The Steam version has this large "activate your product" thing pop up, the retail version does not have that. If it has some sort of stealth activation with no key or prompts requires that would be the first I ever heard of such a thing.
Perhaps your friend is referring to the fact that when you load the game the first time GFWL tells you that you have to activate online to play, but really you do not.

No, based on what he told me he just install the game, double click on the icon and then he imediately had this popup (the one in the screenshot I posted), no prompt for a serial or anything. And the popup is from Securom not from GFWL.

Is he on Steam? The Steam version has that activation, the retail version does not.
Steam - SecuROM activation (unlimited) and GFWL activation for online features (15 PC limit).
Boxed - SecuROM disc check - GFWL activation for online features (15 PC limit but a picture of the CD Key gets them reset).
Steam has been having more DRM than retail copies lately... Risen, Batman, now BioShock 2.

Retail version, ordered from EBGames. Standard version not collector or anything.

Well I don't know what to tell ya, my copy never activated like that. That seems to be in French so maybe it's a Canada thing? Is he sure he got a US copy?
For the record here is the official DRM "scaled back" announcement from 2K: http://www.2kgames.com/cultofrapture/article/bioshock2drmupdatescaling
In that it is very vague what role SecuROM will play, but from the language it seems mighty likely the disc version just checks your PCs date and that the disc is valid, a standard disc check without an online component, which is what my boxed product does. It talks about scaling back Steam but does not speak with specifics, but since there is no disc for a disc check on Steam they likely used an unlimited online activation to check the validity of the exe.

The language is a securom thing, I have the same thing with other games, the game is in english but the copy protection is in whatever local language you computer is configured in.
I guess it is the Date/time check is online, if the date/time check was offline it would be way too easy to trick, you want to play the game before release date, easy, just put you date one week in the future and you are set...
So probably the online activation doesn't check if your serial number is valid like the first Bioshock but instead check the securom server to see the current date and if it's past release date activate your copy. That would explain why there is no "enter serial number" prompt.

It's likely that the activation shows nothing overt unless there's a problem. Thus it simply activates silently unless your internet connection is off or you have some kind of HIPS running (my firewall often catches many games trying to phone home, even when they don't require any kind of activation).

It would be the first game I have ever seen with that stealthy of an activation. There have been many games that activate online without any limits or anything but they still have a prompt of some kind, or a key. If this one activates somehow without ever prompting you it is a first as far as I know.
I'm tempted to instal it on my girl's crappy laptop offline just to see if it is true.

Please do that, it would be helpful to someone like myself who would only buy the game if it was installable and playable offline. But if it's more of the same as Bioshock 1 or GTA IV, I'm not going near it with a 10 foot Adam syringe.
Requiring online connection to servers is activation, whatever companies choose to technically call it.

