Quick answer

A Philippine cyber libel case ordinarily begins with a sworn complaint and supporting evidence filed with the proper City or Provincial Prosecutor—not directly with the trial court. The prosecutor conducts a preliminary investigation and files an Information in the Regional Trial Court only if the evidence establishes a prima facie case with reasonable certainty of conviction.

To succeed, the prosecution must prove a defamatory imputation, publication to at least one person other than the complainant, identification of the person defamed, malice, and use of a computer system or similar information and communications technology. A harsh, offensive, or false online statement is not automatically cyber libel; context, privilege, authorship, malice, venue, and prescription all matter.

Act quickly. In its final April 2026 ruling in Causing v. People, the Supreme Court held that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Filing the complaint or Information interrupts that period. A police blotter, platform report, demand letter, or informal consultation should not be assumed to stop prescription.

Anyone who receives a prosecutor’s subpoena should not ignore it. The counter-affidavit is the principal opportunity to contest the accusation before a criminal case reaches court.

What legally counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or similar technology. This includes potentially libelous material posted through social media, websites, blogs, online forums, email, messaging applications, videos, photographs, or digitally published documents.

The prosecution generally must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Publication. Someone other than the person defamed received, read, saw, or heard the material. A message sent only to the complainant ordinarily lacks this element, but a group chat, shared email, restricted social-media post, or message sent to a third person may constitute publication.
Identification. The complainant was named or was reasonably identifiable from the words, images, surrounding facts, or audience’s knowledge. Naming no one is not necessarily a defense if readers could still recognize the target.
Malice. The applicable form and burden of proving malice depend on whether the statement was privileged and whether the complainant was a private person, public officer, or public figure.
Use of a computer system or ICT. The defamatory material was published through a computer, phone, platform, network, or comparable digital means.
Authorship or responsibility. The evidence reliably connects the accused to the account and the particular post, message, upload, or other publication.

Courts assess the entire communication, not an isolated word or cropped screenshot. Satire, obvious exaggeration, opinion, fair comment, and unpleasant criticism can differ legally from a factual accusation. Merely labeling an accusation “opinion” does not protect it if the statement reasonably asserts or implies defamatory facts.

Private persons, public officers, and public figures

The distinction can decide a case.

For a private complainant, Article 354 of the Revised Penal Code generally presumes malice from a defamatory imputation unless the communication is privileged or the accused establishes the legally required justification.

Where the complainant is a public officer or public figure and the statement concerns official conduct or a matter properly open to public discussion, the prosecution must prove actual malice beyond reasonable doubt. Actual malice means that the author knew the statement was false or acted with reckless disregard of whether it was false. It is not established by falsity, mistake, poor writing, or failure to conduct perfect research alone. The Supreme Court explains this higher constitutional standard in decisions including Grillo v. People and ABS-CBN v. Gozon.

The protection is not unlimited. Accusations unrelated to official conduct, attacks on purely private life, fabricated evidence, or statements made with demonstrated knowledge of falsity may receive different treatment. Whether someone is a public figure and whether the publication concerns a legitimate public matter require a fact-specific assessment.

Truth, privilege, and fair reporting

Truth is important but is not always a complete defense by itself.

Under Articles 354 and 361 of the Revised Penal Code, the defense may need to establish both the truth of the imputation and good motives and justifiable ends. Special rules apply when the imputation concerns a crime or a public officer’s performance of official duties.

The law also recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty to a person with a corresponding interest or duty; and
A fair and true report, made in good faith and without improper comments or remarks, of qualifying official proceedings or acts of public officers.

Privilege removes the ordinary presumption of malice, but it may be defeated by proof of actual malice. Copying an allegation from another social-media account does not automatically make it true, privileged, or responsibly reported.

Likes, shares, reposts, and comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but declared it unconstitutional as applied to people who merely receive and react to a post. It also invalidated the Cybercrime Prevention Act’s aiding-or-abetting provision insofar as it applied to cyber libel.

Accordingly, an ordinary like, reaction, share, or brief expression of agreement should not automatically be treated as cyber libel. But a person who adds a new defamatory accusation, fabricates or alters material, or publishes an independently defamatory account may become the original author of that new content. The precise words and manner of republication must be examined.

The one-year criminal deadline

The controlling rule is now clear: cyber libel prescribes in one year from discovery, not 12 or 15 years.

In the Supreme Court’s final en banc resolution in Causing v. People, G.R. No. 258524, April 8, 2026, the Court affirmed that:

The one-year period begins when the alleged cyber libel is discovered by the offended party, the authorities, or their agents.
Publication and discovery may occur on the same date, but courts cannot simply presume that they always do.
Filing the complaint or Information interrupts prescription.
When prescription is not apparent from the Information, an accused asserting it must present evidence of the actual discovery date.

