What data does an NFC business card tap actually send?

A tap on an NFC business card sends very little. The card passes a web link to the phone, and the phone then loads that page like any other website, which sends the usual technical details every web visit sends: an IP address, a browser identifier, the time and the referring page. The card itself learns nothing about the person tapping, and the owner does not receive the visitor's contacts or identity unless the visitor chooses to send them. This guide follows the data step by step, explains what MyInfo records and what you can see as a card owner, and sets out the UAE PDPL basics that apply to tap, scan and visit data. It is a practical explainer, not legal advice.

The short answer

Three different things happen when someone taps your card, and each handles data differently. First, the chip hands the phone a link. Second, the phone's browser asks the website for your page. Third, the visitor may or may not take an action, such as saving your contact or sending theirs. Only the second and third steps involve information about the visitor, and only the third gives you anything identifiable, and only if the visitor decides to provide it.

If you want the mechanics in plain language before the privacy detail, read how an NFC business card works and what happens when someone taps your card. This post looks at the same journey through a privacy lens, and it deliberately stays on tap, scan and visit data. For the legal outline of the law itself, see our separate post on PDPL and your digital business card.

Step one: what the tap itself sends

When a phone touches an NFC card, data flows from the chip to the phone, not the other way. The chip is passive and powered by the phone's magnetic field. It answers with a short record, normally one web address such as myinfo.ae/yourname. NXP's product page for the common NTAG chips lists a 7-byte unique serial number built into every chip and an optional counter that goes up each time the tag is read. Neither of these says who read it. The serial number identifies the chip, and the counter, if enabled, is simply a number.

So the tap does not send your visitor's name, number, location or account to the card. A normal tap only reads the chip: the phone does not write anything about its owner onto it, and a business card chip has no way to record who read it. The NFC Forum describes the technology's typical range as up to about 2 cm, which is why the interaction is deliberate and local. If you are weighing security in more depth, read can someone steal your data from an NFC business card.

Step two: what a page load sends

After the phone reads the link, it opens a browser and requests your card's page. This step is identical whether the link came from an NFC tap, a QR scan, a WhatsApp message or a typed address. Like every website visit, it sends technical information so that the server knows where to return the page: an IP address, the browser's user agent (a text string naming the browser and device type), the time, and the referring page if there was one. This is how the web works, not something specific to NFC or to MyInfo.

On iPhone, Apple documents that background tag reading shows a notification each time a tag is read, and the user taps it before the link opens. So the visitor sees the address and chooses to proceed. That small step matters for privacy, because it means a tap is a decision by the visitor, not a silent transfer.

What MyInfo records when a card is viewed

MyInfo's privacy policy is plain about this. When a card is viewed, MyInfo automatically records technical information about the visit, including the IP address, the browser user agent, the referring page, a session or cookie identifier and the time of access. According to the policy, it is used to show you visit analytics for your cards and to help secure the service. The policy also says MyInfo does not sell personal data.

The cookie policy adds detail: when someone views a public card, MyInfo records a visitor or cookie identifier together with the visit time, referrer and technical details so owners can see analytics. It notes that blocking cookies as a visitor may mean the visit is not distinctly counted, but does not stop the person from viewing a public card. This is useful to say to anyone who asks: viewing your card does not require an account, and a visitor can block cookies and still see the page.

What you see as the card owner

As an owner, you see much less than the server records. Card analytics, a Premium feature, shows total visits, unique visits, visits over time with a date range, and a view for all your cards or one card at a time. The feature page states it directly: analytics counts visits to your own cards and is a simple count, not a tool for tracking individuals. You see counts, not the identity of visitors.

Two practical points follow. First, your own visits may add to the totals, because visits are counted per visitor device, so treat the numbers as a guide, as explained in read your analytics. Second, do not expect analytics to tell you whether a visit came from a tap, a scan or a link. The documented feature is a count of visits, and a tap, a scan and a typed address all end as the same kind of page request. If you want to compare channels, a practical approach is to use separate cards or compare dates and places in your own records, and how to know if your digital business card is working shows how.

When the visitor chooses to share something

The picture changes only when the visitor takes an action. Here are the cases:

• Save Contact. The visitor downloads your contact file to their own phone. Data flows from you to them, not the reverse. What it contains is whatever you put on your card; see save contact and vCard.
• Exchange Contact (Premium). The visitor fills in a short form with their name, phone, optional email and optional message, and sends it. This is the one moment where personal data about the visitor reaches you. MyInfo's privacy policy says it stores this so you can view and export it, and the lead capture page says the inbox is only visible to you.
• Following a link. If the visitor taps your WhatsApp, Instagram or website button, they leave your card and the destination's own privacy practices apply.

