There's no whitelist. I've been using this in Nightly for a while and the ability to block youtube videos from autoplaying is great.
But what would the solution be?
A) mozilla keeps a list of domains who can autoplay on their own domain. I am not a fan of this as mozilla would now need to vet sites, and could heavily influence all sorts of metrics on affected sited
B) websites can identify themselv as mediaSite or similar, where the primary focus is the video. However this would allow any site to use that tag, and solve nothing
https://developers.google.com/web/updates/2017/09/autoplay-p...
"We are also allowing sites to autoplay audibly if the user has previously granted them camera/microphone permission, so that sites which have explicit user permission to run WebRTC should continue to work as they do today."