Can an NFC tag track you?
The tag itself cannot. It has no power source, no memory of who read it, and no way of telling anybody anything. What can track you is the address it sends your phone to, which sees a visit exactly as any web page would, and that is where the question actually lives.
The object cannot
A tag has no battery, so it does nothing at all unless a reader is against it. It has no clock, so it cannot know when anything happened.
It has no memory it can write to during an ordinary read, so it cannot accumulate a list of the phones that have passed. And it has no connection to anything, so even if it knew something it could not report it.
Every one of those is a property of the silicon rather than a policy that could change. A passive tag is the wrong object to build surveillance on, and that is not going to be improved.
The destination can
Almost every tag holds an address. Tapping it opens that address, and the thing at the other end is an ordinary web server with ordinary capabilities.
It sees the visit, the network address it came from, the browser, and whatever it chooses to set or measure. None of that is specific to NFC and all of it is exactly what visiting any page does.
The addition is that a well built deployment gives each tag its own address, so the visit says which physical object was touched. A page visit becomes a place visit.
That is the honest answer to the question, and it points at the operator of the destination rather than at the tag.
What a series of taps builds
One tap is a moment. Many taps of the same deployment, from the same phone, is a pattern, and a pattern is where privacy questions become real.
Whether those taps can be joined together depends entirely on the destination: whether it sets something that persists, whether it asks you to sign in, whether the addresses are distinct.
A deployment that wants to join them can. A deployment that does not want to can arrange not to, and the choice is made by the operator rather than imposed by the technology.
This is why the useful question to ask about any tag deployment is not what the tag does. It is who runs the page and what they keep.
What you control
Whether to tap, which is the whole of it, since nothing happens until you bring the phone to the object deliberately.
What to do once the page opens, which is the same judgement you would apply to any link.
Reading a tag rather than acting on it, using an application that shows you the content instead of following it, which is worth doing for any unfamiliar tag in a public place.
Take NFC Tools. On iOS it requires an iPhone 7 or later running iOS 15.6 or later, and the app must be launched manually. Background reading is available from the iPhone XS and XR onwards.
Frequently asked questions
Can a tag record who read it?
No. An ordinary tag has no power of its own, no clock and no way to write a record during a read.
So how could a tag be used to track someone?
Through the address it opens. The site at the other end sees the visit and can tell which tag sent it.
Does that make tags worse than QR codes?
No. The same is true of a printed code, and for the same reason. The destination is where collection happens.
How do I check a tag without acting on it?
Read it with an application that shows the content rather than following it. That is the safe way to inspect an unfamiliar tag.