Quick answer

To file a cyber libel case in the Philippines, submit a sworn complaint-affidavit and supporting evidence to the prosecution office with territorial jurisdiction. File promptly: the Supreme Court has definitively ruled that cyber libel prescribes one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Filing the criminal complaint with the prosecution office interrupts that period.

To defend a case, preserve the complete subpoena package and immediately prepare a sworn counter-affidavit addressing every element, the identity of the author, authenticity of the electronic evidence, venue, prescription, privilege, truth, and malice. Under the current DOJ rules, the respondent must receive at least 10 calendar days from receipt of the subpoena and complete complaint to submit the counter-affidavit. Do not ignore the subpoena, delete evidence, or rely on a generic denial.

A complaint does not automatically lead to arrest or conviction. The prosecutor must find prima facie evidence with reasonable certainty of conviction before filing an Information in court. If an Information is filed, the Regional Trial Court independently determines whether there is probable cause to issue a warrant.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or a similar technology.

The prosecution generally must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one person other than the person defamed received or saw the statement. A private message sent only to the subject ordinarily lacks this element, although other laws may apply. A group chat, public post, email copied to others, video, podcast, website article, or comment visible to third parties can satisfy publication.
Identification. The complainant must be identifiable from the words and surrounding circumstances. The person need not always be named, but readers must reasonably be able to determine who was being discussed.
Malice. Defamatory imputations are generally presumed malicious unless a recognized privilege or constitutional protection applies. In cases involving public officials, public figures, official conduct, or matters of public concern, the prosecution may have to prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false.
Use of a computer system or similar technology. The allegedly defamatory material must have been published online or through information and communications technology.
Responsibility as the original author. The evidence must connect the respondent to the creation or authorship of the assailed statement.

Context matters. Courts examine the entire post or publication, not merely an isolated word. Calling an accusation “opinion,” adding “allegedly,” or phrasing it as a question will not provide automatic protection if the statement still communicates a provably defamatory factual accusation.

Likes, shares, reactions, and new comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author but declared it unconstitutional as applied to people who merely receive and react to a post. It also invalidated aiding or abetting liability in relation to cyber libel.

Accordingly, a simple like, reaction, share, or expression of agreement is not automatically cyber libel. But a person who adds a new defamatory allegation in a caption or comment may become the original author of that new statement. Copying, rewriting, or independently reposting an accusation can also create fact-specific authorship and republication issues.

The one-year deadline

The controlling rule is now clear: cyber libel prescribes one year from discovery, not automatically from the original posting date. The Supreme Court affirmed this rule with finality in its April 8, 2026 resolution in Causing v. People.

Discovery may be shown by evidence such as:

The date the complainant first received a link or screenshot
A comment, reaction, or message showing earlier knowledge
A demand, public response, platform report, or threat to sue
Testimony from the person who informed the complainant
An earlier complaint or communication referring to the post
Evidence that an authorized agent or government authority had already found it

The law does not presume that a person discovered a Facebook or other social-media post on the day it became publicly available. Discovery is determined from the evidence in each case.

The filing of the complaint or Information interrupts prescription. If proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may begin running again under Article 91 of the Revised Penal Code.

Do not wait until the last week. Disputes about who discovered the material, whether an agent’s knowledge counts, where the complaint was filed, or whether filing was complete can determine the case.

A separate civil action for defamation may also be subject to a one-year period under the Civil Code. The relationship between the criminal case, civil liability arising from the offense, and an independent civil action should be assessed before filing.

Preserve the evidence before taking action

A screenshot is useful, but it may not prove authorship, authenticity, publication, or the complete meaning of the post. Preserve the strongest available version of the evidence.

Record and retain:

Full-screen screenshots showing the account name, profile address, date, time, platform, and surrounding content
The complete URL or permanent link to the post, comment, video, account, or page
A screen recording showing how the content was accessed
The full conversation, thread, article, or video—not only the allegedly defamatory sentence
Original downloaded files, emails, messages, audio, video, and attachments
Notifications, emails, or messages through which the material was discovered
The number and identity of people who saw or received it, when genuinely known
Earlier and later versions of an edited post
The device on which the material was received or viewed
Evidence connecting the account to its alleged operator
Documents supporting or disproving the factual accusation
Evidence of actual harm, such as lost work, cancelled contracts, customer communications, or medical treatment
The exact date and circumstances of discovery

Keep original files unchanged. Work on copies and document who handled each file. Do not crop away account identifiers or context. Do not ask witnesses to embellish what they saw.

Electronic evidence must be authenticated under the Supreme Court’s Rules on Electronic Evidence. A witness with personal knowledge, account records, metadata, forensic examination, admissions, subscriber information, or other corroborating evidence may be necessary.