Because the visitor types their details into a form on purpose, this is a clear, active choice. That matters under data protection law, as we explain below. See capture leads from your digital business card for how it works in practice.

Cookies and visitor identifiers

A visitor identifier lets MyInfo tell a returning device from a new one, which is how "unique visits" can be counted. It is a small identifier stored in the browser, and the cookie policy says that blocking it simply means the visit may not be counted as distinct. For owners, the practical effect is that unique-visit numbers are approximate. For visitors, the practical effect is control: they can clear or block cookies in their browser settings at any time.

There are also third-party services. The cookie policy notes that some pages load fonts, icons or scripts from third-party content delivery networks, which may collect connection information such as an IP address as part of delivering that content. This is standard on the modern web, but worth knowing if someone asks you where visitor data goes.

Tap, scan or link: is there any privacy difference?

For the visitor, the difference is at the very start. A tap requires being within a few centimetres and, on iPhone, a notification to approve. A QR scan requires the camera and shows the address before opening. A link in a message or email can be opened at any distance. After that, the page request is the same. If you hand out both, as many people do, see NFC vs QR code business cards for how they differ in use.

One consideration for owners is the audience. A card on a public poster, an event badge or a lock screen can be opened by anyone who sees it, and the page is public by default. If the audience should be limited, a Premium card can be made private with a six-digit access code. Read make a card private and private cards for clients and VIP events. Private cards are not listed in search or the directory.

PDPL basics for card owners

The UAE's general data protection law is Federal Decree-Law No. 45 of 2021, usually called the PDPL. It came into force on 2 January 2022 and is overseen by the UAE Data Office, set up under Federal Decree-Law No. 44 of 2021. DLA Piper's guide summarises its reach: it applies to processing the personal data of UAE residents, to controllers and processors in the UAE, and to those outside the UAE who process data of people in the UAE. A Primerus summary adds that exemptions include government data, security and judicial records, sector-specific regulated data such as health and banking, and free zones with their own legislation.

On consent, the same summary says consent is the primary legal basis and must be clear, specific and unambiguous, given through an affirmative action, though other bases exist, such as performing a contract. Data subjects have rights to access, correct, erase and restrict their data, and to object to processing. Controllers must report certain breaches to the Data Office.

Be careful about implementation details. DLA Piper noted that the executive regulations were unpublished as of January 2025, while some more recent guides say they are now in force. Reports differ, so check the UAE Data Office and official sources for the current position, or ask a lawyer if your use is more than a simple card.

How this applies to tap, scan and visit data

Applying the law to an ordinary card gives a short, sensible list of habits. We state them as good practice, not as legal conclusions.

1. Visit data is not yours to mine. Analytics gives you counts. Do not try to identify individual visitors from them.
2. Leads are different. When a visitor submits Exchange Contact, they have given you their details for a purpose: to be contacted by you. Use them for that. Do not add them to a mailing list or share them without a further, clear permission. See follow up within 24 hours.
3. Collect only what you need. The form asks for a name, a phone number, and optional email and message. That is already enough; see what to put on a digital business card.
4. Honour requests. If someone asks you to delete their details or stop contacting them, do it, and remove the lead.
5. Keep exports tidy. If you export leads to a spreadsheet, as in export leads and import into your CRM, treat the file as personal data and delete old copies.
6. Say what you do. Link to the MyInfo privacy policy and, if you run your own follow-up, say how you will use the details.

Telling visitors what happens

A short notice goes a long way. On a poster or stand, a line such as "Scan to open my card. Optional: leave your details and I will contact you about this enquiry" sets expectations. On your card, a text section can say how you use leads, using text sections. If you run a stall at an exhibition, mention it verbally when you hand over the card. Transparency is cheap, and it builds trust with UAE clients who are used to sharing details over WhatsApp.

If you are the one tapping

Visitors have more control than they may realise. You can check the address before opening, decline the iPhone notification, switch NFC off on Android, scan a QR code instead, or block cookies. You never have to submit the Exchange Contact form, and a private card can only be opened with the code the owner gave you. If a page asks for a password or payment, close it.

Frequently asked questions

Does tapping an NFC business card share my phone number or location?

No. The tap passes a web link from the card to your phone, not your details to the card. Opening the page then sends the usual technical information any website receives, such as an IP address and browser type, and MyInfo records those for visit analytics and security. Your name or number reaches the owner only if you choose to fill in an Exchange Contact form.

Does the UAE PDPL apply to my digital business card?

It can apply to personal data you handle, including the details visitors send you through a lead form. In general terms, collect only what you need, use it for the purpose people expected, respect requests to correct or delete, and keep it secure. The law has exemptions and some details depend on regulations, so this is general information, not legal advice. See the PDPL post and the official sources for specifics.

Build a card that respects visitors from the start: create your free MyInfo card.