Personal photos could still be on Facebook three years after being deleted, according to one investigation by a leading tech blog.

Ars Technica this week claimed that Facebook is still working on deleting photos from its servers in a timely manner, nearly three years after it first drew attention to the issue. The site reports that Facebook, whilst taking steps to ensure that photos and other data were deleted “within a reasonable period of time”, an older server could still be storing image files after the user has deleted their photos.

What that means is that photos that users thought they “deleted” from the social network months or even years ago remain accessible via a direct link.

Ars Technica found that photos that it deleted from a Facebook profile in 2009 were still available via a direct link to the jpg file one year later, even though they had been ‘removed’ from the main Facebook profile.

This week, the same blog reported that it was still able to view those files with the direct link, three years after the file was first deleted.

When the issue was raised with Facebook, spokesperson Frederic Wolens told the blog: “The systems we used for photo storage a few years ago did not always delete images from content delivery networks in a reasonable period of time even though they were immediately removed from the site.”

The problem stems from the fact that many older server systems do not remove “deleted” files but instead, simply allows those files to be over-written. The problem is less prevalent in newer systems.

Wolens explained that photos remaining online are stuck in a legacy system that was apparently never operating properly. He said the company is working on a new system that will delete the photos within six weeks.

“We have been working hard to move our photo storage to newer systems which do ensure photos are fully deleted within 45 days of the removal request being received,” Wolens said.

“This process is nearly complete and there are only a very small percentage of user photos still on the old system awaiting migration, the URL you provided was stored on this legacy system.

“We expect this process to be completed within the next month or two, at which point we will verify the migration is complete and we will disable all the old content” he added.