Thousands of pictures including "naked selfies" have been extracted from factory-wiped phones by a Czech Republic-based security firm.
The firm, called Avast, used publicly available forensic security tools to extract the images from second-hand phones bought on eBay.
Other data extracted included emails, text messages and Google searches.
Experts have warned that the only way to completely delete data is to "destroy your phone".
Most smartphones come with a "factory reset" option, which is designed to wipe and reset the device, returning it to its original system state.
However, Avast has discovered that some older smartphones only erase the indexing of the data and not the data itself, which means pictures, emails and text messages can be recovered relatively easily by using standard forensic tools that anyone can buy and download.
The company claims that of 40,000 stored photos extracted from 20 phones purchased from eBay, more than 750 were of women in various stages of undress, along with 250 selfies of "what appears to be the previous owner's manhood".
There was an additional 1,500 family photos of children, 1,000 Google searches, 750 emails and text messages and 250 contact names and email addresses.
The company said: "Deleting files from your Android phone before selling it or giving it away is not enough. You need to overwrite your files, making them irretrievable."