I do not use Facebook but recently I created an account for the purpose of connecting it to an app. I uploaded several photos of myself to Facebook, did what I needed with the app and deleted the photos.

The next day I tried to login to my Facebook account and saw this:

enter image description here

How can Facebook use my photo to check if the account belongs to me? They now should not have any of my photos, right? Does this mean they actually keep deleted content?

  • 2
    Did you add any friends to the Facebook account? Maybe they tagged you in one of their photos.
    – Daisetsu
    Mar 26, 2019 at 2:25
  • 2
    They could have extracted information about your photos (race, hair color, glasses, age, gender, etc.). Maybe that's what they check. You could try uploading a picture of someone totally different and see if it takes it.
    – Daisetsu
    Mar 26, 2019 at 2:30
  • 1
    Facebook does facial recognition and lots of artifical intelligence powered analysis on user content. I think (supposition) Facebook algorithms deduced that the person on the many photos uploaded should be the owner of the account. As some way to prevent people from impersonating other people on Facebook (this is a regular problem for them), they put in place this verification : if you are actually the person on the photos, you should be able to take a new one of yourself. They will easily match the face. Again, this is just complete supposition from myself, not an answer backed up by source
    – Pacopaco
    Mar 26, 2019 at 2:56
  • 2
    It could very well be asking you to give them a photo specifically because it has none.
    – forest
    Mar 26, 2019 at 4:01
  • 3
    @Greendrake Well it's not as if Facebook isn't already known for lying...
    – forest
    Mar 26, 2019 at 5:38

6 Answers 6


2nd Kerckhoff's principle

This principle was conceived by a cryptographer for the cryptography field but applies to any securing process:

"It should not require secrecy, and it should not be a problem if it falls into enemy hands"

See: Kerckhoff's principle

I am not able to audit or proove a process which is kept secret. Hence there is no good reason to keep a securing process secret. The only 2 reasons I imagine to keep secret a securing process I would have conceived would be:

  • my process is weak and if my enemy read it he will be able to break it,
  • I don't trust my process strength and I prefer to avoid the risk of case one.

In both cases I should aknowledge that my process is risky, not audited, not prooven. My secret is just a lie, a lie to me and a lie to my users.

Personal analysis

Facebook writes:

"We use this photo to help us to check that this account belongs to you"

The truth is that if they don't have an evidence this picture is one taken of you as a physical person, they can't proove that this picture is an authentic one of you. They have a relation set between:

  • a photo: P,
  • a sending phone number, or a sending computer IP address: N,
  • an account name: A.

Not any relation with the physical person (the physical person might for example take a nice picture of his neighbour or his daughter).

R1: Facebook can't proove that a picture is an authentic one of a physical person.

What could they check? They could check that photo P is not in any:

  • database of photos signaled as used in identity theft and reported to Facebook, this search would take minutes,
  • database of photos used to "identify" other Facebook accounts, this search would take hours.

All in all, they could detect quickly any attempt of identity theft "from you", if and only if the previous registered photos were authentic, which unfortunately they can't proove (no one can demonstrate that they have any robust process to proove authenticity of photo see R1).

Personal conclusion

I can't trust this process for the above arguments and the lack of clear communication from Facebook. If there is any error in my arguments, someone will be able to see it and signal it publicly. This conclusion is not based on any good or bad reputation Facebook might have in the security field.

  • 2
    I don't see how this answers the question in any way. It seems more like a personal rant about Facebook's photo verification process.
    – Tom K.
    Mar 28, 2019 at 13:06
  • @TomK. the original question: "How can...", and I demonstrated "They cannot.". If you see any error in my answer, please write it, I'll either try to improve it or suppress it.
    – dan
    Mar 28, 2019 at 13:09
  • Maybe you should read the question again.
    – Tom K.
    Mar 28, 2019 at 13:11

Facebook does not need to store the deleted photos. All they need to do is to use the photos you uploaded to extract the biometric details to be able to recognise your face. That data is what they use to verify new photos.

