Quick answer

Cyber libel is committed when a person authors and publishes through a computer system a defamatory statement that identifies another person or organization and is legally malicious. It is punishable under Section 4(c)(4) of the Cybercrime Prevention Act in relation to Articles 353 and 355 of the Revised Penal Code.

If you are the complainant, preserve the original post and account information immediately, identify when and how you discovered it, and file a sworn complaint with the proper prosecutor’s office before the offense prescribes. If you are accused, do not ignore a subpoena, arrest warrant, or court notice. Preserve your own records, avoid contacting or attacking the complainant online, and have counsel assess authorship, publication, identifiability, defamatory meaning, malice, privilege, venue, and prescription.

Cyber libel generally prescribes in one year from its discovery by the offended party, the authorities, or their agents. Discovery and interruption of prescription may involve disputed facts, so neither side should assume that the date displayed on a post automatically resolves the deadline.

What counts as cyber libel?

Section 4(c)(4) of Republic Act No. 10175 applies ordinary criminal libel to unlawful publications made through a computer system or similar technology. This can include an original statement published through social media, a website, blog, online forum, messaging service, email, or another digital platform.

The prosecution must establish all the essential elements:

A defamatory imputation. The statement attributes a crime, vice, defect, dishonorable act, condition, status, or circumstance that tends to expose a person or juridical entity to dishonor, discredit, or contempt.
Publication. Someone other than the author and the person defamed received, saw, or learned of the statement. A private message sent only to the person being criticized ordinarily lacks this element, but copying or forwarding it to a third person may constitute publication.
Identifiability. The person defamed must be named or sufficiently identifiable from the words, images, context, or surrounding circumstances. A name is not always necessary, but vague suspicion is not enough.
Malice. The applicable form of malice depends on the character and occasion of the statement. Some defamatory imputations carry a statutory presumption of malice, while privileged communications require proof of actual malice.
Use of a computer system. The allegedly libelous material must have been committed through a computer system or comparable digital means.

Words are assessed as a whole, in context, and according to how ordinary readers would understand them. Insults, criticism, satire, opinions, and accusations are not automatically interchangeable. A court examines the actual language, its factual implications, the audience, the surrounding discussion, and the evidence of purpose and verification.

Who can be held liable?

In Disini v. Secretary of Justice, the Supreme Court sustained cyber libel as applied to the original author of the online post. It invalidated the use of the Cybercrime Prevention Act’s aiding-or-abetting provision against people who merely receive and react to a libelous post.

Accordingly, merely liking, reacting to, or passively receiving someone else’s post does not by itself make a person the original author of cyber libel. Liability should not be assumed from a share button or account tag alone. The evidence must show what the accused personally authored, published, or caused to be published.

A person who adds a new defamatory caption, materially changes content, adopts an accusation as their own, or independently republishes it presents a different factual question. Likewise, page administrators, editors, employees, and account owners are not automatically liable simply because of their position. Their participation, knowledge, authority, and actual acts must be proved.

An account name or screenshot alone also does not conclusively establish who controlled the account when the material was posted.

Truth, privilege, and fair comment

Truth is important, but “it was true” is not always a complete criminal-libel defense by itself. Article 354 of the Revised Penal Code generally presumes a defamatory imputation malicious even if true unless good intention and justifiable motive are shown, subject to recognized privileged communications. Article 361 contains additional rules on proof of truth.

Qualifiedly privileged communications include:

A private communication made to another person in the performance of a legal, moral, or social duty.
A fair and true report, made in good faith and without added comments, of non-confidential official proceedings or official acts.
Fair comment on matters of public interest, as recognized in jurisprudence.

Privilege is not a license to publish accusations indiscriminately. The communication should be made on a proper occasion, to people with a legitimate interest, and within the scope of the duty or public issue involved. Unnecessary circulation, personal abuse, fabricated facts, or reckless disregard of readily available contrary information may support a finding of actual malice.

