The same-origin policy prevents Google tracking in a iFrame from identifying the parent site, so technically "This website has no tracking or analytics." is correct. It does expose you to Google's analytics for the iFrame however, so it's down to how you define "this site"...