Most sites add analytics by default without having any CRO strategy in place let alone understanding of the privacy implications. It's just a case of "let's just add analytics and maybe we might find it useful sometime in the future". It doesn't help that Google Analytics, the bigger provider out there, has an atrocious, maze-like GUI that makes understanding of these matters difficult for even experienced web professionals.