Quick answer

A cyber libel case may arise when the original author publishes a defamatory statement through Facebook, Messenger, X, TikTok, a website, email, a group chat, or another computer system. To succeed, the prosecution must establish every element of libel, the accused’s authorship, and the use of a computer system. A rude, false, or embarrassing post is not automatically cyber libel.

If you are the complainant, preserve the post and proof of authorship, publication, identification, malice, venue, and discovery before requesting deletion. File a sworn complaint with the proper City or Provincial Prosecutor’s Office; the NBI Cybercrime Division or PNP Anti-Cybercrime Group can assist when technical investigation is needed.

If you receive a prosecutor’s subpoena, do not ignore it or answer casually online. Obtain the complete complaint and evidence, record the deadline, and submit a sworn, evidence-supported counter-affidavit. Under the current DOJ rules, the hearing date—and normally the counter-affidavit deadline—must be at least 10 days after receipt of the subpoena and complaint.

Act quickly in either position. The Supreme Court has definitively ruled that criminal cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents—not automatically from the date it was posted. Filing the proper complaint or information interrupts prescription. A platform report, demand letter, or informal agency inquiry should not be assumed to stop the clock.

What is cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or a similar technological means.

The prosecution ordinarily must prove:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one person other than the person defamed received or understood the statement. A post need not be viral or visible to the entire public.
Identification. The complainant was named or was reasonably identifiable from the words, images, circumstances, or information known to readers.
Malice. The applicable kind of malice depends on whether the complainant is a private person, public figure, or public officer and whether the communication is privileged.
Use of a computer system. The publication was made through information and communications technology.
Attribution to the accused. The evidence must connect the accused—not merely a display name or profile photograph—to the account and the particular publication.

Words are assessed in context and according to how an ordinary reader would naturally understand the complete publication. Questions, jokes, memes, edited images, captions, insinuations, and videos can carry defamatory imputations, but their form alone does not establish liability.

General rules and important exceptions

Private persons

When a statement about a private person is defamatory on its face, Article 354 of the Revised Penal Code generally presumes malice unless good intention and a justifiable motive are shown. The prosecution must still prove the other elements and guilt beyond reasonable doubt at trial.

Public officers and public figures

Statements concerning a public officer’s performance of official duties, or a public figure’s participation in a public controversy, receive greater constitutional protection. The prosecution must prove actual malice: that the author knew the statement was false or published it with reckless disregard of whether it was false.

Reckless disregard requires a high degree of awareness of probable falsity or evidence that the author seriously doubted the statement’s truth. Mere error, failure to investigate, negligence, or even gross negligence does not by itself establish actual malice.

In its July 2026 decision in Tan v. People, G.R. No. 265929, the Supreme Court acquitted an accused because actual malice was not proved beyond reasonable doubt. The complainant’s status and whether the statement concerned official conduct are therefore critical factual questions, not technical labels to be assumed.

Truth is not automatically a complete defense

Under Article 361, truth may support acquittal when the imputation is true and was published with good motives and for justifiable ends. Proof of the truth of an imputation that does not constitute a crime is generally inadmissible unless it concerns a government employee’s discharge of official duties.

A respondent relying on truth should present admissible source documents and witnesses, not merely repeat rumors or say that “everyone knows” the allegation.

Privileged communications

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added remarks, of qualifying official proceedings or acts performed by public officers in the exercise of their functions, provided the matter is not confidential.

Privilege is fact-sensitive. The speaker, recipient, purpose, audience, wording, relevance, and extent of publication all matter. A communication sent only to the proper authority may be treated differently from the same accusation posted publicly. A qualified privilege removes the ordinary presumption of malice but can be defeated by proof of actual malice.

Likes, shares, reactions, and new comments

In Disini v. Secretary of Justice, the Supreme Court limited cyber-libel liability to the original author and struck down the use of the Cybercrime Prevention Act’s aiding-or-abetting provision against people who merely react to an online libel.

A person who simply receives, likes, or reacts to an existing post is therefore not automatically liable for cyber libel. But a new comment that creates its own defamatory accusation may be treated as a new original publication. The substance of the new statement—not the platform’s button or label—controls.

The one-year deadline

In Causing v. People, the Supreme Court denied reconsideration with finality and confirmed that cyber libel prescribes in one year.

The period begins when the alleged cyber libel is discovered by:

The offended party;
The authorities; or
Their agents.

A public Facebook post does not, by itself, create constructive notice on the date of posting. Privacy settings and actual accessibility may affect when discovery occurred. Comments, reactions, messages, threats to sue, and other contemporaneous conduct may prove an earlier discovery date.

The period is interrupted by filing the complaint or information. It may run again when the proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused. The period also does not run while the offender is outside the Philippines.

