A line from the FAQ is interestingly vague
Requires an internet connection? Data charges? Is it conceivable that a Microsoft server somewhere plays a role in interpreting the codes?
Suspicion confirmed by another review
Unlike other tag technologies too, the Microsoft Tags don’t actually store the information. You see, all it stores is a unique ID which it then sends to Microsoft’s servers. This way, you can include much more information, and more variety of information, then if it was just on the tag itself. A nice side-effect of this is also the ability for publishers to gather reporting data on how many times it was seen.So Microsoft sits in the middle between 'those that create tags' and 'those that read tags' with privileged access to which tags that users access (it's not clear whether they authenticate the users' access), and so consequently indirect insight into the user's visits (isn't there a name for this?) to non-Microsoft sites.
To be fair, the FAQ does have a token privacy section
I wonder if the tag interpretation API uses WS-Trust.