What does the site behind a tag see?
What any web visit reveals: an address, a browser, a rough location from it, and whatever the site chooses to set or measure. What is added is which tag you tapped, since a well built deployment gives each tag its own address, and that makes the visit a place as well as a page.
The ordinary part
A tap opens an address in a browser, and from that moment it is a web visit like any other.
The server sees the network address the request came from, which gives a rough geographic area, the browser and platform, and the time. It can set whatever it is permitted to set, and measure whatever it chooses to measure.
None of this is a property of NFC. It would be identical if the visitor had typed the address or scanned a printed code.
Which tag, and therefore where
The part that is specific is that the address itself carries meaning. A deployment that gives each tag a distinct address knows which physical object was touched.
That converts a page view into something more: this person was standing in front of this object, at this time. For a poster in a station or a label on a shelf, that is location data assembled without any location permission.
It is also exactly what makes tag deployments measurable, and it is why every serious deployment does it. The capability and the privacy question are the same feature.
The measurement side of this is covered from the operator's point of view elsewhere on the site.
What can be joined together
Whether two taps by the same person can be recognised as the same person depends on the destination, not on the tags.
If the page sets something persistent in the browser, later visits can be linked to earlier ones. If it asks for a sign in, they certainly can. If it does neither, joining them is guesswork.
A visitor cannot tell which of those is happening from the outside, which is precisely why the disclosure on the page matters.
What an operator should conclude
That you are collecting, whether or not you intended to, from the moment each tag has its own address.
That the visitor arrived without choosing a website, so the page carries more of the burden of saying who you are than an ordinary landing page does.
That per tag addresses should be treated as location data internally, with the retention that implies, rather than as anonymous page views.
And that the honest version of this is easy: say what is recorded, keep less than you could, and make the page work for somebody who declines everything.
Frequently asked questions
Does the site know which tag I tapped?
If each tag has its own address, yes. That is standard practice in any deployment that measures anything.
Is that location data?
In effect, for a tag fixed to a place. The visit says the person was in front of that object at that time.
Can two taps be linked to me?
Only if the destination sets something persistent or asks you to sign in. That is a choice made by the operator.
Is any of this specific to NFC?
Only the per tag address. Everything else is what any web visit reveals, including from a printed code.