Reflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious abo

Reflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious about the analytics code, which is merely going about it's default of reporting the URL of the page. Returning that sort of data in a queryString is still far outside the realm of common sense.