Browsers tend to only complain if doing so breaks security, such as using Javascript from a HTTP source on a HTTPS page: the JS could be swapped out by a man-in

Browsers tend to only complain if doing so breaks security, such as using Javascript from a HTTP source on a HTTPS page: the JS could be swapped out by a man-in-the-middle. If you use or communicate using HTTPS on a HTTP page, there's no real issues. You can actually force Google Analytics to use HTTPS on a HTTP page[1] with _gaq.push(['_gat._forceSSL']) but it's not the default. If it's not the default, it's not going to be used heavily across the hundreds of thousands of pages using Google Analytics. Privacy death by a thousand cuts. [1]: https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#forceSSL https://developers.google.com/analytics/devguides/collection...