Understanding This Article

Foundational Purpose and Technical Function: Article 5 establishes liability protection for 'caching' services, the second of three intermediary service categories in the DSA's liability framework. Caching sits between 'mere conduit' (Article 4) involving only transmission, and 'hosting' (Article 6) involving permanent storage at user request. Caching services automatically and temporarily store copies of transmitted content to improve network performance, reduce latency, conserve bandwidth, and enhance user experience. Without this protection, entities operating CDNs, proxy caches, and similar infrastructure would face crushing liability for every piece of content flowing through their networks - making efficient internet operations economically impossible. The provision recognizes that caching is essential technical infrastructure serving purely operational purposes rather than editorial functions, justifying exemption from automatic liability for cached content. Article 5 directly continues Article 13 of the e-Commerce Directive 2000/31/EC, maintaining established principles while incorporating over two decades of technological evolution and CJEU jurisprudence clarifying intermediary obligations.

The Five Mandatory Conditions - Paragraph 1 Requirements: Article 5(1) establishes that caching exemption applies only when five cumulative conditions are satisfied. Failure to meet any single condition destroys the entire exemption, exposing providers to potential liability. First, providers must not modify cached information (paragraph 1(a)). This requirement preserves content integrity - caches must store and deliver bit-perfect copies of original content. However, 'modification' is interpreted narrowly: technical adaptations necessary for transmission (format conversion between compatible standards, compression for bandwidth efficiency, protocol translation) don't constitute prohibited modification if substantive content remains unchanged. CJEU case law emphasizes substance over form - converting video from one codec to another technically compatible codec for streaming efficiency doesn't violate non-modification if visual/audio content is unchanged. Conversely, inserting advertisements into cached web pages, stripping security headers, removing attributions, or altering substantive content clearly violates the condition. Second, providers must comply with conditions on access to information (paragraph 1(b)). If original content has access restrictions - subscription requirements, geographic blocking, age verification, authentication mechanisms - the cache must enforce identical restrictions. A CDN caching premium content cannot serve cached copies to non-subscribers just because it possesses the files. This prevents caches from undermining content owners' business models or security measures. Third, providers must comply with industry-recognized rules regarding content updates (paragraph 1(c)). Modern web protocols include sophisticated cache control mechanisms: HTTP cache-control headers specify how long content may be cached (max-age), when it must be revalidated (must-revalidate), or whether caching is prohibited (no-cache, no-store). CDNs and proxy servers must respect these directives. If a news website specifies cache max-age of 5 minutes, caches must refresh content at least that frequently. Ignoring update rules and serving stale content violates this condition. Fourth, providers cannot interfere with lawful use of technology to obtain data on content usage (paragraph 1(d)). Content originators have legitimate interests in understanding how their content is accessed and used - for analytics, advertising measurement, audience insights, and business intelligence. Caching services cannot strip analytics scripts, block measurement pixels, or otherwise prevent legitimate usage tracking. However, this requirement coexists with privacy regulations (GDPR, ePrivacy Directive) - providers need not facilitate unlawful tracking, only lawful data collection. Fifth, providers must act expeditiously to remove or disable access to cached information upon obtaining actual knowledge that source content was removed from the network, access was disabled, or a court/administrative authority ordered such removal or disablement (paragraph 1(e)). This creates a 'notice and takedown' obligation specific to caching: once caches know that source content is gone or legally required to be removed, they must purge their cached copies without undue delay. 'Actual knowledge' has the same meaning as Article 6 hosting context - clear, specific awareness, typically from explicit notices, court orders, or origin server signals (404 errors, removal confirmations). 'Expeditiously' means as quickly as reasonably achievable given technical constraints - minutes to hours for automated purges, not days or weeks.

Paragraph 2 - Transmission-Related Transient Storage: Article 5(2) clarifies that acts of transmission and access provision include automatic, intermediate, and transient storage of transmitted information 'in so far as this takes place for the sole purpose of carrying out the transmission in the communication network, and provided that the information is not stored for any period longer than is reasonably necessary for the transmission.' This provision addresses the reality that modern internet transmission inherently involves fleeting storage - routers buffer packets in memory, network equipment stages data for retransmission, transmission protocols require temporary storage for error correction and flow control. Without explicit clarification, even these microsecond technical operations might be deemed 'caching' with corresponding obligations. Paragraph 2 ensures that purely transmission-supporting transient storage remains covered by Article 4 mere conduit protection rather than triggering Article 5 caching requirements, provided two conditions hold: the storage must be solely for transmission purposes (not serving independent caching functions), and duration must not exceed what's reasonably necessary for transmission. A router holding packets in buffer memory for milliseconds while forwarding them remains mere conduit. An ISP keeping content cached for hours or days to serve repeated requests is caching under Article 5. The distinction is functional and durational - what is the storage's purpose and how long does it persist?

Paragraph 3 - Preservation of Injunctive Relief: Article 5(3) explicitly preserves courts' and administrative authorities' power to require service providers to 'terminate or prevent an infringement' in accordance with Member State legal systems. This critical provision ensures that liability exemption doesn't prevent judicial intervention against specific harms. While CDNs and proxy services aren't automatically liable for cached content, courts can issue targeted orders requiring specific action. For example, if a CDN caches infringing content, copyright holders can obtain court orders requiring the CDN to purge cached copies and block re-caching. If a proxy server caches defamatory content, affected parties can seek injunctions requiring cache purging and preventing future caching of the same content. However, Article 8's prohibition on general monitoring obligations constrains what courts can order: injunctions must be specific and targeted, not requiring comprehensive surveillance of all cached content. CJEU case law (Scarlet Extended, SABAM, subsequent rulings) establishes that injunctions can't mandate automated filtering systems identifying all potentially infringing content, as such general monitoring violates fundamental rights and imposes disproportionate burdens. Permissible injunctions identify specific content or specific infringements, enabling targeted blocking without wholesale content surveillance. The balance is delicate: courts need enforcement mechanisms, but providers resist expensive monitoring obligations, and users' fundamental rights constrain permissible orders.

