Quick answer

A cyber libel case begins with a sworn complaint and supporting evidence filed with the proper city or provincial prosecutor’s office. The prosecutor determines whether there is prima facie evidence with reasonable certainty of conviction; if the complaint passes preliminary investigation, an Information is filed in a designated Regional Trial Court acting as a cybercrime court.

Act quickly. The Supreme Court has affirmed with finality that cyber libel generally prescribes in one year from its actual discovery by the offended party, the authorities, or their agents—not automatically from the date the post was uploaded. A platform report, demand letter, or informal report should not be assumed to stop the period. Have counsel ensure that the proper complaint is filed in time. Causing v. People, G.R. No. 258524, April 8, 2026

If you receive a prosecutor’s subpoena, do not ignore it. Preserve everything, note the response date, and prepare a sworn counter-affidavit addressing every element, the evidence of authorship, venue, prescription, malice, and any privilege or constitutional defense.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or similar information and communications technology.

The prosecution must ultimately prove beyond reasonable doubt that:

The accused made an imputation of a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
The imputation was published through a computer system or similar technology.
A person other than the person defamed received or understood it.
The person allegedly defamed was identified or was identifiable from the words and surrounding circumstances.
The accused was responsible for the publication.
The required malice existed.

The complainant need not always be named. Identification may be established if people familiar with the circumstances could reasonably determine who was being discussed. Conversely, an offensive post aimed only at a broad, indeterminate group may fail the identification requirement.

A private message sent only to the person insulted ordinarily lacks publication to a third person. A group chat, email copied to others, public post, livestream, online article, video, or comment visible to another person may satisfy publication, depending on the evidence.

Simple reactions and shares are treated differently

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but rejected liability based merely on receiving a defamatory post and reacting to it. A simple “like,” reaction, or unelaborated sharing should therefore not be treated automatically as cyber libel.

The result can change when a person writes a new defamatory caption, adds an independent accusation, edits the material, or creates a separate post. Liability then depends on the person’s own words and conduct, not merely on the original post.

The same defamatory material should not be prosecuted as two separate libels merely because it appeared in print and was also posted online. The precise publications, dates, authors, and charges must nevertheless be examined.

The one-year deadline

Cyber libel generally prescribes in one year from discovery. Article 91 of the Revised Penal Code provides that prescription is interrupted by the filing of the complaint or Information and may run again if the proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused. The period does not run while the offender is absent from the Philippines.

Discovery is a factual question. The Supreme Court has ruled that even a public Facebook post is not conclusively presumed discovered on its upload date. Discovery may be shown by, among other things:

A message forwarding the post to the complainant
A screenshot first received on a particular date
The complainant’s reaction, reply, or comment
A demand for deletion or threat of legal action
A contemporaneous report to counsel, an employer, police, or another agency
Testimony from the person who first showed the material to the complainant

Both sides should preserve evidence of the discovery date. A complainant should not wait simply because discovery occurred recently. A respondent who asserts prescription needs evidence establishing an earlier discovery, not just the upload date.

How to file a complaint

1. Preserve the material before confronting the poster

Capture the entire publication, not just the allegedly offensive sentence. Preserve:

Full-page screenshots showing the account name, URL, date, time, captions, comments, and surrounding context
A screen recording showing how the post was located and opened
The original photo, audio, video, message, or downloaded webpage
Profile details and account identifiers
Email headers, message details, and available metadata
Links, shortened URLs, and archived copies
Names and contact information of people who saw the material
Messages showing when and how the complainant discovered it
Documents disproving the accusation or showing why the author knew it was false
Evidence of resulting harm, such as lost clients, disciplinary action, threats, or requests for explanation

Keep the original device and files unchanged. Make working copies rather than editing the originals. Electronic evidence must be authenticated; screenshots are not automatically conclusive merely because they look genuine. The Rules on Electronic Evidence place the burden of authentication on the party offering the electronic document.

If the post may disappear or the account is anonymous, promptly consult counsel or seek investigative assistance. The NBI online complaint facility and the NBI Cybercrime Division may assist with investigation, but an investigative report should not be assumed to replace timely filing with the proper prosecution office.

