OP here. Yes it was the same guy both times. The reason why I didn't call the police is because he didn't actually expose himself. He clearly knew that he was doing something wrong because he checked to see if we were watching. I asked two different managers what to do, and both failed to provide a satisfactory answer so I was left to my own devices. The first time I caught him I told him he wasn't allowed to do that. The second time I actually closed the browser and told him that this was the last time this was gonna happen.