Scope and Covered Services: Article 5 caching category encompasses diverse technical services sharing the function of temporary content storage for transmission efficiency. Commercial CDNs like Cloudflare, Akamai, Fastly, Amazon CloudFront, and similar services distributing cached content through geographically distributed server networks clearly qualify - their core function is temporarily caching origin content closer to users for faster delivery. ISP-operated proxy caches used to reduce bandwidth costs and improve subscriber experience fall under Article 5 when caching customer-requested web content, images, videos, and other material for repeated delivery. Reverse proxy caches deployed by content owners in front of origin servers (like Varnish or Nginx caches) technically qualify, though since content owner controls both origin and cache, liability distinction may be less significant. Forward proxy caches used by enterprises, schools, or governments to cache external content for their users are covered. Transparent caching systems operated by network operators to optimize bandwidth qualify. Browser caches present interesting edge case: while browsers cache content locally, they're typically end-user devices rather than intermediary services, falling outside DSA scope. However, if a service provider operates browser-like caching on behalf of users, it might qualify. The key factors are: (1) does the service perform intermediate temporary storage of content in transmission? (2) is storage automatic and for efficiency purposes? (3) does the service operate as an intermediary between content origin and end users? If yes to all three, Article 5 likely applies.

Relationship to Other Liability Exemptions and Content Moderation: Article 5 caching protection exists within the three-tier liability exemption framework (Articles 4-6). Many service providers perform multiple functions simultaneously - an ISP might provide mere conduit (network access), caching (proxy servers), and hosting (email, web hosting). Each function receives corresponding protection. Cloudflare, for example, provides mere conduit (DNS routing, DDoS protection transmitting packets), caching (CDN services storing temporary copies), and potentially hosting (certain products storing content at customer request). Proper classification requires analyzing each specific activity. Critically, Article 7 ensures that caching providers don't lose exemption protection by conducting voluntary own-initiative investigations or implementing proactive measures to detect, identify, and remove illegal cached content. A CDN that implements automated systems scanning cached content for malware, child sexual abuse material, or other illegal content, and removes identified material proactively, maintains Article 5 protection. Without this 'Good Samaritan' provision, caches might hesitate to implement safety measures, fearing that taking proactive action would destroy their liability exemption. Article 7 explicitly states that providers 'shall not be deemed ineligible for the exemptions from liability referred to in Articles 4, 5 and 6 solely because they carry out voluntary own-initiative investigations' or take measures aimed at detecting and removing illegal content. This encourages responsible caching services to implement content safety measures without jeopardizing legal protections.

Knowledge, Notice, and Expeditious Action: The Article 5(1)(e) expeditious removal requirement creates practical obligations when caching providers become aware that cached content must be removed. 'Actual knowledge' arises from: (1) explicit notices from content owners or authorities informing the cache that source content was removed or ordered removed; (2) technical signals from origin servers (404 Not Found responses, gone-status indicators) showing source content is no longer available; (3) court or administrative orders specifically requiring cache purging; or (4) provider's own discovery through monitoring or investigation. Once actual knowledge exists, providers must act 'expeditiously' - as quickly as reasonably achievable. For automated cache management systems, this typically means immediate purging upon receiving removal signals. For manual interventions, 24-48 hours might be reasonable depending on provider size and resources. Deliberate delay or inaction after gaining actual knowledge violates the condition and exposes providers to liability. However, actual knowledge must be specific and clear - general awareness that 'some cached content might be illegal' isn't sufficient. A valid notice must identify specific cached content, explain why source was removed or ordered removed, and provide sufficient information enabling the cache to locate and purge the content. Cache operators should implement procedures for receiving and processing removal notices, automated systems for detecting origin server removal signals, technical mechanisms for rapid cache purging, documentation of when knowledge was obtained and action taken, and processes for verifying purge effectiveness.

Content Modification and Permitted Adaptations: The Article 5(1)(a) non-modification requirement prohibits substantive content alteration but permits technical adaptations necessary for transmission efficiency. Drawing the line between permitted technical modification and prohibited substantive alteration requires careful analysis. Clearly permitted: format conversion between compatible standards (transcoding H.264 video to H.265 if compatible), compression without quality degradation (gzip compression of text, lossless image compression), protocol adaptation (HTTP/1.1 to HTTP/2, IPv4 to IPv6 address translation), encryption/decryption for transmission security (TLS termination and re-encryption), resolution adaptation for device compatibility if quality-appropriate. Clearly prohibited: inserting advertisements into cached content, stripping attribution or copyright notices, modifying text content, removing or altering security headers, injecting tracking scripts beyond those in original content, censoring or redacting portions of content, combining cached content with other material. Gray areas requiring case-by-case analysis: aggressive lossy compression noticeably degrading quality, format conversion between incompatible standards potentially altering user experience, adding performance optimization scripts not in original content, security-motivated header modifications changing content behavior. The guiding principle is whether modifications serve purely technical transmission purposes while preserving substantive content as experienced by users, or whether they serve provider's business interests (advertising insertion, tracking) or alter what users receive compared to origin intent. Best practice: caches should minimize modifications, document and justify any technical adaptations as transmission-necessary, avoid business-motivated alterations, and remain as close to bit-perfect caching as technically feasible while achieving efficiency goals.