Websites can request several configuration settings from your browser in order to help them printing the best page format for you.
But by requesting your browser's specific abilities (here canvas is used for graphical rendering), websites could fingerprint your browser (if you have a unique configuration) across multiple sites.
This is related to the Panopticlick (https://panopticlick.eff.org) method the EFF exposed, using other information sent by your browser to uniquely identify you, even without access to your IP address.
The vast array of information sent makes it easy to end up with a very unique, thus identifiable, signature.
Also, you have to bear in mind that against a very large and capable adversary that listen to all Internet traffic, it can easily follow that type of trace if it exists; it's not only the individual websites requesting this information (which 99% is legitimate, just needed to improve rendering) that you should be wary of but the global big brother that is always looking over your shoulder. Also....I noticed when I went to my https://recoveryfarmhouse.net website the same pop up came up on Tor. One of the plugins that I use on the site shows me "live visits" which are listed by IP. It's a security plugin just so I know the activity on my website. Since I don't know a whole hell of alot about coding and security all I get from an IP is usually your ISP's main location that your using. iT DOESN'T narrow down to absolute location. Idk, not really sure what I could do with just an IP address if I tried. Wish I knew more. I do know this...I had one wordpress plugin in the past that actually saved wrong passwords. The implications behind that are pretty steep. Forget which one it was. Not all info gathering is innocent that is for sure.