The researchers surveyed 16 websites including MySpace and Flickr. They posted photographs to the websites and noted their URLs before deleting them. However, when they checked back 30 days later, the links worked on seven of the sites.
"This demonstrates how social networking sites often take a lazy approach to user privacy, doing what's simpler rather than what is correct," one of the researchers, Joseph Bonneau.
"It's imperative to view privacy as a design constraint, not a legal add-on."
Facebook told the BBC: "When a user deletes a photograph from Facebook it is removed from our servers immediately. However, URLs to photographs may continue to exist on the Content Delivery Network (CDN) after users delete them from Facebook, until they are overwritten. This usually happens after a short period of time."
The research revealed that dedicated photo sharing sites such as Flickr and Google's Picasa removed the images immediately, unlike the social networks.
See also: Facebook rewards app developers