Not only enabled, but in breach of the Google Analytics' Terms which state very clearly: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data. "
See section 7 "Privacy" here for the full text. http://www.google.com/analytics/terms/us.html