Fetch/XHR as long as the tracker server have CORS * enabled, right? Then they can just inspect the blob data.