They just count how often a security report is fetched and an update check is performed. Both are done once when tails is booting. So I would not call this spying (both calls are made through tor, so IP leaking).