For a web exposed use case: TPMs are used as part of Windows's FIDO2 implementation, to make sure that the secret actually cannot be exfiltrated to other hardware.
That doesn't come with any particular privacy concerns however.
Right, I meant that there's no javascript API to communicate with a TPM directly as far as I know. You can still use a TPM as part of your auth to a website, it just has to go through a protocol where the browser handles the interaction. So a website can't leverage the TPM for tracking purposes afaik.
But web is really not so much my thing, so I'm now at the point where I'm probably going to start saying incorrect things.
That doesn't come with any particular privacy concerns however.