Browsers tend to only complain if doing so breaks security, such as using Javascript from a HTTP source on a HTTPS page: the JS could be swapped out by a man-in-the-middle. If you use or communicate using HTTPS on a HTTP page, there's no real issues.

You can actually force Google Analytics to use HTTPS on a HTTP page[1] with _gaq.push(['_gat._forceSSL']) but it's not the default. If it's not the default, it's not going to be used heavily across the hundreds of thousands of pages using Google Analytics. Privacy death by a thousand cuts.

[1]: https://developers.google.com/analytics/devguides/collection...

That's something that might be fixable with a user-script or a browser plug-in?

Maybe something for the likes of ghostery or adblock to implement?

Generally, however, the problem is concern over leaking sensitive data to insecure connections (e.g. load an HTTPS URL but your HTTP referer header on all your insecure HTTP requests tells people your URL).

I don't see any issue with loading an HTTP site and then making an HTTPS request to Google Analytics. It's better to secure part of an insecure page than to leak part of a secure one.

mixed content warnings only appear if http content is included on an https page

Ah ok neat, I got bitten by that once in the past, did not realize that the other way around is fine. Now that I think about it that's kind of logical because you can't really give more away than you are suggesting to the user, only less. Thank you.