They can recognize your face as you tap at the turnstile. Maybe they don’t do it now, but if they currently don’t they will in the name of anti-terrorism.

For a typical workday there are so many datapoints: Checking into the secured bicycle parking, walking through the turnstiles at the exit. Walking into the train station. Walking out of the train station. Walking into the metro station. Walking out of the metro station. Entering the bus. Exiting the bus.

And the opposite way when I go home.

I asked them to delete the entering/exiting data on the secure bicycle parking as it's a free service but they declined as their system couldn't handle manual data removal.

TfL has openly said they track mobile device movements in their network.

The same system exists for the Dutch public transport (exactly the same cards). Privacy wise you are able to buy an anonymous card with cash. But ... the operators are phasing out machines which are able to accept cash faster than you can find them and they are idiotically expensive if you want to replace them every few weeks as they are tracking you anyways even on the anonymous cards.

It’s tough to use TFL anonymously.

You only need to pay once by card for them to link it to you.

You cannot get refunds (e.g. train delay) without registering the card.