This is all outlined in their privacy and security settings. You can turn the feature to collect facial biometric data off.

  • Well, the process appears to be manual: I submitted a photo to that form and it said they will get back to me once it is reviewed. More than 1 hour now, still no reply. If what you are saying is true, why would they do verification manually if bio data can be extracted again and compared automatically?
    – Greendrake
    Mar 27, 2019 at 19:02
  • 1
    I have no idea, then, what they would be comparing it to. But to answer the questions you asked, 1) they could use the new photos to compare to stored biometric data, 2) they do not need to hold on to your photos to do this comparison, 3) they do not need to hold on to deleted content if they store the biometric data. If your question really was, what are they going to compare the login CAPTCHA photo to, then you will need to change your question.
    – schroeder
    Mar 27, 2019 at 19:50

To determine if the account is authentic, Facebook looks at whether the photo is unique. -Wired

They simply need to see if the photo is in the system to decide whether to investigate you further. If you upload a photo used by another user, you may be trying to create a fake account. Facebook also tries to determine the location where the photo was taken and whatever other information AI could gather. All that can be done without any prior photos or other data from you.

As for whether they have your photos, Facebook says they will delete them within 90 days if you delete them.

Facebook said the photos are hashed and then deleted from its servers.

If you do decide to upload your photo for the test, it will be hashed, but the actual photo will be deleted.

The process is automated, including identifying suspicious activity and checking the photo.

You seemed to think the process was not automated in a comment, but Facebook says it is.

  • How credible does appear the claim that the process is automated if it is still going hours after started? The question is not what Facebook says. The question is what it does.
    – Greendrake
    Mar 28, 2019 at 0:20
  • 1
    @Greendrake Hanlon's razor: their system crashed or is overloaded. If I were to design such a system, I'd use a fuzzy hash which has the potential to have false positives. If it matched, it would require human review.
    – user71659
    Mar 28, 2019 at 1:01
  • @Greendrake None of us are there at the time it happens, but I doubt they would convince everyone at Facebook to lie about it. Its hard to get tens of thousands of people to lie all the same way.
    – Vit
    Mar 28, 2019 at 19:55
  • @Greendrake I'm sure a big part of the time it takes is based on the number of requests they process. Theres over a billion people on Facebook.
    – Vit
    Mar 28, 2019 at 21:39
  • Re convincing tens of thousands to lie: 1) only a small percentage of them would actually know the truth about how the process works (the rest wouldn't need to know); 2) an NDA would be pretty convincing for those who know.
    – Greendrake
    Mar 28, 2019 at 22:33

Sorry, I have no tinfoil hat for you today.

System 1 saves your photos and leaves a check in box "Account is ready for face verification".

System 2 checks said box and puts your account on an internal list of accounts that have to be verified.

You delete your photos and system 1 unchecks box "Account is ready for face verification".

System 2 does not check box "Account is ready for face verification" again before your next login, because the case that an account has only few photos that are verifiable and deletes them shortly after is a rare case and now the process hangs.

In other words:

The computation for biometric features is only done, when needed - read: only then when the verification process is triggered. There are no more photos to extract the data from, and now the verification process can't go forward.

  • Are you saying that it would have asked to upload face photo even if I did not delete the photos I uploaded initially?
    – Greendrake
    Mar 28, 2019 at 10:27
  • Yup, because your account creation behavior is pretty bot-like
    – Tom K.
    Mar 28, 2019 at 10:39
  • Okay, this sounds like a nice theory. Anything convincing that it is how things actually are?
    – Greendrake
    Mar 28, 2019 at 12:18
  • Unfortunately not, you'd probably have to file a bug report / tweet this to @Facebook and get a confirmation. ;) I don't know what the infrastructure or the verification flow at Facebook looks like. And the crux is, noone here does, unless someone here is a dev at Facebook. In the end we can only take our best theory, and my theory takes faulty code/flow as a basis, and that is probably the most common reason for weird behavior in systems.
    – Tom K.
    Mar 28, 2019 at 12:28
  • The verification process has now finished and resulted in disabling my account. Still it allows me do download all my data (don't yet know what's in there - should be nothing). But what this means is that the theory is wrong: the process went forward, and apparently manually as it resulted in disabling the account.
    – Greendrake
    Mar 28, 2019 at 22:50


Without detailed information, which Facebook probably wants to keep secret, I can only speculate about what information they could use.

