Replying to @random_walker
It's done in JS because the CMPs are entirely client-side. They don't try to hide it better because you, me, and some of our friends on here see it as evil but the vast majority don't know — and they don't get punished for it. It's only upside.
♥ 3