What does a tag learn about the phone that reads it?
Nothing that survives the read. An ordinary tag has no memory it can write to and no power once the phone leaves, so it cannot accumulate anything about the devices that have read it. The asymmetry surprises people: the phone learns about the tag, and the tag learns nothing.
The asymmetry
The phone powers the tag, addresses it, and reads what it holds. Afterwards the phone has the content, the identifier, the chip type and the memory size.
The tag, once the phone moves away, has nothing. It stops running. There is no state left behind and nothing to look at later.
People assume the exchange is symmetrical because it is a conversation. It is not: one side is a computer with storage and a network, the other is a chip that exists only while it is being held.
What crosses during a read
Commands, from the phone, and answers, from the tag. The tag receives instructions to select it, to read a block, to report its capabilities.
None of those commands carry an identity of the phone. There is no device name, no account, no phone number and no serial in the exchange.
So even during the read, while the tag is running, it does not learn who is reading it. It learns that something is reading it, which it needs no memory to act on.
The one exception worth knowing
Some chips include a counter that increments on each read, which is a genuine piece of persistent state and the only common exception to the rule above.
What it holds is a number of reads. Not who, not when, not from where. It cannot distinguish a thousand reads by one person from one read by a thousand.
Where a deployment uses that counter, it is usually to detect a tag being read far more than expected, or to include the count in an address so the destination can see it.
That last arrangement is worth noticing, because it moves information from the tag to the destination, and the destination is where the privacy question always ends up.
What follows from it
A tag on a wall cannot build a list of the people who passed. It is not a sensor and cannot be made into one by writing something clever on it.
A tag you carry cannot report on you either, for the same reason, which is the subject of a separate guide.
And a deployment that claims to know who tapped is describing its destination, not its tags.
The correct place to direct any question about what is being collected is therefore the address, every time.
Frequently asked questions
Does a tag store which phones read it?
No. An ordinary tag has no writable memory during a read and no power afterwards, so nothing is retained.
Does the phone send its identity to the tag?
No. The commands select and read the tag. There is no device name, account or serial number in the exchange.
What about read counters?
Some chips count reads. That is a number and nothing more: not who, not when, not from where.
Could a tag be made into a sensor?
Not an ordinary one. Sensor tags exist as a separate product family, and they are a different object entirely.