When the subject is a public official, public figure, or matter of public concern, the constitutional protection of speech may require proof of actual malice—knowledge that the factual assertion was false or reckless disregard of whether it was false. Honest error is not automatically actual malice. Courts examine the sources used, verification attempted, reliability of the information, urgency of publication, wording, corrections, and other surrounding facts.

Filing a cyber-libel complaint

1. Preserve the evidence before requesting removal

Save the material in a form that shows context and origin:

Full-page screenshots, not only cropped quotations.
The exact URL, account name, profile URL, post ID, and publication date and time.
Comments, captions, photographs, videos, edits, and surrounding conversation.
Messages or notifications showing when you first discovered the publication.
Names and contact details of people who saw it.
Original files and downloaded copies, with metadata intact where possible.
Evidence connecting the account to the suspected author.
Evidence of falsity, lack of verification, motive, prior threats, or repeated publication.
Records of reputational or financial harm, such as lost contracts or communications from clients.

Record the date and manner of discovery in a contemporaneous note. Do not edit the original files, annotate the only copy, or rely exclusively on a disappearing story or a platform’s search results.

A notarial acknowledgment of printed screenshots may help document what a person saw, but notarization does not by itself prove authenticity, authorship, or that the content was online at the relevant time.

2. Consider prompt investigation and preservation

A complainant may approach the National Bureau of Investigation’s cybercrime unit or the Philippine National Police Anti-Cybercrime Group for investigation. Law-enforcement officers can pursue subscriber data or forensic evidence through the procedures authorized by law.

Private individuals generally cannot compel a platform or telecommunications company to disclose protected subscriber or content data. Disclosure, interception, search, seizure, and forensic examination may require the appropriate judicial process under the Supreme Court’s Rule on Cybercrime Warrants.

Republic Act No. 10175 requires service providers to preserve specified categories of computer data for statutory periods, while law enforcement may issue or seek proper preservation and disclosure measures. Because platforms may delete logs under their own retention policies, delay can make attribution much harder.

3. Prepare a sworn complaint

The complaint-affidavit should state facts personally known to the complainant, including:

The complainant’s identity and address.
The respondent’s identity, if known.
The exact words, images, or material complained of.
Where and how the material was published.
Why it referred to the complainant.
Who else saw or received it.
Why it was defamatory and malicious.
When and how the complainant discovered it.
Facts establishing the proper territorial venue.
The supporting documents and witnesses.

Attach legible, organized copies of the evidence and the sworn affidavits of material witnesses. If the author is not yet known, consult the investigating agency and a lawyer promptly about attribution and lawful data-preservation measures rather than naming a person based only on suspicion.

4. File with the proper prosecutor’s office

A criminal case normally begins with a complaint filed for preliminary investigation with the Office of the City Prosecutor or Office of the Provincial Prosecutor having proper territorial authority. Filing with an investigative agency can assist case development, but it should not be assumed to substitute for every legal step needed to interrupt prescription.

Cybercrime cases ultimately fall within the jurisdiction of a designated Regional Trial Court. Under Republic Act No. 10175 and the Rule on Cybercrime Warrants, venue may depend on where an element occurred, where the relevant computer system was situated, where qualifying damage was caused, and other jurisdictional facts. Cyber libel also intersects with the special venue rules historically applicable to libel. Because online content may involve several locations, the correct prosecutor’s office should be confirmed before filing.

A demand letter, platform report, barangay complaint, or request for takedown is generally not a statutory prerequisite to a criminal cyber-libel complaint. None should be allowed to consume the one-year prescriptive period.

5. Participate in the preliminary investigation

The prosecutor evaluates whether the submitted evidence meets the governing standard for filing a criminal charge. The respondent is ordinarily served with a subpoena and copies of the complaint and supporting evidence, then given an opportunity to file a sworn counter-affidavit and supporting documents.

The controlling deadline is the one stated in the subpoena and applicable prosecution rules. Extensions are not automatic. The parties should keep proof of submission and service and comply with requirements concerning copies, affidavits, identification, annexes, and electronic or physical filing.

If the prosecutor dismisses the complaint or directs that an Information be filed, the available review or appeal procedure and deadline depend on the issuing office, the offense, and the governing Department of Justice rules. Obtain the complete resolution and proof of receipt immediately.

