The age-guessing site was unveiled at the Microsoft Build conference last Thursday, and within four days it had already received 240 million pictures from 33 million different users, according to a tweet from Microsoft vice-president Joseph Sirosh.
David Fraser, a Halifax-based privacy lawyer, said the terms of service appear to give Microsoft the right to use the photos for advertising or other purposes, but he said he doubts the company would purposefully deceive its users.
The contradiction between Microsoft's general policy and the website's promise not to keep the photos is a classic example of the problem with companies using generic legal language to cover all of their websites rather than tailoring agreements to individual services, Fraser said.
But he added that it is common among large Internet companies such as Microsoft, Facebook and Google.
Microsoft reiterated that the How Old Do I Look website, which uses a face-detection algorithm and machine learning to detect the age of those who upload photos, does not store pictures or personal information and was originally intended as a demonstration of the ease of developing on Microsoft's cloud services.
"We planned to take it down right after the keynote but it seems folks really enjoy playing with the service, so for now we are leaving it up," said Leanne Bull of Veritas Communications, which provided a statement of behalf of Microsoft.
What were originally developed as meaningful agreements of users' rights have now become policies designed to give companies as much control as possible, he said.
Howard Deane, director of the Consumers' Council of Canada, said it was reassuring that Microsoft volunteered that it would not keep the photos.
"People want their privacy policies in plain language and in smaller chunks," he said. "Businesses can start doing pretty good deals with people if they're just more open and transparent about how they're using their information."
Follow @Henderburn on Twitter.