You generally don't delete files from a CDN. They just get evicted when they are the least recently used, which may never happen if the URL is still in circulation.
Facebook may have set near-infinite Expires/Cache-control headers on their static content, since it never gets overwritten. In that case, the CDN never goes back to the origin to check if the file is still there. The CDN they are using probably does have the ability to explicitly remove files (e.g., to respond to DMCA take-down notices), but probably doesn't have the ability to do this at Facebook picture deletion scale.
In other words, Facebook probably can't do much about it unless they get the CDN provider to make a big investment, build their own CDN, or switch to another provider that does support it (usually a costly decision).
No CDN caches content for that long, even if the origin tells them to. (Services like Akamai's NetStorage excluded, which Facebook most likely does not use.) It's quite obvious that Facebook is actually keeping the images on their origin servers long after they have been deleted.
I have this same issue with my site, but in case anyone is looking for a solution---I have a tentative one: NetDNA (or MaxCDN if you're not looking at their enterprise options) has a XML-RPC API that lets you purge individual files. So you can delete something on your server, then push the purge to them.
So while things have been bad in the past--they're getting better. Having everyone try to use s3 as a CDN has really forced the industry to evolve.
Doesn't Facebook run their own CDN, though? (At least that's what the URL's would suggest).
And in the case of major CDN providers like Level 3, removing assets is dead simple. They provide an API for you to pass assets to expire immediately. Or barring that, having a person spend 5 seconds on the keyboard to log into the control panel and paste in the URL to kill.
It is possible - the author of the Ars article had his pictures erased after writing the article.
In other words, they are now valued at $100 billion, but providing the most basic privacy functionality imaginable, after being given years to do so, is just too expensive?
Facebook may have set near-infinite Expires/Cache-control headers on their static content, since it never gets overwritten. In that case, the CDN never goes back to the origin to check if the file is still there. The CDN they are using probably does have the ability to explicitly remove files (e.g., to respond to DMCA take-down notices), but probably doesn't have the ability to do this at Facebook picture deletion scale.
In other words, Facebook probably can't do much about it unless they get the CDN provider to make a big investment, build their own CDN, or switch to another provider that does support it (usually a costly decision).