You can do tracking perfectly fine without Javascript using just plain old cookies and links. Javascript can't really do anything nefarious "on the users comput

You can do tracking perfectly fine without Javascript using just plain old cookies and links. Javascript can't really do anything nefarious "on the users computer" (outside the browser). You can monitor detailed clicks and perhaps steal some data from the origin (which is developer error), that's about it. The security implications of Javascript are always exaggerated, few people talk about how buggy CSS and HTML parsers or image/video decoding can be. Lots of zeroday exploits there and they keep coming.