They put photos on 16 popular websites - noting the web addresses where the images were stored - and deleted them.
The team said it was able to find them on seven sites - including Facebook - using the direct addresses, even after the photos appeared to have gone.
Facebook says deleted photos are removed from its servers "immediately".
The Cambridge University researchers said special photo-sharing sites, such as Flickr and Google's Picasa, did better and Microsoft's Windows Live Spaces removed the photos instantly.
You may have put your pictures in Facebook's bin, but you will still have to wait for the content delivery network to delete them
To perform their experiment, the researchers uploaded photos to each of the sites, then deleted them, but kept a note of direct URLs to the photos from the sites' content delivery networks.
When they checked 30 days later, these links continued to work for seven of the sites even though a typical user might think the photos had been removed.
User photographs can still be found on many social networking sites even after people have deleted them, Cambridge University researchers have said.
They put photos on 16 popular websites - noting the web addresses where the images were stored - and deleted them.
The team said it was able to find them on seven sites - including Facebook - using the direct addresses, even after the photos appeared to have gone.
Facebook says deleted photos are removed from its servers "immediately".
The Cambridge University researchers said special photo-sharing sites, such as Flickr and Google's Picasa, did better and Microsoft's Windows Live Spaces removed the photos instantly.
You may have put your pictures in Facebook's bin, but you will still have to wait for the content delivery network to delete them
To perform their experiment, the researchers uploaded photos to each of the sites, then deleted them, but kept a note of direct URLs to the photos from the sites' content delivery networks.
When they checked 30 days later, these links continued to work for seven of the sites even though a typical user might think the photos had been removed.
Lazy approach
Joseph Bonneau, one of the PhD students who carried out the study, said: "This demonstrates how social networking sites often take a lazy approach to user privacy, doing what's simpler rather than what is correct.
"It's imperative to view privacy as a design constraint, not a legal add-on."
But a Facebook spokesman defended the company's approach saying; "When a user deletes a photograph from Facebook it is removed from our servers immediately.
"However, URLs to photographs may continue to exist on the Content Delivery Network (CDN) after users delete them from Facebook, until they are overwritten.
"Overwriting usually happens after a short period of time."
Users of Facebook staged a revolt recently over rules which would have given the site permanent ownership of their data.
Joseph Bonneau, one of the PhD students who carried out the study, said: "This demonstrates how social networking sites often take a lazy approach to user privacy, doing what's simpler rather than what is correct.
"It's imperative to view privacy as a design constraint, not a legal add-on."
But a Facebook spokesman defended the company's approach saying; "When a user deletes a photograph from Facebook it is removed from our servers immediately.
"However, URLs to photographs may continue to exist on the Content Delivery Network (CDN) after users delete them from Facebook, until they are overwritten.
"Overwriting usually happens after a short period of time."
Users of Facebook staged a revolt recently over rules which would have given the site permanent ownership of their data.