What are the privacy duties of a public tag?
The tag holds no personal data and creates no duty by itself. The duties attach to whoever runs the destination, because that is where a visit is recorded, and they are the same duties any web page carries. What is different is that people tap without deciding to visit.
Where the duty attaches
A tag on a wall holding an address is an object with a string written on it. It collects nothing and there is nothing about it to disclose.
The moment somebody taps it, a request arrives at a server you operate, and from then on the obligations are the ordinary obligations of running a website.
So the correct question is never what does the tag require. It is what does the destination require, and the answer is whatever your jurisdiction requires of any site.
What is different about a tap
A visitor who clicks a link has read the link, chosen it, and usually knows whose site they are going to. Somebody who taps an object has done none of that.
They may not know who published the page, whether it is the venue, the brand, or a third party running the campaign. That gap is created by the physical medium and it is yours to close.
They also had no opportunity to inspect the destination before arriving, which is a reasonable argument for keeping the first screen unusually plain and unusually explicit.
And a per tag address means the visit reveals where they were standing, which is more than a link from a search result reveals.
What that means in practice
Identify yourself on the page, immediately and by name, rather than in a footer.
Say what the tap does and what is recorded, in a sentence, before asking for anything.
Collect the minimum that makes the deployment work, and keep per tag records for as long as you need them rather than indefinitely, since they function as location data.
And make the page work for somebody who refuses everything, because a tap that leads to a wall of demands is worse than no tag.
The physical side
A tag should be visible as a tag. A hidden tag that acts when somebody puts a phone down is not a deployment, it is a trap, and it will be received as one.
Signage matters more than most operators expect: a printed line saying what the tap does raises use and removes the ambiguity at the same time.
Where a tag is in a place people cannot avoid, the case for restraint in what you record is stronger, not weaker.
The legal framing of all this is jurisdiction specific and is discussed separately, but none of the above depends on which country you are in.
Frequently asked questions
Does the tag itself create obligations?
No. It holds an address and collects nothing. The obligations attach to whoever runs the destination.
Is a tap different from a link?
In one respect that matters: the visitor did not read a link or choose a site, so the page has to say who you are.
How long should per tag records be kept?
Treat them as location data and keep them for as long as the deployment needs, not indefinitely.
Should the tag be visible?
Yes, and labelled. A hidden tag that acts when a phone is put down will be received as a trap.