Disappearing messages on work devices survived judicial review on 31 July 2026. In R (BB) v Commissioner of Police of the Metropolis [2026] EWHC 1986 (Admin), McKendrick J dismissed all four grounds of a challenge to Metropolitan Police guidance requiring officers to run WhatsApp’s 90-day auto-deletion function. The lawfulness of the policy turned on an export step, which is the part firms should be reading.
What did the High Court decide?
The claimant, anonymised as BB and a defendant in ongoing Crown Court proceedings, argued that the guidance authorised unlawful conduct, was unreasonable, and interfered with the right to a fair trial. The judgment, given in the Administrative Court, rejected each ground.
The Article 6 ground failed on a jurisdictional footing rather than on the merits of the policy. Any prejudice from deleted material in BB’s own prosecution was held to be a matter for the Crown Court to determine, not the Administrative Court, particularly with the Crown Prosecution Service not a party and the position on what had and had not been disclosed unresolved. The court also recorded concern that the officer in the case identified two further exported chats only after the hearing had begun, but held that this evidential complication did not undermine the lawfulness of the guidance itself.
Worth noting for anyone assessing how far the reasoning travels: the guidance was adopted in 2023 despite documented ICO concerns and reservations recorded in the force’s own data protection impact assessment, and it survived anyway. A DPIA that flags a risk is not, on this judgment, fatal to the policy it assesses.
Why does the export carve-out matter?
Because it is what the policy rests on. The guidance does not simply switch deletion on and leave the consequences where they fall. It requires evidential material shared by members of the public to be exported to another system before the timer runs, and it requires officers to identify themselves properly, using the force crest with their full name and rank.
Strip the export requirement out and a rather different policy is left: one that deletes material of potential evidential value on a fixed schedule with no route by which anything is preserved. Nothing in the judgment suggests that version would have survived. The 90-day timer was defensible because it operated alongside a mechanism for taking the material that mattered out of the system before it expired.
What this means for firms running disappearing messages
The transferable point has nothing to do with policing. Most firms now run client and internal communications across WhatsApp, Teams and comparable platforms, a good many have retention timers switched on somewhere in that estate, and this is the first substantial judicial treatment of whether a blanket auto-deletion policy is lawful where the material may later be disclosable.
The uncomfortable question is whether your own policy has an export step or only a deletion step. Auto-deletion is not unlawful in itself, and a firm with a defensible retention period, a documented carve-out for matter-related communications and a record of how it reached that position is in a reasonable place. A firm running disappearing messages with no carve-out at all is relying on a policy this judgment would not have saved, and the gap tends to be between what the retention policy says on paper and what is actually configured on the devices.
Firms already have to demonstrate a documented process when something goes wrong on the data protection side, which is the theme running through complaints handling under UK GDPR, and the same evidential discipline applies here. The ICO’s recent enforcement activity is a reminder that the regulator does look at what firms actually configured rather than what they wrote down.
How do litigation holds reach a messaging app?
Usually they do not, which is the practical failure most firms have not tested. A hold circulated by email to fee earners does nothing to a timer running server-side on a platform the firm may not administer, and a policy that depends on individuals remembering to preserve is a policy that will fail under CPR Part 31 and PD 57AD at the point it is examined.
Three checks are worth running this month. Establish which platforms carry matter-related communications and what the retention setting on each actually is, rather than what it is supposed to be. Confirm whether a hold can be applied at platform level or only asked for at user level. And document the reasoning behind the retention period you have chosen, because the DPIA trail is what turns a defensible policy into one you can show a court.
Auto-deletion is not unlawful in itself, but the ruling turned on the existence of an export step for material that matters. A firm running disappearing messages without a documented carve-out for matter-related communications, and without a litigation hold that actually reaches the platform, is relying on a policy this judgment would not have saved.