You know those pictures… the ones from that one party a few years ago, when you were a freshman… the ones you then put up on MySpace and Facebook?  The ones you need to remove now that Dad’s on facebook and can see?  Just in the nick of time, you deleted those.  So they’re gone, never to be seen again, right?

Well, Cambridge University released findings in June that said “Not always.”  Arstechnica.com put it to the test recently.  On 21 May, they deleted pictures from MySpace, Facebook, Flickr, and Twitter.  (Note:  With Twitter, I don’t know if they’re referring to Twitpic.com pictures, or actual individual tweets.  I’ve asked for clarification.)

Arstechnica reports that Twitter and Flickr deleted your pictures immediately, within seconds of the request.  The other two services, MySpace and Facebook, however, still have not deleted the data; they have simply removed it from public consumption.  Both services provide direct links to pictures uploaded; anyone who had copied those direct links before the deletion request came in CAN STILL SEE THOSE PICTURES.  And to make things even better, they can STILL be shared with friends, enemies, and family members… you know, those people like your grandma, who might have tough questions about that night you were the beer pong champ?  Or when you played the Presidential Debate Drinking Game?  Yeah.

Both sites claim to delete user info immediately, so we reached out to the companies to see what they had to say about the findings.

“MySpace takes the safety, security and privacy of its users very seriously and immediately deletes user content and profiles in their entirety when requested to,” MySpace spokesperson Amy Walgenbach told Ars via e-mail. “We are aware it can take longer for images to be removed from third party servers (servers from the vendor we work with) and are actively working to address this.”

Facebook offered a similar statement, but went a step further by claiming that third parties could not access the information even though it is retained on the server. “As stated in the Statement of Rights and Responsibilities, the governing document for the site, ‘when you delete IP content, it is deleted in a manner similar to emptying the recycle bin on a computer. However, you understand that removed content may persist in backup copies for a reasonable period of time (but will not be available to others),’” Facebook spokesperson Elizabeth Linder said. “We are working with our content delivery network (CDN) partner to significantly reduce the amount of time that backup copies persist.”

(Emphasis mine)

This is simply not true.  Arstechnica proved it; they also have provided links to the myspace and facebook pictures in question.  As of this writing, I was able to view them.  If I can view them, then Facebook has one of  two problems:  1.  Their rep is lying through his/her teeth, or 2.  All of their backups are available on line, all the time.

The moral of the story is easy:  If you want to keep those embarrassing photos private, keep them offline.