Documented where? Honest question. The marketing department isn't going to list something that's totally non functional. Is there a privacy oriented spec sheet somewhere (that people will actually read)?

I can see this slipping through the cracks between different job roles' responsibilities, although after this incident they'd probably go through a post mortem and find a way to incorporate new checks into the product launch process.