Evidence of discovery may include an earlier reply or reaction, a demand for deletion, a prior platform report, messages discussing the post, correspondence with a lawyer, or other conduct showing that the complainant or an agent already knew of the material.

A separate civil action for defamation is also subject to a one-year period under Article 1147 of the Civil Code. The accrual and interruption of a civil deadline, and its interaction with a criminal case, can be legally complex. Obtain advice before either one-year period becomes close.

How to file a criminal complaint

1. Preserve the publication before requesting deletion

Capture the evidence while it is still available:

The complete post, message, article, video, image, caption, comments, and surrounding thread
The account name, profile page, account identifier, and visible profile details
The exact URL or permanent link
The date and time displayed, including the device’s time zone if relevant
The post’s audience or privacy setting, if visible
Engagement data such as comments, shares, recipients, or group members
A screen recording showing how the account and post were reached
The original digital file, not only a screenshot forwarded by another person
Notifications, emails, or messages showing when and how the complainant discovered it
Copies of any demand, response, correction, apology, or subsequent republication

Do not crop away context or repeatedly convert files between formats. Keep untouched originals and working copies. Record who collected each item, when it was collected, and from which device. Back up the evidence securely.

2. Identify witnesses and proof of publication

Ask people who personally saw the material to preserve their own copies and prepare truthful affidavits. A useful witness should be able to explain:

When and where the witness saw the material
Which account published it
Why the witness understood it to refer to the complainant
What the complete statement communicated in context
Whether the witness knew the parties or relevant circumstances

A complainant cannot establish publication merely by showing that the statement was sent privately to the complainant alone.

3. Establish who controlled the account

A profile name and photograph are relevant but may not be conclusive. In XXX v. People, the Supreme Court identified several ways to connect a person to a social-media account, including:

An admission of ownership, access, or authorship
Testimony that the person was seen using the account or composing the message
Information in the post known only to the alleged author or a small group
Distinctive language or writing patterns
Prior posts, messages, interactions, or conduct consistent with control
Platform, telecommunications, internet-service-provider, geolocation, or device-forensic records

The Supreme Court’s official summary is available in its guide on proving social-media identity.

For a dummy or anonymous account, promptly consult the NBI Cybercrime Division or PNP Anti-Cybercrime Group. Under the Rule on Cybercrime Warrants, law-enforcement officers—not private complainants acting alone—may seek judicial authority requiring a service provider to disclose relevant computer data. Platform data may be retained only for limited periods.

The NBI publishes an official online complaint page and procedure for investigative assistance to computer-crime victims.

4. Prepare the complaint-affidavit

The sworn complaint should state facts within the complainant’s personal knowledge and organize them chronologically. It should clearly address:

The complainant’s identity and actual residence or public office at the relevant time
The respondent’s identity and available contact information
The exact defamatory words, images, or conduct
An accurate translation of non-English material where needed
The publication date and the separately identified discovery date
How the complainant was identifiable
Who else received or viewed the material
Why the statement was defamatory in context
Evidence connecting the respondent to the account and publication
Facts relevant to malice, privilege, truth, and motive
The computer system or digital platform used
The proper venue
A list of attachments and witnesses

Avoid argument unsupported by evidence. Do not exaggerate audience size, business loss, emotional injury, or the respondent’s intentions. A knowingly false sworn statement can create separate legal consequences.

The DOJ’s current administrative checklist for a preliminary-investigation complaint is available on its official filing-requirements page. Confirm the required forms, copies, fees, oath administration, and accepted filing method with the particular prosecution office.

5. File in the proper prosecution office

Venue in libel cases is jurisdictional, not a matter of convenience. Under Article 360, as amended by Republic Act No. 4363:

For a private complainant, the recognized venues are generally the place where the complainant actually resided when the offense was committed or where the material was printed and first published.
For a public officer, the proper venue depends on where the officer held office and whether that office was in Manila, or where the material was first published.

Internet publication complicates proof of the place of first publication. Merely opening or reading a website in a chosen city does not automatically establish venue. When in doubt, filing based on the complainant’s qualifying actual residence or public office may be more readily documented, but the exact facts must still satisfy Article 360 and cases such as Bonifacio v. RTC of Makati.

File the complaint with the City or Provincial Prosecutor having territorial authority over the proper venue. An NBI or police investigation can support the case but should not be assumed to replace timely filing with the prosecution office.

6. Participate in preliminary investigation

Because cyber libel carries a possible maximum imprisonment exceeding six years, it is handled under the regular preliminary-investigation procedure in DOJ Department Circular No. 15, series of 2024.

The prosecutor may require a counter-affidavit, reply, clarificatory evidence, or additional case build-up. The current standard is not merely suspicion or a bare probability that an offense occurred. The evidence must establish a prima facie case with reasonable certainty of conviction and must be admissible, credible, preservable, and capable of proving every element and the responsible person’s identity.