2. Check every legal element before filing

The complaint-affidavit should explain, with personal knowledge where possible:

The exact defamatory words, images, or statements
Their meaning in context, including any necessary translation
Why they refer to the complainant
Who received or viewed them
Why the respondent is believed to be the author
When the material was published and discovered
Why the statement was malicious or knowingly or recklessly false
The facts supporting the chosen venue
The supporting documents and witnesses for each element

A bare allegation that an account “belongs” to the respondent may be insufficient if authorship is genuinely disputed. Identify admissions, account details, prior communications, witness testimony, distinctive information, or lawfully obtained digital evidence connecting the respondent to the publication.

3. Choose the proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, a cybercrime action may be filed in the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used is situated; or
Where any of the damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. The complaint is ordinarily initiated through the prosecution office corresponding to the proper venue. State the concrete facts supporting venue; general internet accessibility everywhere is not a safe substitute for proper venue allegations.

4. File the sworn complaint and required documents

Submit the complaint-affidavit, affidavits of supporting witnesses, Investigation Data Form, electronic and documentary evidence, proof of the respondent’s last known address, and the copies required by the particular prosecution office. Check the office’s current checklist, fees, office hours, and accepted filing method before the deadline.

The current 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings require prima facie evidence with reasonable certainty of conviction. The evidence must be credible, admissible, capable of preservation and presentation at trial, and sufficient—if left uncontroverted—to establish all elements and the respondent’s identity. The Supreme Court upheld these rules in G.R. No. 280455.

5. Participate in the preliminary investigation

If the complaint is complete and sufficient in form, it is docketed and assigned to an investigating prosecutor. The respondent is served with a subpoena and copies of the complaint and evidence.

The respondent files a sworn counter-affidavit and supporting evidence at the preliminary investigation hearing. Current procedure contemplates a short response period; the subpoena and hearing order control. An extension requires meritorious grounds and, when granted under the DOJ-NPS rules, may not exceed ten days. Do not assume that an emailed affidavit is sufficient: electronic filing is allowed only in specified circumstances, and original hard copies may still be required.

The prosecutor may conduct a clarificatory hearing, require additional evidence, or issue subpoenas for material records and testimony. Reply- and rejoinder-affidavits are not automatic; submit them only when directed or allowed.

How to defend a complaint

Respond immediately but carefully

Upon receiving a subpoena:

Record the exact date and manner of service.
Obtain the complete complaint, attachments, and electronic files.
Preserve your account data, devices, drafts, source materials, messages, and logs.
Do not delete or alter relevant evidence.
Do not retaliate online or pressure the complainant or witnesses.
Consult a lawyer before signing a counter-affidavit.

A counter-affidavit is sworn evidence and may contain admissions usable later. A motion to dismiss cannot ordinarily substitute for it unless the motion is verified, contains the defenses, and can be treated as a counter-affidavit. Failure to respond may allow the prosecutor to resolve the complaint using only the complainant’s evidence.

Test the prosecution’s proof element by element

A useful defense review asks:

Defamatory imputation: Do the words actually accuse the complainant of a crime, vice, defect, or discreditable condition when read as a whole?
Publication: Did anyone other than the complainant receive the statement?
Identification: Could readers reasonably identify the complainant?
Authorship: What admissible evidence connects the accused to the account and particular post?
Computer-system use: Was the charged material actually published through the technology alleged?
Malice: Was malice presumed, or must actual malice be affirmatively proved?
Venue: Do the complaint and evidence establish one of the authorized venues?
Prescription: When did the complainant, an authority, or an agent actually discover the publication?
Date of conduct: Was the post made after the Cybercrime Prevention Act took effect? An online post made before the law became effective cannot be punished retroactively as cyber libel.

Defenses and important exceptions

No authorship or unreliable digital attribution

An account name, photograph, or screenshot does not necessarily prove who controlled the account at the relevant time. Evidence of impersonation, hacking, shared access, spoofing, fabrication, or missing context may be material. Preserve security alerts, login histories, account-recovery messages, device records, and reports made when the compromise was discovered.