Basically FB is looking to see if you are a human opening one personal account, according to their rules. They have to fight spam bots and spam farms, where farm indicates the fact that a single individual, part of an organization, may open and manage multiple accounts without necessarily using software automations.

They could acquire the picure along with:

  • It's cryptographic hash, to make sure one doesn't download and send a picture already posted somewhere on FB
  • A number of visual hashes (e.g. HSV indexes, wavelets) to perform the above check loosely and to avoid simple modifications of a downloaded picture
  • EXIF metadata, including the serial number of the camera that took the picture

They could also acquire, and retain, a hash of the face recognition of the subject being portrayed. This one is clearly to avoid someone opening multiple accounts. Or just to compare the face features with existing users.

In my opinion, the idea behind this is to make it a hard time for someone to open several accounts. No system is perfect, so you might be able to open two, say three, accounts using the same individual, but you'll have to take different pictures every time.

The more the system is accurate, the lesser chances you'll have to open the second account. But that might not be the ultimate goal of FB. They want to fight those who run dozens of accounts.


I don't think the answer above is helpful, in that they wouldn't have the data to go from if he deleted the photos in all cases even if they do in some.

The correct way to see what data they have stemming from your account is to to go Setttings> Your Facebook Information From there, you can see what photos you posted and what photos your were tagged in. It also lets you download your information so you can see exactly what is there.

That tells you what they have, as for the keeping old information, Facebook has said it can take up to 90 days to delete the data permanently. That means they would also get rid of metrics gained from an AI photo scan. https://www.nbcnews.com/card/facebook-does-delete-your-data-n864816

Facebook could potentially still have a photo of you for up to 90 days, but that message is automated and would still pop up even if they do not have photos of you any longer. It is considered a form of CAPTCHA, since it would be hard for a bot to replicate photos that are not publicly available, so even if Facebook does not have your photos saved, the site can scour the photos they do have to see if you are submitting a photo that is already on the site and therefore could be a bot using other people's photos. It can show you probably aren't a bot even if it can't recognize you as you. https://www.telegraph.co.uk/technology/2017/11/29/facebook-asking-users-upload-selfie-prove/

  • ... and if the biometric data was extracted when the photos were uploaded? Then they do not need the photos in storage.
    – schroeder
    Mar 27, 2019 at 17:42
  • That is true up to 90 days as the article said, but Facebook uses the photos as a CAPTCHA even if it doesn't have the boimetric data so that explanation does not cover every possibility.
    – Mike jkdsl
    Mar 27, 2019 at 17:44
  • So the first line in your answer is now incorrect? Because they still have the photos for 90 days even if he deleted them? I'm really having trouble following your logic.
    – schroeder
    Mar 27, 2019 at 17:50
  • I said they would not have the data in ALL cases. Sometimes it would sit on the server for a while, but not always. That means the suggestion of that in your answer can not always be true.
    – Mike jkdsl
    Mar 27, 2019 at 17:51
  • 1
    @Mikejkdsl I think you may be a bit confused, you said that "they wouldn't have the data to go from if he deleted the photos", they would not extract bio-metric data from photos every time someone logs in. It would be done when the photo is first uploaded, and then stored separately to the photo. Meaning that even if the user deletes the photo, the bio-metric data would remain.
    – meowcat
    Apr 2, 2019 at 4:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .