It looks like North Carolina's data privacy laws are looser than many states: http://ftp.legislature.state.nc.us/EnactedLegislation/Statutes/HTML/BySection/Chapter_125/GS_125-19.html. Exception B1 looks open to ambiguous interpretation.

We examined Google Analytics' EULA and noted that you're forbidden form reverse engineering the code, they can change it any time, and if it sits on a private/SSL page it can architecturally render the entire DOM contents visible to Google via javascript, effectively exposing research habits with a third party.