When the account is anonymous or disputed

An account name or profile photograph alone may not prove who authored a post. Account access, device evidence, platform records, IP information, admissions, writing history, recovery details, and surrounding conduct may become important.

Private individuals cannot compel platforms or telecommunications companies to disclose protected subscriber or content data merely by sending a demand. Law-enforcement authorities may issue preservation orders and seek appropriate court warrants under Republic Act No. 10175 and the Rule on Cybercrime Warrants.

If attribution or disappearing data is a problem, promptly request investigative assistance from the NBI Cybercrime Division or the PNP Anti-Cybercrime Group. The DOJ Office of Cybercrime may also facilitate preservation and investigation within its legal authority.

Republic Act No. 10175 provides minimum preservation periods for specified subscriber and traffic data and permits an additional preservation period through lawful orders. These provisions do not guarantee that every platform possesses the requested data, especially if action is delayed.

Check venue before filing

Venue in a criminal case is jurisdictional. A complainant should not assume that a case may be filed wherever the post was viewed, wherever the complainant happens to be, or wherever filing is most convenient.

Republic Act No. 10175 provides Philippine jurisdiction when, among other situations, an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, or the offense caused damage to a person who was in the Philippines. Selecting the proper city or provincial prosecution office still requires analysis of the alleged acts, territorial jurisdiction, the applicable libel-venue rules, and the facts stated in the complaint.

Improper venue can defeat an otherwise supported case. If the post, parties, devices, platform records, or alleged harm involve several cities or countries, obtain case-specific advice before filing.

How to file the complaint

1. Evaluate every legal element

Identify the exact words complained of and explain:

What factual accusation they communicated
Why the accusation was defamatory
Who understood it to refer to the complainant
Who received or saw it
Why the respondent is believed to be its original author
How a computer system was used
When and how the complainant discovered it
Why the selected prosecution office has territorial jurisdiction
What evidence establishes malice or, where relevant, actual malice

A demand letter, platform takedown request, or barangay proceeding is not a substitute for a timely criminal complaint. A prior demand is not ordinarily an element of cyber libel.

2. Obtain technical assistance if necessary

Consider going first to the NBI or PNP Anti-Cybercrime Group when:

The author is anonymous
The account may be fake, compromised, or deleted
Platform or subscriber records are essential
The evidence requires forensic acquisition
Lawful preservation or disclosure orders may be needed

3. Prepare the complaint-affidavit

Under DOJ Department Circular No. 015, series of 2024, a regular preliminary investigation is initiated by filing:

The original complaint-affidavit
Two duplicate copies for the prosecution office
One additional copy for each respondent
A completed NPS Investigation Data Form
Affidavits of witnesses
Documentary, electronic, and other supporting evidence

The complaint-affidavit must state the parties’ names and addresses, the date and place of the alleged offense, and the material facts showing how it was committed. It must be sworn before a prosecutor, another government official authorized to administer oaths, or, when they are unavailable, a notary public.

Follow the receiving office’s current requirements for exhibit labels, storage media, paper size, and copies. Do not assume that an emailed complaint is validly filed unless that prosecution office has expressly authorized the method.

4. File before prescription expires

Secure and preserve the official receiving stamp, docket or investigation-slip number, filing date, and complete filed set. These may become critical if prescription is disputed.

5. Monitor the case

Provide an address where notices can reliably be received. Inform the prosecution office formally of any change. A case can be delayed or resolved without a party’s additional evidence if official notices are missed.

The preliminary-investigation timeline

The 2024 DOJ-NPS Rules govern preliminary investigations in National Prosecution Service offices. The Supreme Court has recognized the DOJ’s authority to issue these rules and has upheld the higher prosecutorial standard of prima facie evidence with reasonable certainty of conviction.

Stage	Current general rule
Initial review	Within five calendar days after receiving the entire assigned record, the investigating prosecutor either recommends dismissal or issues subpoenas
Hearing setting	The preliminary-investigation hearing must generally be set no later than 30 days from the prosecutor’s receipt of the entire record
Counter-affidavit	The respondent must receive at least 10 calendar days from receipt of the subpoena and complaint package
Clarificatory hearing	If needed, it may be set within 10 calendar days after receipt of the counter-affidavit
Reply or rejoinder	When required, each generally must be filed within 10 calendar days from receipt of the pleading answered
Resolution	Generally within 60 calendar days from assignment, with a maximum 30-day extension in the specified categories of cases
Motion for reconsideration	Within 15 days from receipt of the prosecutor’s resolution

Extensions to submit a responsive affidavit are exceptional and must be justified by the interests of justice. When granted on meritorious grounds, the extension may not exceed 10 days. Never assume that requesting an extension moves the deadline; obtain a written order.

