Firstly they know the YouTube IP address.
ISP's have an IP database. For example YouTube's ASN is AS15169. On the server side they would make a grouping for each service.
One of them is the default grouping and this is the billing group. When you make use of default group, that usage is recorded in the system.
For example a few YouTube addresses are listed below.
root@server ~>whois -h whois.radb.net -- '-i origin AS15169' | grep ^route
When you are trying to reach YouTube or other YouTube services (Google video storage) your phone will try to reach these IP addresses.
The ISP checks the IP address, and if it is inside the YouTube group, they don't apply charge at this group.
Another option is checking the SNI header at the initial HTTP connection.
When you make a connection with HTTPS sites not all the data is encrypted.
For example, when you make a search on Google, you can see the URL in your browser like this:
Encrypted data is
/search?q=hello+world and all page content. Now you are reaching a site like
www.google.com, but they don't know which page or the content inside of that page.
Some ISPs use SNI for this. For example in Turkey this method is used for making specific internet packages like 5GB internet+4GB Spotify or 7GB internet with unlimited WhatsApp. Also they use SNI for banning websites. Some websites use the same IP addresses like
wikipedia.org. If they try to block Wikipedia with an IP addresses they block all Wikimedia services.