ga.js can be static, and can read cookies. You go to Google and do a search, Google stores your search sessions on the server, and assigns you some unique ID.

ga.js can be static, and can read cookies. You go to Google and do a search, Google stores your search sessions on the server, and assigns you some unique ID. If you click on a search result, google logs that in your session. You visit site with Google Analytics. ga.js reads the Google.com cookie to get your session ID in some clever way (perhaps embedding an invisible iframe in the Google.com domain, which can read the Google.com search cookie). Now, Google Analytics knows that you're the same person who just clicked on that search result .2 seconds ago... a match in my book. They could also tell you things like "visitors to your site also search for XXX" but that's clearly a violation of privacy. They get this data, but we don't.