Already Uploaded a Selfie? How to Get It Deleted

What you are actually asking to delete

Most people think of one thing: the photo. A face scan site usually holds several, and they have different lifetimes.

• The original image. Often deleted quickly, sometimes kept for a retention window.
• Derived measurements. The landmark coordinates, the distances, the ratios, the final score. These are small, easy to store, and often kept longer than the photo because they are what the product actually uses.
• The result text. The paragraph you screenshotted. It is generated from the measurements, but it may be stored as its own record.
• Account data. Email, login history, purchase records if you paid for anything.
• Server logs. IP address, user agent, timestamps. Usually kept for security and debugging, often 30 to 90 days.
• Backups. Copies that survive a deletion by hours or weeks.
• Third parties. Payment processors, analytics, cloud storage, or an inference API the site calls.

Deleting the photo does not delete the measurements. If you want the record gone, say so explicitly — that is the single most useful sentence in this article.

First, check whether there is anything to delete

Some tools genuinely do not keep the image. This site's privacy policy says the photo is used for one analysis, deleted from the server afterwards, not used for training and not shared. If that is accurate, there is nothing to retrieve after the result appears — which is a better outcome than a delete button.

How to check any site in about five minutes:

1. Open the privacy policy and search for the word "retention", "delete", "store" or "save".
2. Look for a number. "As long as necessary" is not a retention period. "90 days" is.
3. Look for a deletion route that is not an email address: a settings page, a form, a "delete my data" link.
4. Check whether the policy distinguishes the image from the analysis results. Most do not, and that silence is information.
5. Look at the footer for a company name and a jurisdiction. A site with no legal entity is hard to pursue and easy to ignore.

The pre-upload checklist covers the same ground before you press upload, which is the cheaper moment to ask.

The request itself

You do not need a lawyer, and you do not need to cite a statute to be taken seriously — though citing one helps when the first reply is vague. Two rights do most of the work:

• Access. Under the GDPR (Article 15) you can ask what data is held about you and get a copy. This is useful because it forces the company to look, and the answer tells you whether deletion is even necessary.
• Erasure. Under the GDPR (Article 17) you can ask for deletion when the data is no longer needed for the purpose it was collected for. A face scan result you already viewed usually qualifies.

The GDPR applies to companies outside the EU when they offer services to people in the EU, so "the company is in another country" is not automatically an answer. UK GDPR mirrors it. In California, the CCPA as amended by the CPRA gives a right to delete and a right to know, with a 45-day response window that can be extended once. Other countries have their own versions, with different names and different clocks.

Timelines matter when you are deciding whether to wait: GDPR requests should be answered within one month, extendable by two more for complex ones, and the company should tell you if it extends. If nothing arrives in that window, the silence is itself a compliance problem you can report.

A message that gets answered

Keep it short, specific, and impossible to answer with a template. Something like:

Hello — on 12 October I uploaded a photo to your face scan tool at [URL], while logged in as [email]. Please delete: (1) the uploaded image, (2) all derived face measurements, including landmark coordinates and ratios, (3) the generated result, and (4) any copy in backups, within the retention period your policy states. Please confirm in writing: the date the deletion was completed, which categories were deleted, and when backup copies expire. If you rely on an exception, tell me which one. This is a request under [GDPR Article 17 / CCPA right to delete]. Please reply within the statutory period.

Four things make that message work. It names the categories, so a reply that only mentions the photo is visibly incomplete. It asks for a date, which creates a record. It asks about backups, which is where "deleted" usually means "hidden". And it asks for the legal basis of any refusal, which is much harder to answer with a form letter than "we cannot do that".

What a real deletion looks like

A useful confirmation contains four elements:

1. Which data was deleted, itemised, matching your list.
2. When, with a date.
3. What was kept, and why — billing records, for example, often have to be kept for tax reasons, and that is legitimate as long as it is stated.
4. The backup window, or an explanation of why backups are out of scope.

If the reply says "your data has been deleted in accordance with our policy" and nothing else, ask again with the four points numbered. You are not being difficult; you are asking for the record that a regulator would ask for.

Five things that are not deletion

• Deleting the app. Removes the client. The server copy is untouched.
• Clearing your browser. Removes local storage, cookies, cached pages. Nothing on their side changes.
• Unsubscribing from email. Changes a marketing flag. Your account and results stay.
• "Deactivating" an account. Usually hides the profile and keeps the rows. Look for the word "delete", not "deactivate", and check whether logging in again restores everything.
• Deleting the result from your history. Hides it from you. It is still in their database.

How to check that it happened

You cannot audit a remote database, but you can collect evidence that a regulator would accept.

• Ask for a request ID and keep the thread. Email timestamps are evidence; a chat window that disappears is not.
• Test the account. If you asked for account deletion, try "forgot password" a week later. If a reset email still arrives, the account record still exists.
• Re-read the policy a month later. Retention language sometimes changes right after a wave of requests, and the version you relied on is worth saving as a PDF with the date.
• Watch for re-appearance. If you start receiving email from a related brand, the data may have been shared before deletion.

If they ignore you

Escalation is boring and effective, in this order:

1. A second email, one line, referencing the first and its date.
2. The hosting provider. Look up the site's IP, run a WHOIS, and use the abuse contact. Hosts forward complaints; some suspend accounts.
3. The payment processor, if you paid. Chargeback desks care about merchants that ignore data requests, and the merchant knows it.
4. The app store, if it was an app. Both major stores have privacy complaint routes.
5. Your data protection authority. In the EU and UK this is free and can be filed online. You generally need to show you contacted the company first, which is why the email trail matters.

The short version

Ask for the measurements, not just the photo. Ask for a date, not an assurance. Ask about backups, because that is where deletion goes to die. And if the answer is vague, ask the same four questions again, numbered — vagueness is usually a template, and templates do not survive specificity.

If you are still deciding whether to upload at all, the privacy checklist is the place to start, and the explainer on what a scan computes tells you exactly which derived values exist to be deleted.

Frequently asked questions

Can I ask a site to delete my face data if I never made an account?

Yes, if the site can link the upload to you — an order number, a payment, an email you entered. Without any identifier, the request is hard to execute because they cannot tell which anonymous upload was yours. That is an argument for uploading only where an identifier exists.

How long should deletion take?

Under the GDPR, one month from receipt, extendable by two months with notice. Under the CCPA, 45 days, extendable once by another 45 with notice. Many sites act faster; the legal window is the deadline, not the target.

Does deleting my account delete my face scan results?

Not necessarily. Account deletion and data deletion are often separate operations, and results may be retained as anonymised analytics. Ask for both explicitly, in the same message.

What if the site has no contact address at all?

Use the hosting provider's abuse contact and the payment processor. A site with no contact route is also a site worth reporting to whichever consumer authority covers your country — and a good reason not to upload there again.