They could theoretically do both by having the JS on the page set one cookie on the host domain and having the server response set one on the GA domain. I don't believe they do, however.

Shameless self mention: Chartbeat does not do this either.