How have courts ruled on cached or temporary files as evidence of possession of illegal images?
Executive summary
Courts are sharply split on whether files found only in a browser cache or temporary folders prove criminal possession of illegal images: many jurisdictions treat cached files as circumstantial evidence of prior viewing but require additional proof of knowledge, control, or affirmative acts to establish knowing possession, while others have convicted where the totality of conduct showed dominion and intent [1] [2] [3]. The doctrinal tension tracks two competing analytical frames—the “evidence‑of” approach (cache proves prior viewing) and the “present possession” or dominion‑and‑control approach (cache files themselves can constitute possession when the defendant had control)—and courts rely on case‑specific factors to reach different outcomes [4] [3].
1. Split in the circuits: evidence of viewing versus proof of possession
Federal and state courts have repeatedly resisted a bright‑line rule, instead bifurcating into lines that treat cache files as mere evidence that images were viewed and lines that treat cache artifacts as capable of showing possession when paired with indicia of control; the New York Court of Appeals and several state appellate courts held that automatic caching alone is legally insufficient to prove knowing possession without affirmative acts like saving or downloading (People v. Kent reasoning summarized) [5] [1], while other decisions (and some federal panels) have upheld convictions where testimony showed the defendant sought out images, enlarged or saved them, or otherwise exercised dominion (Romm and related cases) [6] [7].
2. Key factors courts weigh when cache files are the only forensic trace
Judges consistently look to a cluster of pragmatic factors—knowledge of the caching mechanism, ability to access and delete cache files, affirmative acts (printing, saving, emailing), repeated visits or payment for access to sites, use of search terms, and evidence of manipulation—to infer dominion and control; when those factors are absent, appellate courts (including the Fifth and Ninth Circuits) have reversed or refused to sustain possession convictions based solely on cached files [2] [8] [7].
3. Examples showing opposite outcomes from similar facts
Concrete examples illustrate the divide: in Winkler and related Fifth Circuit reasoning, convictions based only on temporary internet files were overturned where the defendant lacked sophistication, knowledge of the cache, or attempts to access the cached files [2], whereas courts like in Romm or in some state rulings found sufficient evidence where defendants enlarged, saved, or otherwise manipulated images on screen—actions judged to demonstrate dominion even if the images were only in active temporary files [7] [6].
4. Academic critiques and doctrinal framing that shape outcomes
Scholarly commentary distinguishes two conceptual approaches—“present possession” and “evidence‑of” possession—and argues that choice of frame materially alters results; defenders warn that equating viewing with possession criminalizes passive web browsing because browsers automatically cache content, while prosecutors favor an evidence‑of approach as a pragmatic tool to prove culpability when combined with behavioral evidence [4] [3] [9]. Law reviews urge courts to adopt consistent factor‑based tests to avoid arbitrary contours and to respect statutory mens rea requirements [10] [3].
5. Practical implications and where uncertainty remains
The bottom line for litigants and investigators is that cached or temporary files alone are often insufficient in many jurisdictions to establish knowing possession; prosecutors succeed only when they can present corroborating behavioral or forensic indicia of control, and defenses successfully challenge convictions by emphasizing automatic caching, lack of user knowledge, or absence of affirmative acts—yet because outcomes remain fact‑specific and jurisdictionally varied, published decisions do not provide universal guidance and gaps persist about how newer browsing models and cloud streaming affect the analysis [11] [8] [1].