Preserve evidence of the exact discovery date. If you are defending, require the complainant to establish that date and collect any older messages or reactions showing earlier knowledge.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. Accrual, interruption, prior filings, and the relationship between the criminal and civil actions require case-specific analysis, so do not wait for the criminal deadline to expire before obtaining advice.

Evidence to preserve before anything is deleted

A screenshot can help, but a cropped image standing alone may fail to establish context, authenticity, authorship, publication, or date. Preserve as much of the original digital setting as possible.

Keep:

Full screenshots showing the exact words, images, account name, handle, profile, date and time, audience, comments, and surrounding context;
The complete URL or other unique identifier for the post, account, video, or message;
A screen recording showing navigation from the account or page to the publication;
Original downloaded files, emails, message exports, notifications, and platform data;
The device on which the content was received, with its original files and metadata intact;
A written chronology stating when and how the post was discovered;
Names and contact details of people who personally saw or received the post;
Messages, admissions, apologies, or demands that connect the account and post to a person;
Earlier posts, writing patterns, unique facts, linked accounts, or communications relevant to authorship;
Documents confirming or disproving the accusation;
Evidence of actual harm, such as lost contracts, customer inquiries, employment records, or treatment records, where damages are claimed; and
Proof of relevant locations, including where the author used the device, where a computer system was situated, and where the damage occurred.

The Rules on Electronic Evidence require electronic evidence to be authenticated. The Supreme Court has recognized several possible ways to connect a social-media account to an accused, including admissions, eyewitness testimony, distinctive information or language, consistent conduct, platform or telecommunications records, and forensic examination.

Do not hack an account, guess a password, impersonate another person, install spyware, or secretly seize someone’s device. Illegally obtained evidence may be excluded and may expose the collector to separate liability.

How to file the criminal complaint

1. Identify the proper venue

Cybercrime cases fall within Regional Trial Court jurisdiction and are handled by designated cybercrime courts. Under the Rule on Cybercrime Warrants, a criminal action may be filed in the designated cybercrime court of the province or city where:

The offense or any element occurred;
Any part of the computer system used was situated; or
Any damage to a natural or juridical person took place.

The court where the action is first properly filed acquires jurisdiction to the exclusion of the others. The corresponding prosecution office ordinarily conducts the preliminary investigation.

Do not select an office solely for convenience. State and support the facts establishing venue. When the post, author, devices, readers, and harm are in different places, consult counsel before filing.

2. Decide whether technical investigation is needed

You may proceed directly to the proper City or Provincial Prosecutor’s Office if the respondent is known and the evidence is sufficiently complete.

Seek investigative assistance from the NBI Cybercrime Division or PNP Anti-Cybercrime Group when:

The account is anonymous or impersonating someone;
The post has been deleted;
Subscriber, traffic, or platform records may be needed;
Devices require forensic examination;
The publication or account is outside the Philippines; or
Authorship is disputed.

The NBI’s Citizen’s Charter for computer-crime assistance describes its intake and sworn-statement process. The PNP’s Primer on Cybercrime Investigation identifies evidence investigators commonly require.

Ask promptly whether a lawful preservation request or cybercrime warrant is needed. A private complainant cannot compel a platform or telecommunications company to disclose protected subscriber or content data merely by sending a demand.

3. Prepare a complete complaint-affidavit

Under DOJ Department Circular No. 015, series of 2024, a regular preliminary investigation begins by filing:

The original sworn complaint-affidavit;
Two duplicate copies for the official file;
One additional copy for each respondent;
A completed NPS Investigation Data Form;
Affidavits of witnesses; and
All available supporting evidence.

The complaint-affidavit should clearly state:

The parties’ names and addresses;
The exact statement complained of;
When, where, and through what computer system it was published;
Why it is defamatory;
How the complainant was identified;
Who other than the complainant saw or received it;
Why the respondent is the author;
Facts establishing the applicable form of malice;
The date and circumstances of discovery;
Facts establishing venue; and
The documents and witnesses supporting each allegation.

The affidavit must be sworn before a prosecutor or another government official authorized to administer oaths or, if they are unavailable, a notary public.

The DOJ rules allow e-filing and virtual preliminary investigation as alternatives, but availability and official email addresses vary by prosecution office. Confirm the local office’s current filing instructions. Do not rely on an unverified email address or assume that sending an email completed filing.

4. Expect evaluation and preliminary investigation

The prosecution office first checks whether the complaint is sufficient in form and whether the evidence is complete. It may require missing evidence before docketing.

Once assigned, the investigating prosecutor has five calendar days to recommend dismissal or issue subpoenas. The hearing must be set within 30 calendar days from the prosecutor’s receipt of the complete record. The respondent must receive at least 10 days from receipt of the subpoena and complaint to prepare a counter-affidavit.

