Moat called automatically in torconnect, without user consent
When bootstrapping, we automatically schedule an internet test, which will make a moat request.
From our design documents:
Proxy Obedience
Prior to connecting to the Tor Network, the browser MUST NOT bypass Tor proxy settings for any content. User consent is REQUIRED when the browser needs to access remote services to facilitate connecting to the Tor Network (for example, to acquire bridges from the rdsys service).
Since we start the test automatically, we aren't sticking to the "REQUIRED" consent part.
Taken from wiki!1 (comment 3026741).