The code is written by engineers to either solve a problem, or spy on the users. The policy document does not disambiguate between the two.
Include them in the web server logs of the system serving the static file and call it a day.
That’s pretty basic.