They can point to a metadata URL, or store data. But the key is they have a unique id and can be used to verify ownership. Think of it like a global compound primary key: (chain id, NFT contract address, NFT id). For many things a database will suffice here, but it’s also useful to remove the dependency of a central authority. It’s worth exploring more.