The one-year prescriptive period

In Causing v. People, the Supreme Court abandoned earlier doctrine applying a much longer period and held that cyber libel prescribes in one year, under Articles 90 and 91 of the Revised Penal Code. The period is counted from discovery by the offended party, the authorities, or their agents—not automatically from the upload date in every case. The Court reiterated the doctrine in its 2026 resolution.

Prescription may be interrupted by the institution of proceedings, but the effective interrupting event and the factual date of discovery can be contested. Evidence may be necessary. A repost, later edit, resurfacing search result, or continued availability of the same page does not automatically restart the clock. A material modification or genuinely separate publication requires case-specific analysis.

For complainants, the safe course is to act well before one year from the earliest defensible discovery date. For respondents, prescription should be raised promptly and supported with admissible evidence showing discovery, publication, and filing dates.

Possible penalties and civil liability

Ordinary written libel under Article 355, as amended by Republic Act No. 10951, may be punished by imprisonment, a fine of ₱40,000 to ₱1.2 million, or both. Section 6 of Republic Act No. 10175 provides a penalty one degree higher when a Revised Penal Code offense is committed through information and communications technology.

The exact lawful sentence depends on the charging language, proven circumstances, sentencing rules, and current jurisprudence. Courts have also been directed to consider whether a fine rather than imprisonment is appropriate in libel cases, but a fine is not guaranteed and criminal liability has not been abolished.

The offended party may seek civil damages with the criminal case. Article 33 of the Civil Code also recognizes an independent civil action for defamation. Criminal and civil claims have different procedural consequences and may involve separate prescriptive questions, so a party should not assume that the deadline for one claim controls the other.

For the same defamatory act, Disini held that the accused cannot be prosecuted and punished both for ordinary libel and cyber libel merely because the statement was made online.

How to defend against a cyber-libel complaint

Respond immediately and preserve everything

Upon receiving a subpoena, complaint, or court process:

Note the exact date and manner of service.
Obtain a complete copy of the complaint and all annexes.
Preserve the account, device, messages, drafts, source material, and access records.
Do not delete or alter the disputed post after anticipating an investigation without first preserving it and obtaining legal advice.
Do not ask witnesses to change their accounts or create new documents.
Do not retaliate against the complainant online.

Deleting a post does not erase existing evidence or automatically end a case. It may also remove information helpful to the defense.

Test every element

A defense should examine whether the prosecution can prove:

The accused was the author or person who caused publication.
A third person received the statement.
The complainant was identifiable.
The words, viewed as a whole, were defamatory rather than protected opinion, rhetorical language, or non-defamatory criticism.
The required malice existed.
The publication was made through a computer system.
The case was filed within the prescriptive period.
The chosen office and court have proper venue and jurisdiction.
The digital evidence is authentic, complete, and lawfully obtained.

If an account was hacked, impersonated, shared with others, or used from another device, preserve security alerts, access history, recovery emails, device records, reports to the platform, and contemporaneous messages. A bare denial is usually less persuasive than objective account and device evidence.

Document truth, good faith, and verification

Preserve the sources available before publication: public records, interviews, messages, photographs, recordings lawfully obtained, official reports, research notes, and requests for comment. The defense should show what was known at the time—not create a justification afterward.

For a statement claimed to be fair comment, separate disclosed or reliably established facts from conclusions or opinion. For a duty-based private communication, identify the duty, the recipient’s legitimate interest, and why the circulation was limited and necessary.

Challenge defective digital evidence properly

Screenshots can be evidence, but they may be incomplete, manipulated, taken from a fake account, or stripped of context. Relevant questions include:

Who captured the screenshot and when?
Can the witness identify the account and content?
Is the URL or post identifier visible?
Is there proof connecting the account to the accused?
Does the screenshot omit replies, corrections, dates, privacy settings, or surrounding language?
Was device or account information obtained through lawful process?
Has the original file or forensic copy been preserved?

