Application filtering does not work

Hello, even though the traffic from phones is blocked in my internet exit policy for Facebook and Instagram, and I can see in the logs that it is being blocked, end-user phones continue to have access. In my location, I have a controller device for the wireless side, and I can manage it with my PEF license, but I might face difficulties in user-based rules. What could be the reason for this? Despite blocking in the rule and seeing it blocked in the logs, why might they still have access?