The same-origin policy prevents Google tracking in a iFrame from identifying the parent site, so technically "This website has no tracking or analytics." is correct. It does expose you to Google's analytics for the iFrame however, so it's down to how you define "this site", but as the owners of the site don't have access to that tracking information, the statement seems fair.