... without asking for permission! What is it trying to do? Bug or feature? I call it spyware.

I was made aware of this by Norton, and blocking the internet access didn't cause game termination. But that a game is trying to access the internet (and uploading something, if I interpret the Norton message correctly) without my approval, is a serious issue in my mind.

Is there a protocol entry for something like this? All I can see in the normal Norton protocol is that I have changed the rules for tq.exe ("you have defined firewall rules for tq ..."). When I launched Titan Quest, there was a Norton prompt informing me that tq.exe was trying to access a certain IP address (which I didn't write down) with an arrow pointing from the symbol of my PC to the symbol of that other IP address and asking me if I wanted to allow or block the access. I decided to block it permanently, and that was it.
To reproduce the message I might delete the firewall rule, re-install TQ, and run it again. But I still don't know how to store the message (I' not sure that I had the option to take a screen print at the time).

After running the game for the first time my firewall popped up asking if I wanted to allow TQ to access the internet, to which I said no, and then it ran fine. Don't know why.

I just installed it for the first time and didn't get a firewall notification from Windows Defender. Usually Windows always asks when I'm playing games if I want to make an exception, but not this time. Are you guys using Galaxy?

The IP address tq.exe is trying to access is 239.255.255.250.
I'm not using GOG Galaxy, and to block the internet doesn't prevent me from playing the game.
The issue is that tq.exe doesn't ask me for approval, and doesn't tell me why and what it's doing there. Without Norton, I wouldn't know that tq.exe is reaching out to the internet. This fits my understanding of spyware.

I looked up that IP address and found it to be an address used for SSDP, Simple Service Discovery Protocol. I'm no expert, but I think Titan Quest might be looking for other PCs on your LAN running Titan Quest?

Possibly, except that I don't have a LAN. The Norton firewall message also shows a symbol labelled "Port 1900" between my PC and that IP adress.
My point is not that whatever tq.exe is doing is a real threat (this may or may not be the case), but that it is trying to access something without my approval and without telling me.

if correct from what it sounds like is it could be auto collecting server data, which would then be used to ready the server list, or another part of multiplayer which is server side.
thats a guess anyway

my suggestion would be to allow it once, exit game then restart and see if it asks again.
as if it only asks once then high chance its simply to gather server data or something else which co exists with multiplayer.
if it asks again, could just be it updates servers list on startup or something.

this guess of mine comes thanks to the info provided by others in this thread.

plus also since i know of a couple games which auto connect to the internet on loadup, and toss you a little popup well during game letting you know when new online matchs are up.
said popups appear in singleplayer gameplay.

I have also done a little investigation regarding IP 239.255.255.250, and I tend to agree with you. Most importantly, that address doesn't appear to be a private address assigned to someone outside my PC. If true, TQ.EXE's request can't be considered spyware, but rather a bug in the sense that the developers left some multi-player code active in the single-player game. If I may add, a bug which should have been spotted during the most elementary system or acceptance test: to start the application and watch the result. Throws a light on the vendor's QA.

As far as I'm concerned, I'll simply let my firewall block this attempt permanently, and ignore the issue.

Well, but it's not a stricty single-player game, so why should it be a bug? How should the game know what you intend to do (e.g. never play a LAN game).

First of all, I'm still not sure what really happens. All I know is that my firewall informs me of an attempt to reach a certain IP address. According to information I obtained from searching the internet, I think it's probably not a private IP address owned by some outside server, but an address used by or for the service SSDP, for a purpose which may have to do with obtaining information about the LAN my PC operates or belongs to. Thinking is not knowing, and I know far less about what all this means. And I shouldn't have to be a network expert to understand what TQ.EXE is doing.
The main point is that this happens without my approval, even without informing me. I trust my firewall to protect me from unauthorized communication with the internet, and that my firewall thinks it's necessary to alert me is reason enough for me to be concerned - and it should be reason enough for the vendor of the game to avoid such a situation.
The main difference between SP and MP is that MP needs internet access while SP doesn't. Thus when SP tries to access the internet, it may be a bug or a feature, but it's not a normal property of SP. If it's a feature, I must be informed by the program, and because I'm not, I call it a bug, something that happens unintentionally, is not part of the normal functionality. Otherwise I would have to call it a deliberate attempt to do something behind my back, malware. That TQ supports MP, too, is true, but not an excuse - a designer could easily take care of the distinction between SP and MP. And QA should have spotted the issue before releasing TQ.
If unintentional, it's bad QA, bad design and / or bad coding, whatever, with other words, a bug.

Disclaimer: No offense intended, I have nothing to gain from defending the devs, I just like playing devil's advocat against people who rush to conclusions, which you do in my opinion, again no offense.

The IP adress is definitely part of the UPnP protocol (see quote below) and thus necessary for the MP part of the game. Is that my assumption? Yes. Is it very, very likely? Also yes. Could it have been done differently? Maybe, but that's not a bug, that's a difference in design philosophy between you and the dev in my opinion. We both don't know the source code, maybe there's a valid reason for the game to make that "hey are there other computers running TQ on the (local) network" (or something similar) call at startup instead of later.
As for "the program has to inform me about that": Yes, I agree with you, but does that make sense for everyone out there, all the computer illiterate people, who just want to play the game? Sometimes it's necessary to hide something the program does from the normal user so said user is not confused by that: "program is asking me/ telling me about weird shit, I just want to play my game!" I prefer having the boot log of my computer shown when I start it up. Most people don't, so Microsoft and others hide it behind a nice animated screen.

Sometimes it's neither malice nor stupidity (as per the usual phrase) on their part, but rather information they have and you don't (in this case the source code/general knowledge about the inner workings of the game). from: https://technet.microsoft.com/en-us/library/bb727027.aspx

No offense taken. It's good to exchange diverse opinions, and you raise fair points.
We continue to disagree in one point, though: I don't want software on my PC to reach out from my PC without my approval. This is not a question of computer literacy (I consider myself to be half-literate, as far as networks and connectivity are concerned) or convenience, even within my LAN. Conversely, if my PC were a component of a LAN, and it would tell me that a program on another PC had tried to access my PC or the LAN server, then I would pay the guy responsible for that other PC a visit immediately ... - unless it was an acknowledged policy on that LAN that such an access was legitimate. It's a question of security, and not one of convenience. If people are not interested in being informed what's going on on their PC's, then they should not use virus protection and / or a firewall in the first place (and assume responsibility for the damage they could cause for themselves or others by their ignorance)..
Viruses, troians and the like spread by transmission from one PC to others, be it through the internet or through a LAN. I don't accuse the TQ developers of spreading malware, obviously, but they should be more sensitive. And, by the way, during the time I used to manage a developer team (in a commercial B2B environment), it was an acknowledged design standard not to tamper with the customers' IT environments in an undocumented and for the customers transparent fashion.
I know that TQ is not the only program doing this, and not the worst - others do send information to an external server without telling you (another good reason to use a firewall!) - but this doesn't justify them.
The correct way to do it would be to have an option "check LAN" (or whatever they call it), with an explanation and a default set to "no".