If the prosecutor dismisses the complaint, an aggrieved party may ordinarily file a motion for reconsideration within 15 days from receipt under Department Circular No. 15. Further review is governed by applicable DOJ appeal rules. Follow the resolution’s instructions because the correct reviewing office and remedy can depend on who issued it and the procedural history.

How to defend against a cyber libel complaint

1. Preserve everything and stop discussing the merits publicly

Keep the subpoena, envelope, email headers, complaint, attachments, account records, devices, drafts, source documents, and correspondence. Do not edit or manufacture screenshots. Do not ask witnesses to coordinate stories.

Avoid posting retaliatory accusations or attempting to pressure the complainant. Settlement discussions should be handled carefully, preferably through counsel. An apology or affidavit of desistance may influence the parties or penalty, but it does not automatically terminate a criminal prosecution controlled by the State.

2. Calendar the subpoena deadline immediately

Under the regular DOJ procedure, the subpoena should provide at least 10 days from receipt for submission of the counter-affidavit. The controlling date is the specific deadline stated in the subpoena or a valid order granting an extension.

A counter-affidavit is sworn evidence, not a casual explanation. It should be reviewed against every attachment before filing. An omission, unnecessary admission, or contradiction may later be used in court. Do not assume that a bare motion to dismiss can replace a counter-affidavit.

3. Test each required element

Possible defenses, depending on the evidence, include:

The words are not defamatory when read as a whole.
The statement is protected opinion, fair comment, satire, or rhetorical exaggeration rather than an assertion of defamatory fact.
The complainant was not named or reasonably identifiable.
No third person received the communication.
The accused did not own, control, or use the account.
The account was hacked, impersonated, or accessed by another person, supported by security alerts, login records, recovery emails, device evidence, or contemporaneous reports.
The accused merely reacted to or received another person’s post, as distinguished from creating a new defamatory statement.
The communication was qualifiedly privileged.
The imputation was true and made with good motives and for justifiable ends, where that defense is legally available.
The complainant was a public officer or public figure and the prosecution cannot prove actual malice.
The complaint was filed in the wrong venue.
The offense prescribed more than one year after the proven discovery date.
The alleged publication predates the Cybercrime Prevention Act and cannot be punished retroactively as cyber libel.
The same publication is being prosecuted as both traditional and online libel contrary to Disini’s double-jeopardy ruling.

A bare denial or unsupported claim that an account was hacked is risky. Provide objective records and identify witnesses or devices that can substantiate the defense.

4. Address evidence and authentication

Challenge whether the screenshots or files are complete, authentic, and attributable to the accused. Relevant questions include:

Who captured the evidence?
Was the witness personally able to view the original?
Does the screenshot show the URL, date, account, and full context?
Was the content edited, forwarded, translated, or re-encoded?
Is the account genuine?
Do platform or device records contradict authorship?
Can the evidence be presented in admissible form at trial?

The Rules on Electronic Evidence require authentication of an electronic document by evidence showing that it is what its proponent claims.

5. Use the proper remedy after the prosecutor’s resolution

Either party may ordinarily seek reconsideration within 15 days from receipt under the 2024 DOJ-NPS Rules. A petition for review may also be available under the applicable DOJ rules, but filing one does not automatically stop proceedings in court. If an Information has already been filed, counsel may need to seek suspension through the proper motion.

Once the Information reaches the RTC, the judge independently determines probable cause for an arrest warrant. Before plea, the defense should assess any motion to quash based on prescription, jurisdiction, improper venue, double jeopardy, or failure of the Information to charge an offense. Some objections can be waived by entering a plea without raising them, although jurisdiction, extinction of criminal liability, double jeopardy, and failure to charge an offense are treated differently under the Rules of Criminal Procedure.

6. Attend court and address bail promptly

Cyber libel is tried in the Regional Trial Court. Bail is generally a matter of right before conviction because the offense is not punishable by reclusion perpetua or death, but the court fixes the conditions and amount. Do not evade a warrant or miss arraignment. A person arrested or facing an arrest warrant should contact counsel immediately to arrange lawful surrender and bail where appropriate.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional libel. The possible imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

Imprisonment is not mandatory in every conviction. In People v. Soliman, the Supreme Court held that a court may impose a fine alone when justified by the circumstances. The current statutory fine range for online libel is ₱40,000 to ₱1,500,000, although the actual penalty depends on the law in force when the offense occurred, the proven circumstances, and applicable sentencing rules.

A complainant may also seek damages. A civil claim arising from the offense is ordinarily deemed included in the criminal action unless properly waived, reserved, or previously filed. Article 33 of the Civil Code also recognizes an independent civil action for defamation proved by a preponderance of evidence. Actual, moral, or exemplary damages are not automatic; their factual and legal bases must be pleaded and proved, and there can be no double recovery for the same injury.