A motion to dismiss ordinarily cannot replace the counter-affidavit. A verified motion containing the respondent’s defenses may be treated as one, but relying on that exception can be risky.

How to defend after receiving a subpoena

Preserve proof of receipt

Keep the envelope, courier record, email headers, acknowledgment, subpoena, complaint-affidavit, and every attachment. The receipt date controls the minimum response period.

Check whether the package is complete. The subpoena should include the complaint-affidavit and its attachments. If exhibits are missing or unreadable, raise the deficiency immediately in writing and request access without waiving defenses.

Secure the account and evidence

Preserve the account, devices, logs, drafts, messages, login alerts, and recovery records. Change compromised passwords and enable multifactor authentication, but document the account’s existing condition first.

Do not edit or delete the assailed post before preserving it and obtaining advice. An edit may complicate questions of republication; deletion may destroy favorable context or evidence. If continued publication is causing harm, counsel can help balance preservation with a prompt takedown.

Prepare a fact-specific counter-affidavit

The response should address:

Whether the words were actually defamatory
The complete context and intended meaning
Whether the complainant was identifiable
Whether any third person saw the statement
Whether the respondent authored or controlled the post
Whether the account was hacked, impersonated, or shared—and the evidence supporting that claim
Whether the material was privileged
Whether the complainant is a public official or public figure and actual malice must be proved
The sources, verification, records, and editorial process used
Truth, good motives, and justifiable ends where legally available
The discovery date and prescription
Venue and territorial jurisdiction
Defects in authentication, completeness, or admissibility
Any inconsistent statements or missing evidence

Attach witness affidavits and supporting documents. A bare denial, an unsupported claim that the account was hacked, or a general appeal to freedom of speech is rarely enough.

File and serve correctly

Generally, file the original counter-affidavit plus two duplicate copies with the prosecution office and furnish the complainant with a copy. The respondent’s personal appearance may be dispensed with when the counter-affidavit was properly sworn before an authorized prosecutor, government official, or notary, but follow the subpoena and local office instructions.

If a virtual procedure is authorized, comply with the order’s PDF, email, hard-copy, and verification requirements. An unreadable, corrupted, encrypted, or late electronic submission may be excluded.

Important defenses and exceptions

No defamatory factual imputation

Insults, exaggeration, satire, rhetorical hyperbole, and harsh criticism are not automatically libel. The controlling question is what the statement, in its complete context, would reasonably communicate. A supposed “opinion” that implies undisclosed defamatory facts may still be actionable.

No publication or identification

A statement seen only by the person discussed lacks publication. A vague criticism that readers could not reasonably connect to the complainant may lack identification. Both conclusions depend on evidence, not merely the author’s claimed intention.

The respondent was not the author

The prosecution must connect the respondent to the assailed online statement. A profile name, photograph, or screenshot may be insufficient when authorship is genuinely disputed. Conversely, admissions, exclusive account access, device evidence, platform records, and corroborating conduct can establish responsibility.

Qualified privilege

Article 354 recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty
A fair and true report, made in good faith and without improper comments, of specified official proceedings or acts

Fair commentary on matters of public interest also receives constitutional protection. Privilege is not a license to publish irrelevant attacks, knowingly false allegations, or statements with reckless disregard for truth. Actual malice can defeat a qualified privilege.

Public officials, public figures, and public concern

When the statement concerns a public official’s conduct, a public figure, or a genuine matter of public concern, criticism receives greater constitutional protection. The prosecution may have to establish actual malice rather than rely on ordinary presumed malice.

Actual malice does not simply mean anger, hostility, or bad feelings. It means publishing with knowledge that the assertion was false or with reckless disregard for whether it was true. Records of research, source verification, requests for comment, corrections, and contemporaneous communications can therefore be important.

Truth, good motives, and justifiable ends

Truth is not an automatic defense in every criminal libel case. Article 361 governs when proof of truth is admissible and provides acquittal when the matter is true and was published with good motives and for justifiable ends. Different constitutional burdens may apply to allegations concerning official conduct or public figures.

Preserve the records that existed when the statement was published. Evidence discovered only afterward may prove truth but may not necessarily show what the author knew or verified at publication.

Prescription and improper venue

Prescription or lack of territorial venue can result in dismissal, but factual proof may be required. If the dates or jurisdictional defect do not appear on the face of the Information, the issue may have to be established through evidence rather than a bare motion.

If the prosecutor issues a resolution

An aggrieved party may generally file a motion for reconsideration within 15 days from receipt. A petition for review is governed by separate and periodically updated DOJ rules.

Do not assume that a motion for reconsideration or DOJ petition automatically suspends court proceedings after an Information has been filed. The appropriate motion to suspend must be filed, and suspension requires proper action by the court.