The current prosecutorial standard is prima facie evidence with reasonable certainty of conviction. The available evidence must be admissible, credible, preservable, and capable—if uncontroverted—of proving every element and the responsible person. The Supreme Court upheld this standard in Meking v. Department of Justice, G.R. No. 280455.

How to defend after receiving a subpoena

1. Record receipt and obtain the complete record

Write down the exact date, time, and manner in which the subpoena was received. Check whether it includes the complaint-affidavit and every attachment. For voluminous records, the prosecutor must provide an opportunity to obtain the complete record at least 10 days before the hearing.

Do not assume that a missing attachment suspends the deadline automatically. Raise the omission immediately in writing.

2. Engage counsel before signing anything

A counter-affidavit is sworn testimony and may later be used as evidence. Statements made casually to investigators, complainants, employers, or online audiences can also damage the defense.

If private counsel is unaffordable, promptly ask the Public Attorney’s Office or an IBP legal-aid office whether you qualify for assistance.

3. File a counter-affidavit, not a bare motion

A motion to dismiss cannot ordinarily replace a counter-affidavit. If a verified motion contains the respondent’s factual and legal defenses, the prosecutor may treat it as the counter-affidavit.

Answer each element and attach admissible evidence. Depending on the facts, defenses may include:

The words are not defamatory when read as a whole;
The statement is opinion, rhetorical criticism, satire, or hyperbole that would not reasonably be understood as asserting a defamatory fact;
No third person received or understood the communication;
The complainant was not identifiable;
The respondent did not own, control, or use the account;
The account was hacked, spoofed, or impersonated, supported by contemporaneous reports and technical evidence;
The screenshots are incomplete, altered, unauthenticated, or do not prove the post’s existence, context, or author;
The communication was privileged;
The statement concerned a public officer or public figure and actual malice cannot be proved;
The allegation was true and made with good motives and for justifiable ends, where Article 361 permits that defense;
The respondent merely received or reacted to another person’s post and did not create a new defamatory publication;
Venue is not supported by facts;
The post predates the Cybercrime Prevention Act and cannot be punished retroactively; or
The case prescribed before the proper complaint was filed.

A general denial is rarely enough. Identify the supporting witness or document for each factual defense.

4. Meet the deadline

The subpoena must allow at least 10 days from receipt to submit the counter-affidavit. An extension is not automatic. Under the DOJ rules, an extension may be allowed when the interests of justice require time to obtain counsel, examine voluminous records, or address novel or technical issues. Any granted extension may not exceed 10 days.

If the respondent received the subpoena at the last known address but fails to appear or file without justification, the prosecutor may resolve the case using the complainant’s evidence alone.

5. Prepare for clarification and resolution

After receiving the counter-affidavit, the prosecutor may submit the case for resolution or set a physical or virtual clarificatory hearing within 10 calendar days. The parties do not have an automatic right to cross-examine each other during preliminary investigation.

The DOJ rules direct the investigating prosecutor to resolve a regular preliminary-investigation complaint within 60 calendar days from assignment, with a maximum 30-day extension for specified circumstances such as complex issues, countercharges, consolidation, or reassignment. These are official processing periods; their expiration does not automatically dismiss the complaint.

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A further petition for review is governed by separate DOJ rules. When an information has already been filed in court, a petition for review does not by itself guarantee that the court proceedings will stop; counsel should seek the appropriate suspension promptly.

What happens if an information is filed in court?

The prosecutor’s filing does not itself prove guilt. The RTC judge independently examines the record to determine judicial probable cause. The judge may dismiss for lack of probable cause, require additional evidence, or issue a warrant of arrest.

Before conviction, bail for cyber libel is generally a matter of right because the offense is not punishable by reclusion perpetua. The court determines the amount and conditions. If a warrant has been issued, do not evade it or attempt an improvised surrender. Counsel can verify the warrant, coordinate surrender, prepare the bail requirements, and prevent avoidable detention.

At arraignment and trial, the prosecution must prove guilt beyond reasonable doubt. Objections to electronic evidence must be raised at the proper time; a failure to object when evidence is formally offered can waive an admissibility challenge.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional libel:

Imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period, corresponding to four years, two months, and one day up to eight years; or
A fine from ₱40,000 to ₱1,500,000; or
Both imprisonment and fine.

In People v. Soliman, the Supreme Court held that a court may impose a fine alone. Administrative Circular No. 08-2008 encourages courts to consider whether a fine would better serve justice in a particular libel case, but it does not abolish imprisonment. Subsidiary imprisonment may also apply if a fine is imposed and remains unpaid, subject to the Revised Penal Code.

