Thanks for raising your concern about the permissions.

RYD hasn’t changed how it handles your data. What changed is how Mozilla labels these permissions - not what the extension does with your data.

The same issue is discussed by Ajay, the author of SponsorBlock and DeArrow:
https://discourse.mozilla.org/t/the-new-data-transmission-permissions-seem-to-be-misleading-to-users/149410

The extension is actually recommended by Mozilla, so they do not consider it harmful or dangerous.

RYD uses only the data it needs to display dislikes and count votes.

Its site permissions cover YouTube and its own API at returnyoutubedislikeapi.com. RYD doesn’t read other websites, and these site permissions cannot be used to access them.

Personally identifiable information - RYD’s randomly generated, anonymous user ID, used to count votes. This isn’t your Google or YouTube account.

Browsing activity - moving to the next YouTube video, so the extension can send its video ID and fetch the new dislike count.

Website content - things like the visible like count, which helps work out dislike estimates.

Website activity - clicking Like or Dislike.

Again, we’re talking about YouTube activity. The extension isn’t watching everything you do across the internet - it simply can’t with these site permissions.

The new labels can sound alarming, but they don’t give the extension access to additional websites.

RYD’s source code is public, so you can check how it works: https://github.com/Anarios/return-youtube-dislike