Do not manufacture a hacking defense. False affidavits and altered records can create separate criminal exposure.

No defamatory meaning, identification, or publication

Humor, rhetorical exaggeration, satire, or opinion may lack an actionable factual imputation in context, but merely labeling an accusation “opinion” does not protect a false factual charge. The whole publication, its audience, language, and surrounding circumstances matter.

Similarly, an unnamed person may still be identifiable, while a harsh statement directed at no ascertainable person may fail the identification element.

Privileged communication

Article 354 of the Revised Penal Code recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments or remarks, of qualifying official proceedings or acts of public officers.

Supreme Court decisions also recognize fair commentary on matters of public interest as potentially privileged. A qualified privilege removes the ordinary presumption of malice, but it can be defeated by proof of actual malice, excessive publication, bad faith, irrelevant personal attacks, or use of the occasion for an improper purpose.

A workplace report, complaint to a regulator, or warning to a person with a legitimate interest may qualify when sent in good faith to appropriate recipients. Posting the same accusation publicly to people with no corresponding duty or interest may produce a different result.

Public officials, public figures, and public-interest speech

For criminal libel involving a public figure—particularly a public officer’s official conduct—the prosecution must prove actual malice beyond reasonable doubt: knowledge that the statement was false or reckless disregard of whether it was true. Mere negligence, an error, or failure to investigate perfectly does not by itself establish actual malice.

Reckless disregard is fact-specific. It may be supported by evidence that the author entertained serious doubts, possessed information contradicting the accusation, fabricated facts, or deliberately avoided obvious proof. The protection is not a license to knowingly publish false personal accusations unrelated to a public issue. See Daquer v. People, G.R. No. 206015.

Truth and good motives

Truth is not an automatic defense to every Philippine criminal-libel charge. Under Articles 354 and 361, admissibility and effect depend on the nature of the imputation and the complainant. Proof of truth is generally admissible when the imputation concerns a crime, and in qualifying accusations against government employees concerning their official duties. Where proof of truth is admitted, acquittal requires both truth and good motives and justifiable ends.

Preserve reliable sources, official records, interview notes, requests for comment, contemporaneous messages, and the steps taken to verify the publication. Repeating rumors or relying solely on an anonymous accusation may not establish truth or good faith.

Prescription and improper venue

Prescription and venue can be decisive but normally require supporting facts. A respondent asserting prescription should identify evidence of when the complainant or an authorized agent actually learned of the post. A venue objection should examine the allegations and evidence concerning the act of publication, the relevant computer system, and where damage occurred.

What happens after the prosecutor’s resolution

If the complaint is dismissed or charges are recommended, an aggrieved party may generally move for reconsideration within 15 days from receipt under the 2024 DOJ-NPS Rules. Further review follows separate DOJ routing and filing requirements. If an Information has already reached court, an administrative appeal does not automatically stop the court case; current rules may require a separate motion to suspend proceedings.

If an Information is filed, the RTC judge independently evaluates probable cause for issuing a warrant of arrest. Filing a complaint does not itself authorize arrest. Once a warrant is issued, however, ignoring it can worsen the situation. Cyber libel is generally bailable as a matter of right before RTC conviction, but the court determines the conditions and amount. After conviction, bail pending appeal is governed by different, more restrictive rules.

Arraignment, pre-trial, trial, and appeal follow if the case is not dismissed or otherwise resolved. At trial, guilt must be proved beyond reasonable doubt; the prosecutor’s preliminary finding is not a conviction.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional written libel. The imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period, corresponding to approximately four years, two months and one day to eight years, subject to the Indeterminate Sentence Law, mitigating or aggravating circumstances, and other sentencing rules.