Evidence both sides should preserve

For the complainant

Complete original posts, messages, videos, photographs, and metadata
URLs and account identifiers
Proof of the discovery date
Affidavits from people who received or saw the publication
Evidence showing how readers identified the complainant
Account-attribution evidence
Corrections, demands, responses, and republications
Employment, business, medical, or other records supporting claimed damages
Official records contradicting an alleged fabricated accusation
The device used to capture or receive the material

For the respondent

Full account history and data exports
Login alerts, IP or device history, password-reset records, and hacking reports
The original post and its complete context
Research notes, official records, sources, interview material, and drafts
Communications showing purpose, duty, good faith, correction, or lack of malice
Evidence that the complainant knew of the post earlier than claimed
Witnesses to account use or authorship
Proof of residence, office, publication location, and other venue facts
The original devices, without wiping or factory-resetting them

Common mistakes

Waiting because of outdated claims that cyber libel prescribes in 12 or 15 years
Assuming a police blotter, NBI inquiry, demand letter, or platform report stops prescription
Filing in a convenient but legally improper venue
Submitting only cropped screenshots with no URL, context, or authenticating witness
Treating every insult, negative review, or factual mistake as cyber libel
Assuming truth alone always defeats liability
Charging everyone who liked, shared, or reacted to a post
Naming an account holder without proving control or authorship
Relying on an unsupported “my account was hacked” defense
Ignoring a prosecutor’s subpoena or filing a rushed, contradictory counter-affidavit
Deleting accounts, resetting devices, or destroying potentially relevant evidence
Continuing the dispute through retaliatory posts
Assuming an apology, deletion, settlement, or affidavit of desistance automatically ends the case
Confusing platform removal procedures with a criminal complaint or civil action

When legal help is urgent

Consult a Philippine lawyer immediately if:

The one-year deadline is approaching or the discovery date is disputed.
A prosecutor’s subpoena, court summons, arrest warrant, or arraignment notice has been received.
The post came from a dummy account and platform or subscriber records may be needed.
The alleged author claims hacking, impersonation, or shared account access.
The complainant is a public officer, journalist, candidate, activist, or other possible public figure.
The dispute involves official records, confidential information, a minor, intimate images, threats, stalking, doxxing, or gender-based sexual harassment.
The publication, author, server, or witnesses are outside the Philippines.
A separate civil action, injunction, platform request, or data-preservation measure is being considered.
Devices have been seized or law enforcement requests access to an account or computer.

Cyber libel may overlap with other laws, but each offense has different elements. Immediate threats or danger should be reported to local law enforcement without waiting for a defamation case.

Frequently asked questions

Can a private Facebook post or group chat be cyber libel?

Potentially. “Friends only” or group restrictions do not necessarily prevent publication. The prosecution must still prove that at least one third person received the defamatory material. A direct message seen only by the complainant ordinarily lacks publication.

Is one screenshot enough to file?

It may help begin an investigation, but it may not be enough to establish authenticity, authorship, context, publication, and identity. Preserve the original URL, device, full thread, account details, and witnesses.

Can I sue an anonymous account?

The publication can be investigated, but criminal responsibility must ultimately be attributed to an identifiable person through admissible evidence. Prompt law-enforcement assistance may be necessary before provider data disappears.

Is a like or share automatically cyber libel?

No. Disini protects people who merely receive and react to another person’s post. A new caption, comment, altered image, or independent accusation may be treated as a new original publication.

Does deleting the post prevent a case?

No. Deletion does not erase a completed publication or copies already preserved. Preserve the evidence first. Deletion, correction, and apology may be relevant to motive or penalty but do not automatically extinguish liability.

Can a true statement still result in liability?

Possibly. For many private-person cases, the defense must also show good motives and justifiable ends. Different constitutional rules apply to public officers and public figures concerning public conduct.

Does cyber libel always lead to imprisonment?

No. Imprisonment is legally possible, but the Supreme Court has confirmed that a court may impose a fine alone when the circumstances justify it. A conviction may also include damages and accessory consequences.

What happens after the prosecutor finds sufficient evidence?

The prosecutor files an Information in the proper RTC. The judge evaluates probable cause, after which the case may proceed through warrant or bail proceedings, arraignment, pretrial, trial, judgment, and any timely post-judgment remedies.

How long do I have to appeal a conviction?

The general period to appeal a criminal judgment is 15 days from promulgation or notice, subject to the effect of a timely motion for new trial or reconsideration and the rules governing the particular case. Obtain counsel immediately after judgment rather than waiting for the period to expire.

Official and primary references

This article provides general legal information, not legal advice or an attorney-client relationship. Outcomes depend on the exact words, audience, authorship evidence, discovery date, venue, documents, and procedural history. Philippine statutes, rules, and controlling sources were checked through July 26, 2026.