There is something called "local storage" that allows applications to store more information than just a cookie. Cookies are sent to the server, while local storage, as the name implies, stays local. (That doesn't mean that this data can't be sent to the server via JavaScript.) But local storage makes it possible to make 100% offline applications if the whole webpage is cached / downloaded (assuming no online functionality is required).
edit: As for deleting this, if I click on the lock icon in the address bar in Firefox, I have an option to clear cookies and site data for the current site. I assume the "site data" is the local storage I mentioned. If you're using a Chrome based browser, you can probably google how to do the same thing.
JavaScript is already sandboxed. You can only execute functions where there is an actual API defined by the browser to do so, for example
Date.getTime()
. There is / should be no way to get, say, your device ID. (With the exception of unpatched exploits that allow executing arbitrary code. But keep in mind browsers are likely one of the if not the most security tested software.)What you linked to here appears to specific to Google Tag Manager in a way that I don't fully understand, but is not related to how websites usually execute JavaScript code.