The Supreme Court has also held that a court may impose a fine instead of imprisonment, imprisonment instead of a fine, or both, depending on the law and circumstances. The current fine range identified for online libel is ₱40,000 to ₱1,500,000. The judicial guideline favoring consideration of a fine does not eliminate imprisonment or guarantee a fine-only sentence. People v. Soliman, G.R. No. 256700

Civil liability may be pursued with the criminal case. Defamation may also support an independent civil action under Article 33 of the Civil Code, which uses the preponderance-of-evidence standard. The timing of a civil filing, waiver, reservation, prior action, and possible consolidation should be planned with counsel to avoid procedural problems or duplicate recovery.

Deletion, an apology, correction, settlement, or affidavit of desistance may affect damages, sentencing, or the parties’ practical decisions, but none automatically erases an already completed offense or compels the prosecutor or court to dismiss the criminal case.

Common mistakes

Waiting for a platform to answer a takedown request while the one-year period runs
Filing in a convenient city without facts establishing proper venue
Submitting cropped screenshots without URLs, context, dates, or authentication evidence
Failing to prove that anyone other than the complainant saw the post
Assuming the account name alone proves authorship
Assuming every insult, criticism, or negative review is cyber libel
Assuming “it is true” is always a complete defense
Treating a public official’s criticism exactly like a purely private dispute
Ignoring a subpoena because no warrant has been issued
Filing an unsworn denial instead of a proper counter-affidavit
Deleting posts, messages, accounts, or device data after learning of a complaint
Contacting witnesses to influence what they will say
Posting new accusations about the dispute
Assuming an apology, settlement, or affidavit of desistance guarantees dismissal

When legal help is urgent

Seek a Philippine lawyer immediately when:

The first-discovery anniversary is approaching
The author is anonymous or the post is disappearing
You need subscriber information or preservation of platform data
The complainant is a public official, journalist, company, or public figure
Several people, accounts, publications, or possible venues are involved
You received a prosecutor’s subpoena or an adverse resolution
An Information or warrant of arrest has been issued
Police or investigators want access to your device or account
The dispute also involves threats, extortion, intimate images, identity theft, data-privacy violations, or workplace discipline
A settlement, correction, or takedown is being negotiated

Do not consent casually to a device search or disclose passwords without understanding the legal basis and scope of the request. Ask for the warrant or written authority and obtain counsel.

FAQ

Can a private group-chat message be cyber libel?

Possibly. If at least one person other than the person defamed received it, publication may exist. Whether the message is defamatory, identifiable, malicious, or privileged still depends on the context.

Is a “share” automatically cyber libel?

No. Disini protects people who merely receive and react to the original post. A new caption, accusation, edit, or independently authored republication requires separate analysis.

Can a deleted post still support a case?

Yes. Deletion does not undo a completed publication if witnesses and authenticated electronic evidence can prove it. Deletion and a prompt apology may be relevant to practical resolution or sentencing, but not automatic dismissal.

Is a demand letter required before filing?

No general demand-letter requirement applies to cyber libel. A demand may support settlement or show discovery, but it does not safely substitute for filing the proper complaint within the prescriptive period.

Does the one year always start on the upload date?

No. Current Supreme Court doctrine starts the period from actual discovery by the offended party, the authorities, or their agents. The upload date and discovery date may be the same, but that must be established from the evidence.

Can the complainant file both a criminal and civil case?

Potentially, yes. Civil liability may accompany the criminal case, and Article 33 permits an independent civil action for defamation. The filing sequence, reservation, and applicable prescriptive periods require careful planning.

Will the respondent be arrested as soon as the complaint is filed?

No. A prosecutor’s complaint begins an executive investigation. Arrest ordinarily requires an Information filed in court and a judge’s independent finding of probable cause for a warrant, unless a valid warrantless arrest situation exists.

Can the case continue if the complainant withdraws?

Possibly. A criminal case is prosecuted in the name of the People of the Philippines. A withdrawal or affidavit of desistance may be considered, but it does not automatically bind the prosecutor or court.

Official sources

This article provides general legal information, not legal advice or an assessment of any particular post, complaint, or defense. Cyber libel outcomes depend heavily on the exact words, audience, authorship evidence, discovery date, venue, documents, and procedural history. Sources and current rules were checked as of 3 August 2026.