If an Information is filed:

The case is filed in the proper Regional Trial Court, usually a designated cybercrime court.
The judge independently examines probable cause.
The judge may dismiss the case, require additional evidence, or issue a warrant of arrest.
The accused must address bail, arraignment, pretrial, and trial deadlines through counsel.

Before conviction by the RTC, bail is generally a matter of right for cyber libel, but the court determines the amount and conditions. A subpoena from a prosecutor is not an arrest warrant.

Possible penalties and civil liability

Under Section 6 of Republic Act No. 10175, the imprisonment for cyber libel is one degree higher than for traditional libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

In People v. Soliman, the Supreme Court ruled that a fine remains an alternative penalty. Following the amended Revised Penal Code and the rule for increasing fines by one degree, the applicable fine range is ₱40,000 to ₱1,500,000. The court may impose imprisonment, a fine, or both, depending on the law and circumstances.

A fine-only sentence is discretionary, not a right. The Supreme Court’s preference guidelines do not abolish imprisonment, and subsidiary imprisonment may apply when a validly imposed fine cannot be paid.

Civil damages may also be claimed. The outcome and amount depend on proof of injury, causation, privilege, malice, and the applicable procedural route—not merely on the number of views or reactions.

Common mistakes

Waiting because the post remains online and assuming prescription has not started
Failing to document the exact discovery date
Filing in a convenient but legally improper venue
Submitting only cropped screenshots without URLs, context, witnesses, or authentication
Treating account ownership as conclusive proof of authorship
Naming everyone who liked or shared a post despite Disini
Responding to a subpoena with a generic template or an unsworn letter
Filing a motion to dismiss instead of a proper counter-affidavit
Assuming an extension request was granted
Deleting, editing, or resetting relevant devices before preserving evidence
Posting public admissions, threats, or retaliatory accusations
Pressuring witnesses or coordinating their stories
Assuming truth alone always defeats criminal libel
Assuming a retraction, apology, settlement, or affidavit of desistance automatically terminates the criminal case

An affidavit of desistance may be considered, but cyber libel is prosecuted in the name of the People of the Philippines. The complainant does not have an absolute right to end the case after it has been filed.

When legal help is urgent

Consult a Philippine criminal lawyer immediately when:

The one-year period may expire within weeks
A subpoena or prosecutor’s deadline has been received
An Information or arrest warrant has already been issued
The account is anonymous, deleted, hacked, or impersonated
Provider records or a forensic examination are needed
Several posts, respondents, cities, or countries are involved
The complainant is a public official or the publication concerns public affairs
The case involves journalism, whistleblowing, confidential sources, or privileged records
The post includes threats, doxxing, intimate images, stalking, or harm to a child
A settlement, retraction, or public response is being considered

People who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its current eligibility and merit requirements.

Frequently asked questions

Can I file even if the post has been deleted?

Yes, if admissible evidence of the post, publication, authorship, and other elements remains available. Deletion may make proof harder, so preserve screenshots, URLs, notifications, witnesses, devices, and platform-related records immediately.

Do I have to report the case to the NBI or PNP first?

Not necessarily. A complainant may file directly with the proper prosecution office if the evidence is complete. Law-enforcement assistance is particularly useful for anonymous accounts, forensic work, preservation orders, or provider data.

Can a private message be cyber libel?

Only if the prosecution can establish publication to someone other than the person defamed. A message sent exclusively to the subject ordinarily lacks publication, although threats, harassment, or other content may violate different laws.

Can I sue everyone who shared the post?

Not automatically. Disini protects people who merely receive, like, react to, or share the original post from cyber-libel liability on that basis alone. A person who adds a new defamatory allegation may be treated as the original author of the new statement.

Is a true statement always safe?

No. Article 361 requires attention to the type of imputation, truth, good motives, and justifiable ends. Privilege and constitutional protections may change the analysis, especially in public-official or public-interest cases.

Will an apology or takedown prevent prosecution?

Not necessarily. It may affect the complainant’s decision, damages, proof of malice, or sentencing, but it does not erase a completed publication or automatically dismiss a pending case.

Does receiving a prosecutor’s subpoena mean I will be arrested?

No. It means a complaint is under preliminary investigation. Arrest generally becomes an issue only if an Information is filed and the judge independently finds probable cause to issue a warrant.

May I handle the complaint or counter-affidavit without a lawyer?

A person may generally file personally, but cyber libel involves short deadlines, jurisdictional venue, constitutional defenses, electronic authentication, and possible imprisonment. Professional assistance is strongly advisable, particularly for the respondent.

Official sources and primary authorities

This article provides general legal information, not advice for a particular case or an attorney-client relationship. Facts, documents, venue, and procedural posture can change the result. Philippine law and official procedures were checked as of August 10, 2026.