A civil claim arising from the offense is ordinarily deemed included with the criminal case unless the offended party waives it, reserves the right to file separately, or filed the civil action first. A purely civil defamation action may also be available under Article 33 of the Civil Code. Damages are not presumed in every amount claimed; the nature, cause, and extent of the loss must be proved under the applicable rules.

An apology, correction, deletion, affidavit of desistance, forgiveness, or settlement of damages does not automatically extinguish the criminal case, which is prosecuted in the name of the People of the Philippines. It may nevertheless affect the civil aspect, evidentiary issues, damages, or the court’s choice of penalty.

Practical steps that may limit further harm

After preserving evidence:

Use the platform’s reporting and takedown tools;
Consider a carefully drafted request for correction, retraction, or removal;
Correct misinformation with verifiable facts instead of retaliatory accusations;
Restrict further circulation of sensitive material;
Ask witnesses not to repost the publication merely to “save” it;
Preserve communications with the author without threatening, harassing, or bargaining for money in exchange for silence; and
Route negotiations through counsel when admissions, settlement, or public statements could affect the case.

A prior demand or request for retraction is generally not an element that must be proved before filing cyber libel. It can be useful, but it should not consume the one-year period.

Common mistakes

Saving only a cropped screenshot without the URL, account, date, or context;
Requesting deletion before preserving the evidence;
Waiting for a platform, employer, barangay, or agency to respond while prescription runs;
Assuming every false or insulting statement is defamatory;
Failing to prove that anyone other than the complainant saw the post;
Treating a profile name or photograph as conclusive proof of authorship;
Naming every liker, follower, group administrator, or sharer as an accused without evidence of a new original publication;
Assuming truth alone always defeats the case;
Ignoring the public-official, public-figure, actual-malice, or privilege issues;
Filing in a convenient but unsupported venue;
Missing the counter-affidavit or reconsideration deadline;
Filing a bare denial without supporting affidavits or records;
Deleting accounts, messages, devices, or files after receiving a complaint, subpoena, or preservation instruction;
Posting the complaint, counter-affidavit, settlement discussions, or evidence publicly; and
Assuming that desistance or private settlement automatically ends the prosecution.

When legal help is urgent

Seek a Philippine lawyer immediately if:

The one-year period is close to expiring;
You received a prosecutor’s subpoena or court process;
A warrant may already have been issued;
The post or account is being deleted;
The author is anonymous, overseas, or using an impersonation account;
A device, office, or home may be searched;
The statement concerns a public officer, election, journalist, whistleblower, or public controversy;
Several posts or several complainants are involved;
The case includes threats, extortion, stalking, intimate images, child-related material, identity theft, or data-privacy violations; or
Employment, immigration, professional-license, or business consequences are likely.

Frequently asked questions

Is a private Messenger message cyber libel?

If only the person allegedly defamed received it, the publication element may be absent. If it was sent to or seen by another person, publication may exist. Group chats and forwarded messages require a factual review of recipients and authorship.

Can I file even if the post was deleted?

Possibly. Deletion does not erase an offense already completed, but the remaining evidence must still prove the post, its content, publication, authorship, and other elements. Preserve devices, notifications, witness testimony, and lawful platform or forensic records.

Is an anonymous account a dead end?

No, but a display name and photograph are not enough. NBI or PNP investigators may seek subscriber, traffic, device, or platform evidence through the required legal process. Start promptly because providers do not retain every type of data indefinitely.

Does an offensive opinion count as libel?

Not automatically. Courts consider whether the words, in their full context, communicate a factual defamatory imputation or are recognizable opinion, criticism, satire, or hyperbole. Simply adding “in my opinion” does not protect a statement that asserts defamatory facts.

Can a public official file cyber libel?

Yes. Public office does not eliminate protection of reputation. But when the statement concerns official conduct, the prosecution must prove actual malice beyond reasonable doubt.

Will the respondent be arrested as soon as I file?

Ordinarily, no. Cyber libel undergoes preliminary investigation. If the prosecutor later files an information, the judge independently determines whether probable cause and a need for an arrest warrant exist.

Does correcting or apologizing prove guilt?

Not automatically. An apology may be explained in several ways and must be assessed with all the evidence. It may mitigate consequences, but it may also contain admissions. Obtain advice before publishing a detailed apology while a case is pending.

Can both traditional libel and cyber libel be charged for the same online post?

The same online libel cannot be punished twice merely by charging it under both the Revised Penal Code and the Cybercrime Prevention Act. The Supreme Court addressed this double-jeopardy concern in Disini. Different publications or independently authored statements may require separate analysis.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Cyber libel depends heavily on the complete publication, the parties’ status, admissible digital evidence, authorship, venue, and procedural history. Sources and current law were checked as of August 7, 2026.