A good example of this is Clickpass that Hacker News uses for logins. With Google, it asks for access to "Google Contacts". There is no explanation of why it needs access to Contacts or what it is going to do with it. As far as I can tell, it doesn't do anything nefarious. I have seen other sites using Google Accounts for sign in with requesting OAuth access.