesting enough to google (yeah I know...) Here's a story about a site being caught doing that.

https://websanova.com/blog/articles/...acking-mlb-com
https://news.ycombinator.com/item?id=7477736

Google Analytics, of course, uses a key ("nonce") system to uniquely identify their data streams. If you simply copied an analytics package, it wouldn't be yours.

NoScript is the first browser extension I install when I build Firefox and wouldn't leave 127.0.0.1 without it, except to get it.

I'm dead set against running JavaScript globally and very picky about where and what scripts I do allow to run.