The most likely explanation is that one of his devices visited YouTube over HTTP (not HTTPS) and his ISP &quot;helpfully&quot; installed some kind of caching proxy that returned the wrong cookies to the wrong user. ISP have been known to cause mixups like that when cranking up caching aggressiveness to 11.