It has been more than three years since Ars first started covering Facebook's inability to remove "deleted" photos from its servers, but this particular saga appears to be coming to an end. The company told Ars that its new photo storage systems are in place and are now deleting photos within a reasonable period of time, which we were able to independently confirm.
But this doesn't mean Facebook's privacy problems are gone. There are plenty of other issues that Facebook users have run into in recent years. As the company moves forward into its new role as a public entity, those issues will have to be addressed if Facebook wants to remain on top.
How we got here
We first began investigating Facebook, MySpace, Flickr, and Twitter in 2009 to see how fast our drunken-escapades-slash-cat-photos disappeared from the Internet after we deleted them from each of the social networks. Our method for checking for the photos was to save a direct link to the JPEG in question—easily obtainable by even the most computer illiterate by right-clicking on a photo and telling your browser to open it in a new tab/window, then copying the URL.
Though it took mere seconds for Twitter and Flickr to remove the photos from their content delivery networks (CDNs) after deletion from the site, MySpace and Facebook weren't so quick. MySpace got around to deleting the photos from its CDN several months later, but Facebook ended up being the embarrassing holdout. It took more than a year after our coverage began for Facebook to delete my photos from its CDN, but it seemed like only my photos were deleted—numerous Ars readers wrote in with links to their own photos that they tried to delete, and nearly all of those remained online (in direct-linkable form) for three years or more.
All along, Facebook had maintained that users having direct URLs to deleted photos was rare (I have piles of Ars reader mail to the contrary), and that the photos were only available online for a "limited amount of time." But in February of this year, the company finally admitted that its systems may not have been working correctly in the past, confirming that not all photos were deleted within a reasonable amount of time after all.
"The systems we used for photo storage a few years ago did not always delete images from content delivery networks in a reasonable period of time even though they were immediately removed from the site," Facebook spokesperson Frederic Wolens told Ars in February. "We have been working hard to move our photo storage to newer systems which do ensure photos are fully deleted."
Gone in 60 172,800 seconds
That has now changed. Since February, all of the direct photo links that were sent to me by Ars readers disappeared, and I began deleting my own photos again from Facebook's site to see how long it would take for them to be removed from the CDN. I tested this with two photos while saving their direct URLs, and both photos became inaccessible within two days of deletion.
Wolens confirmed to Ars that this was a result of Facebook's new photo deletion policy and storage systems.
"As a result of work on our policies and infrastructure, we have instituted a 'max-age' of 30 days for our CDN links," Wolens told Ars this week. "However, in some cases the content will expire on the CDN much more quickly, based on a number of factors."
Wolens wouldn't elaborate on what those factors are, but he did emphasize once again that people casually surfing Facebook would stop seeing the photo immediately upon deletion.
"As you know, the photos stop being shown to other users on Facebook immediately when the photo is first deleted by the user. The 30-day window only applies to the cached images on the CDN," Wolens said.
Better late than never, but 3+ years is still quite a while for the world's most popular social network to figure out how to remove images from its CDN properly. (Facebook CEO Mark Zuckerberg is probably glad the company's policies have finally changed, too, because there may be even more embarrassing photos that weren't downloaded by outsiders before they were "deleted" from the site.)
Instagram: even faster
Facebook bought photo sharing service Instagram in April of this year, so I thought I'd take a look at Instagram's photo deletion procedures as well. The two companies are unlikely to be completely integrated at this point, so it made sense that Instagram might operate a little differently from Facebook at the time of this writing.
I tested by deleting two photos over a period of four months. The first one was "deleted" in April but didn't disappear from Instagram's servers until last week, while the second disappeared instantaneously. There was no two-day delay, or even a two-hour delay, or a two-minute delay. The moment I deleted the image, it was inaccessible from Instagram's servers. Curious about the discrepancy, I asked the company about its policies.
"We mark photos as deleted on [Amazon S3] after a user deletion, though they may be cached in our CDN for up to 24 hours after. There was a short time period where photos weren't getting marked as deleted in S3, but that has been fixed," Instagram spokesperson Kevin Systrom said in response to the four-month delay in deleting my first photo. "It's easy for us to re-delete if there are images where this is the case, but they should be few and far between the billions of photos that we have up there."
Indeed, followup tests from different accounts yielded instant deletions on Instagram.
Where do we go from here?
If there's anything I've learned from covering this issue for the last 3 years, it's that this—and other privacy-related issues on Facebook—are quite widespread. Users have an exceptionally hard time getting anyone at Facebook to listen to their complaints, too; I know this because they usually Google around, find my old coverage here at Ars, and start begging me for help in finding a real person to answer their inquiries. I have received almost unreal levels of e-mail on just Facebook-related privacy problems over the last 37 months.
One reader named Joachim Schipper wrote to me with a devious plan to trick Facebook into removing his "deleted" photos from the CDN. The theory involved transferring the US rights of the photo to a friend (complete with notarized document and payment), and then having that friend send a DMCA takedown to Facebook in order to have the photo removed from the original poster's account. I was unable to confirm that this strategy would work, but when your users are resorting to this level of inconvenience in order to make sure their photos are really offline, you have a serious user experience problem.
Other readers wrote to me about different aspects of their Facebook experience remaining online indefinitely. Many pointed out that Facebook chats are only hidden and not deleted when a user thinks they're deleting them. Others said that deleted private messages seemed to magically resurrect themselves when using any one of Facebook's mobile apps or outside applications. And more than one user told me horror stories about how their friends-only Facebook albums somehow ended up being publicly accessible, and there's at least one unanswered Get Satisfaction thread on the topic.
Facebook is now a public company as of February of this year, so these kinds of issues will only get more and more attention from users and regulators alike. How Facebook handles those issues going forward will help determine how Facebook is seen by the public as more competitors enter the social networking space. So while the issue of photos staying on Facebook's servers indefinitely appears to be laid to rest, there's plenty of work left to do when it comes to handling user privacy, transparency, and user communications—and we're sure Ars readers will continue telling us their Facebook privacy problems while they wait for Facebook to come up with a solution.
reader comments
34