> any old coffee shop wifi operator could essentially bug your machine with Google analytics

... also whenever people use all those CDN-hosted jquery and other popular JS libraries. Which is - unfortunately - also widespread practice these days.