Norwegian Translation Codes (no, nn, nb) - Which to use on a website?

As recommended by W3C, you should be using nb as it is more specific than the macrolanguage no.

Use macrolanguages with care. Some language subtags have a Scope field set to macrolanguage, ie. this primary language subtag encompasses a number of more specific primary language subtags in the registry.

[…]

You can find the more specific (ie. the encompassed) subtags by searching the registry for Macrolanguage: <subtag_name>. Alternatively, the Language Subtag Lookup tool will automatically list these for a given macrolanguage (example).

As we recommended for the collection subtags mentioned above, in most cases you should try to use the more specific subtags, but there are a small number of important exceptions. These are situations where you should continue using a macrolanguage subtag for reasons of backward compatibility.

[…]

source: https://www.w3.org/International/questions/qa-choosing-language-tags#langsubtag > Decision 1: The primary language subtag > Use macrolanguages with care

You can find the details about codes no (Norwegian), nb (Norwegian Bokmål), nn (Norwegian Nynorsk) and all the others at https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry.

I assume your concern is with regard to Norwegians and not compliance with some statutory requirement (if there is any such requirement, which I doubt, I am certain that it wasn't arrived at by opinion polls in Norway). The code "no" refers to any form of Norwegian, and "nb" refers to Bokmål, "nn" referring to Nynorsk which would definitely be inappropriate. The code "no" refers to any version of Norwegian so includes "nb" and "nn" as well as all other dialects, which don't have separate ISO codes. The code "nb" is more narrowly Bokmål. When a web page offers Bokmål and Nynorsk versions, you will see appropriate use of the two codes, but if the page is available only in Bokmål, I believe that the majority practice is to identify the language as "no" thus not by implication excluding other forms of the language (also, non-coincidentally, aligning with the country code). For example, gulesider does not offer a Nynorsk page, is written in Bokmål, and uses the code "no", the digital archive, ruter, the transportation company, Oslo Metropolitan U and the Valdres web page do likewise. However, the University of Tromsø and University of Bergen are likewise in Bokmål but they explicitly identify as "nb".

It would be an interesting computational sociological study to see what the actual patterns are in web-pages. I suspect that there are ideological issues, for example the position that "no" is an inappropriate language code because there is no written form that is neutral between "nn" and "nb", therefore you should say which one it is.