Websites ‘keeping deleted photos’
User photographs can still be found on many social networking sites even after people have deleted them, Cambridge University researchers have said. — They put photos on 16 popular websites - noting the web addresses where the images were stored - and deleted them.
Context & Ripple Effects
Cambridge University's security group has a track record of auditing how much of the web stays exposed: back in November 2007 the same lab showed a Google search could surface the password behind its compromised Light Blue Touch Paper blog. This week the group applied that probing instinct to photo hosting — uploading images to 16 popular social networking sites, recording the web addresses where the files sat, deleting them, then checking whether the files were actually gone.
The result is a direct challenge to what a delete button promises: photographs remained retrievable at their original addresses across many of the 16 sites tested. Because the finding names no single platform but the category, it lands as a credibility problem for every social network that markets user control over content.
First-order effects
- Users of the 16 tested sites cannot treat deletion as removal — photos they erased stay reachable by anyone who kept the original web address, so the practical control they thought they had over their own images does not exist.
- The sites themselves face immediate questions about what their delete function actually performs: whether images are purged from storage and cached copies or merely hidden from profile pages.
Second-order effects
- Platforms that can demonstrate genuine file removal gain a differentiator, turning 'deleted really means deleted' from a technical detail into a trust feature in competition for users wary of posting personal photos.
- Data-protection authorities and privacy advocates acquire concrete evidence that retained 'deleted' content can contradict a site's stated practices, giving them a specific enforcement hook rather than an abstract complaint.
Third-order effects
- If user-side deletion stays unverifiable, pressure builds toward independently audited or regulator-defined standards for content removal, forcing platforms to re-engineer caching and storage so that a delete operation is a checkable event rather than a interface label.
- Over time this pushes the industry toward treating retention itself as a liability — the longer a platform keeps 'deleted' media accessible, the more it accumulates legal and reputational exposure it cannot easily shed.
The trend: Social platforms are being pushed from treating deletion as a user-interface gesture toward verifiable content removal, as researchers keep testing whether deleted actually means gone.