How did you distinguish it from OAuth2? The browser it pops up in may not be one into which you're already logged in, in which case you saw what I would expect to see. Google's (dangerous) OAuth2 UX will first prompt you to login with a generic login page and only then ask if you want to share info with the third party.

However, requiring a Google login is sus for anything that could be sensitive, including a BDS campaign. It will share Google account info of whoever filled out that OAuth2 prompt with whatever service they are using. Might be a Google Form for their own account, might be some third party, who knows. Very bad practice.

The developer is a Palestinian, so I highly doubt it.

Here’s what’s actually happening:

• You click the “submit for boycott” button
• Your OS opens an in-app browser that attempts to open this Google Form which is what he’s using to collect new products for boycott: https://docs.google.com/forms/d/e/1FAIpQLSfHzDfF1SY7rRLtWuLvdfoVHl4UtK8v_iz5f39mKlKbZAsQpQ/viewform?pli=1
• The form isn’t open to the public and thus requires a signed in account to interact with
• Your in-app browser likely isn’t signed into Google already, so it prompts you to sign in so you can see the form

If your OS lets you re-open the link in your regular signed in browser you’ll see that it reuses your session and then you can see the form. There’s nothing nefarious happening here.

I don 't think it's a scam, but it's a great way for the developers to build a huge database of customer habits that they can sell to marketing companies.