Does this mean that GA can't track users across websites?

They could theoretically do both by having the JS on the page set one cookie on the host domain and having the server response set one on the GA domain. I don't believe they do, however.

Shameless self mention: Chartbeat does not do this either.

Wouldn't that count as a third-party cookie? It depends on whether "third party" is defined as "third party from the server response" or "third party from the domain of the loaded page".

Google provides a way to do it: https://developers.google.com/analytics/devguides/collection...