The study was conducted on 16 sites over the period of 30 days, and the results were awful. The details of the test, as described by LBT, are as follows:
For our experiment, we uploaded a test image onto 16 chosen sites with default permissions, then noted the URL of the uploaded image. Every site served the test image given knowledge of its URL except for Windows Lives Spaces, whose photo servers required session cookies (a refreshing congratulations to Microsoft for beating the competition in security). We ran our initial study for 30 days, and posted the results below. A dismal 7 of the 16 sites failed to revoke photos after 30 days
The sites that failed the test include most of the biggest social networks out there: Facebook, MySpace, Bebo, and hi5 flat out failed the test, meaning the deleted photos were still available at the same URL. On other sites, such as Blogger and Friendster, the removal of the photos in question took some time, but it was ultimately carried out within the 30 day limit. Only four sites - Flickr, Photobucket, Orkut and Windows Live Spaces (which used session cookies) - passed the test with flying colors.