The study was conducted on 16 sites over the period of 30 days, and the results were awful. The details of the test, as described by LBT, are as follows:
For our experiment, we uploaded a test image onto 16 chosen sites with default permissions, then noted the URL of the uploaded image. Every site served the test image given knowledge of its URL except for Windows Lives Spaces, whose photo servers required session cookies (a refreshing congratulations to Microsoft for beating the competition in security). We ran our initial study for 30 days, and posted the results below. A dismal 7 of the 16 sites failed to revoke photos after 30 days
The sites that failed the test include most of the biggest social networks out there: Facebook (), MySpace (), Bebo, and hi5 flat out failed the test, meaning the deleted photos were still available at the same URL. On other sites, such as Blogger () and Friendster (), the removal of the photos in question took some time, but it was ultimately carried out within the 30 day limit. Only four sites - Flickr (), Photobucket (), Orkut and Windows Live Spaces (which used session cookies) - passed the test with flying colors.
This means that for most of these services user privacy isn’t very high on their list of priorities, as it’s technically easier to simply wait till the photos drop from the server’s cache. And yes, it’s all there (usually) in their TOS, but when you’re faced with the cold fact of your deleted photos not being removed even after 30 days, then “reasonable period of time” doesn’t really sound that reasonable anymore.