Just finished it...
***SPOILER****
honestly I can't say that I totally hate it. It's more like wasted potential. I feel like I just played a 3rd-Party Mod of the game instead of a serious sequel.
I think we all agree that the story is faux into the core, innovationless and full of holes and unfinished side stories it's not even worth for a sequel.
What bugged me for one is that Tenebaum just disappeared after the first chap and never appeared again. Second thing: Why does it have to take AFTER Bioshock 1 and can't be just a damn prequel? It would've been more solid in the plot than thinking what happens afterwards.
I'd also buggle about the graphics, but personally, I gave up looking at the graphical level for a long time since the Next-gen shit started, because this is the cancer of all. I'd admit the graphics of Bioshock 1 were better, but this one had at least good face textures. Meh, game should've been rather a DLC instead a full sequel if you ask me.
Anyway, what pissed me off was the low gameplay execution. Yes, I like the improved combat system, the little sister adopting-feature, the frickin' DRILL-STINGER, or battling with the big sisters, but it became just really low afterwards.
At the beginning you had to interact with your environment, like crouching at holes, jumping, opening holes with your drill(STINGER,YEAAAH) and plasma, but afterwards starting at level 3 all the features became just meaningless, you could've skipped all the exploration and sister part just to finish the level in less than 20 minutes.
The enemies weren't that new. The brute splicer and Big Sister were fun, but seriously when I see all the concepts(yeah, I have the Rapture-edition), I could've expected more of it. They even seem to have reduced the number of splicer types(none of the splicers introduced in the homepage or previews were in it!), 2k just copied the same splicers from Bioshock 1 with the SAME DAMN AI!
Also, I don't want to come with the boss battles, since there was only one, at that was just an harder Spider-Splicer. Couldn't you have battled with "Alex the Great" instead? Or having another ridiculous finale battle? Or COLE?
My other gripes were the hacking system. Fuck, were they trying to fuck with me? It was even easier than the one from Bioshock 1, where you just had to type at the right time! It wasn't fun at all!
And the missions...how can they become more ridiculous? At Bioshock 1 you hunted after Cole's students, or tried to create a hilarious flame-thrower, but here? Oh my, on one level you just had to look for the sisters WHILE THEY WERE OPTIONAL ON ALL THE OTHER LEVELS!!!1
But my biggest gripe was the wasted potential of the said gameplay. The best thing in the game was that you controlled a Little Sister and see the world through HER EYES! Really mindblowing on my part. But you controlles her for like 5 minutes and the splicer didn't even hunt you! WHAT A FUCKIN' WASTE!
This is like playing a much cheaper version of Condemned! Giving you the impression of an awesome gameplay but in the end you just go from point A to point B and press the F button to finish the mission! Oh, and Drill the shit of each splicers with the Plasma-Traps.
Even the pressure you were supposed to have when Delta starts to die and Rapture starts to blow up at the end were no pressure at all! Honestly, didn't 2k looked up at Metroid Prime 3: Corruption for that?
I could say this game is total shit and an insult to the former game, but somehow I still enjoyed it.
What made still continue playing it was the story between Delta and his "daughter" Elanor. It was really bitter-sweet, and I kinda felt like I was a Big Daddy looking for mah girl. The morality decisions and the 4 alternate endings were also a good add-up, but it'S screwed up that you get a bad-ending if you kill Alex though he asked you to finish him.
I had the pure ending since I killed Stanley and spared Alex(WTF), but I wanted the good ending since this seemed to be the most authentic one. It fit to the outcome of the relationship and the fate of Delta.
I hope I will play Elanor in the next sequel(yes, I am sure there will be a sequel, if this shit is being released, I am sure 2k isn't scared to do another one), or controll Little Sisters, again.
I give it a 7/10 for at least making me to play it twice, a rare thing for next-gen portls. But better rent it.

Ok, I will try it. Her laptop is a piece of crap though, you have no idea what you are asking me to do... ;)

I don't know if I would go quite that far, I see it more as an expansion made by the B-team while the real talent works on a real sequel.
It was ok. I enjoyed it and finished it straight through which I only do with games I enjoy a good bit. It just wasn't the amazing experience the original was, and not just because it had been done but also because it lacked a lot of the soul and design.

I've been reading the DRM threads on the 2K forum as well, and I agree that they are very vague. My understanding is that the retail game's SecuROM component does go online. They say that SecuROM checks the exe and the date, which means that the application must go online - you can't check the date without a reference clock to check against. (The PC clock is useless because it can be changed by the user) No internet connection (or if the SecuROM servers are down) means that the date check fails and the game won't install. Essentially it's like any other online activation.
Also, supposedly the GFWL key can only be reset once, which means that you get 30 activations total and no more.
My interpretation, hard to know for sure without buying the game:
Steam: SecuROM activation (unlimited) + GFWL activation for online features (15 activation limit, may be reset once) + Steam built-in DRM
Retail: SecuROM disc check + SecuROM activation (unlimited) + GFWL activation for online features (15 activation limit, may be reset once)
So the Steam versions actually has three separate components that go online to check whether or not you are allowed to play the game. It would be funny if it wasn't so sad.

I hope you're right and I'm wrong; if the retail version can be installed and played without going online (using an offline GFWL profile) I'll probably order myself a copy. Looking forward to your test results.

Actually near the end of the thread, Liz (the 2k mod) clarify things a little : when she said "no activation" she actually meant "no activation limit" (page 161)
Based on various threads and the test my friend did with his version that seems to be the case, actually the game will install without problem (unlike the first one which required you to be online to download missing files) but will refuse to start the first time if you dont let it activate online.