Nope, people do not need to do investigate things before leaving ratings. New permissions request -> uninstall.

The new warning about data collection is misleading, nothing changed about how the extension handles data (and it's open-source, see it for yourself). Sponsorblock and similar addons are in the same situation.

It's a Mozilla issue: unlike GDPR cookie banners where you can explain how and why data is collected, there's no way to do that with the new data collection permission warning.

See "The new data transmission permissions seem to be misleading to users" on Mozilla Discourse.

Besides the shitstorm, I think this is a great (and essential) extension to easily identify misleading videos.

With recent updates this plugin went from requiring normal permissions to demanding your full browse activity & personal information. Disappointing and invasive.

People really need to investigate things a little bit before leaving bad ratings. It's safe, and open source. Relax people!

Thanks Dmitry!

Disgustingly invasive premium ad. Making money is perfectly fine, and having premium features is also fine, but the way the ad for it was implemented was terrible.

Leaving a five-star review to support in wake of recent data collection labeling requirements change. Thanks for the work you do on this add-on!

Thanks for the clear concise responses to the permissions update.

Thanks for explaining the 'new permissions'. It's a shame about how they're labelling this, because it rather dilutes the meaning of such a warning.

good stuff.

yeah so why do you need my personally identifying data?

and where can we verify you aren't just selling it to data brokers.

"The developer says the extension will collect: personally identifying information, browsing activity, web site content, website activity" Get this spyware off my device

spyware, please ignore whatever the 'developer' has claimed, I'm sure they've been hacked and this is a compromised account now, reported.

my browser has been taking a whole lot more memory since this got updated...

The developer claims that Mozilla changed the labeling system, but I have a lot of extensions installed, and none of them asked for additional permissions to collect my data. Why do I smell bs?

EDIT: I asked Mozilla about this situation, and they confirmed that the developer isn't lying. So, I am changing my review to 5 stars and would like to apologize to the developer for my accusations.
I also asked them to post some kind of clarifying message on the add-on's page.

New permission requirements make this an automatic hard pass - recommendation should be revoked.

Edit in response to the developer:

I think you're missing the point.

The issue isn't that Mozilla suddenly gave RYD access to the whole internet. It's that Mozilla has now made explicit data collection that was apparently already happening, but wasn't previously disclosed.

And "anonymous user ID" doesn't really solve that. It's a persistent identifier tied to YouTube activity. That's pseudonymous, not meaningfully anonymous.

More importantly, the extension being open source only tells us what gets sent. The RYD backend is still a black box. Once that data leaves the browser, we're being asked to trust RYD not to retain, correlate, profile, monetize, or sell it — particularly after we've learned the collection was previously undeclared.

The fact that the data is useful to RYD doesn't mean it's necessary for the extension's basic advertised function. Showing a dislike count doesn't inherently require building a persistent record of users' YouTube activity.

And the Chrome and Firefox stores don't even have identical data-collection declarations, so "Mozilla just changed the labels" doesn't really explain everything away.

That's why I find the response a bit tone deaf. The concern isn't "OMG, RYD can now read every website." It's "why does a simple dislike-count extension need to collect this much information about my YouTube activity, and why was that collection not clearly disclosed before?"


Edit 2:

The vote/registration pipeline isn't anonymous — it's pseudonymous and persistent, and your own code and privacy policy confirm it:

1) Persistent identifier: generateUserId() creates a unique 36-character ID at registration, which createBrowserCredentialStore() persists in browser.storage.sync. It isn't rotated per session or video.

2) Persistent correlation: performVote() sends { userId, videoId, value } to /interact/vote and /interact/confirmVote. Reusing the same identifier lets your backend associate votes and video activity with the same user over time. That's pseudonymization, not anonymization.

3) Additional identifiers: Your privacy policy says IP address and request time are also collected. Those can further associate the persistent identifier with a real-world network connection.

4) Your own policy treats the identifier as personal data. So describing it to users simply as an "anonymous" ID is misleading. Randomly generated does not mean anonymous when the value is persistent and specifically used to correlate records.

The appropriate description is pseudonymous, persistent user identification, not anonymous collection.