Technical objections must be grounded in actual evidentiary defects. The absence of a forensic examination does not automatically make every screenshot inadmissible.

Common mistakes

Mistakes by complainants

Waiting for an apology or platform action until the one-year period is nearly over.
Saving only a cropped screenshot without the URL, account, date, or context.
Treating hurt feelings alone as proof of a legally defamatory imputation.
Naming every person who liked, commented on, or shared a post as an author.
Filing in a convenient city without facts establishing venue.
Exaggerating damages or relying on hearsay about who saw the post.
Assuming a fake-looking account cannot be investigated.
Publicly announcing unsupported accusations against the suspected poster.

Mistakes by respondents

Ignoring the prosecutor’s subpoena because it is “only an affidavit.”
Posting a second attack, threat, or supposed explanation that repeats the accusation.
Deleting accounts, messages, drafts, or access logs.
Contacting the complainant or witnesses in a manner that could be viewed as intimidation.
Assuming truth alone always defeats liability.
Claiming “opinion” while making verifiable accusations of crime or misconduct.
Assuming a private group, chat, or email cannot satisfy publication.
Missing the counter-affidavit, review, arraignment, or bail deadline.
Filing public responses that reveal defense strategy or contradict later sworn statements.

When legal help is urgent

Consult a Philippine criminal-law lawyer promptly if:

One year from publication or discovery is approaching.
The author is unknown and subscriber or platform records may disappear.
You have received a prosecutor’s subpoena.
An Information has already been filed in court.
A warrant of arrest has been issued or police are attempting to seize or examine a device.
The material concerns a public official, journalist, workplace investigation, confidential proceeding, or whistleblowing activity.
The account may have been hacked or impersonated.
The post was made, hosted, or viewed across different cities or countries.
Several criminal, civil, employment, privacy, or administrative complaints arise from the same publication.

The Public Attorney’s Office may provide representation to qualified indigent persons, subject to its requirements and conflict rules. A private lawyer can also determine whether immediate motions, bail arrangements, preservation requests, or review remedies are necessary.

Frequently asked questions

Is every insulting Facebook post cyber libel?

No. The prosecution must prove a defamatory imputation, publication to a third person, identifiability, the required malice, authorship, and use of a computer system. Context matters.

Must the post be public?

No. Publication can exist when even one third person receives or reads the defamatory matter. A message seen only by its author and the offended person ordinarily does not meet that element.

Is sharing or liking a post automatically cyber libel?

No. Under Disini, criminal liability for cyber libel attaches to the original author, and the aiding-or-abetting provision cannot be used to punish mere reactions to a libelous post. A person who creates new defamatory content or independently adopts and publishes an accusation may present a different case.

Does deleting the post prevent a case?

No. Copies, witnesses, platform records, and device evidence may remain. Deletion also does not reverse a completed publication.

Is a demand letter required?

Generally, no. It may help secure a correction or settlement, but it is not a substitute for timely filing and does not automatically stop prescription.

Can an apology or retraction end the criminal case?

Not automatically. It may affect the parties’ decisions, damages, or assessment of good faith, but cyber libel is a public offense prosecuted in the name of the People. The legal effect of an affidavit of desistance or settlement depends on the stage and circumstances.

Does the one-year period begin whenever I rediscover the post?

Not necessarily. The controlling issue is the legally provable first discovery by the offended party, authorities, or their agents. Continued online availability does not by itself create a new offense every day.

Can a company be defamed?

Yes. Article 353 recognizes that a natural or juridical person may be the subject of a defamatory imputation, provided the required elements are proved.

Can police search my phone immediately after receiving a complaint?

A complaint alone does not create unlimited authority to search a device. Digital disclosure, search, seizure, interception, and examination are governed by constitutional protections and the Rule on Cybercrime Warrants, subject to recognized lawful exceptions. Ask for counsel and do not physically resist officers.

Official legal sources

This article provides general Philippine legal information, not legal advice or an assessment of any particular post, complaint, or defense. Outcomes depend on the exact words, audience, evidence, dates, documents, and procedural history. Sources and legal developments were checked as of September 12, 2026.