They can use onclick and leave the href attribute alone.

I'm sure this is something they have considered as their own analytics program uses onclick to track outbound traffic - I assume it's a mix of speed, reliability and the ability to track without javascript.

Plus, if it was done on OnClick there would definitely be an add-on to disable the tracking on all browsers.

There are some privacy reasons for it.

A direct link from a search page will let websites see the search terms that users entered in to navigate there.

Google still knows everything so it doesn't protect you from them, but websites are more in the dark what users were doing before clicking the link.

And then Google aggregates that back to sides that use Google analytics so that they get both sides of the users

There is rel="noreferrer" for that.

Then they can't track if you share the link!

But what to do about them JavaScript disabling varmints then?

That’s what hyperlink auditing with the ping attribute is for:

https://html.spec.whatwg.org/multipage/links.html#hyperlink-...

You put a `ping` attribute on a link, and when the user follows the link, the browser sends a request to the ping URL notifying it of the action.

Firefox disables it by default, which doesn’t seem like much of a privacy win considering JavaScript is enabled by default and can polyfill this functionality.

Giving Javascript the ability to make requests without asking the user via dialog for each one—if we must allow it at all—was a mistake.

That's the point, How else are we supposed to fight these companies? Take their source of money away and watch them squirm.