well as long as people don't block images you still can track the client, the IP and so on but the general "over application mapping" you would have to use something like "IP+MAC+CLIENT" to have something like an identifier.
That's for the websites I personally block all tracking scripts with my main browser but still since I don't block Images I always will and can be tracked.
I don't know about google analytics heuristics but at the mobile word they actually create a fingerprint based on your "OS+installedapplications" which they use to actually profile your behaviour cross application.
When I was writing e-mail tracking software we used images with base128 encoded parameters to track your opening behaviour + redirects and so on, pretty basic this would mean integrating those param into your session but this leads to far.