Quick answer

To file a cyber libel case in the Philippines, preserve the online material and proof of when it was discovered, identify the person responsible, and file a sworn complaint-affidavit with supporting evidence before the proper prosecutor’s office. A report to the National Bureau of Investigation or Philippine National Police cybercrime unit may help when account ownership or technical evidence must be investigated, but it does not replace a properly filed complaint.

To defend a case, do not ignore the prosecutor’s subpoena. Preserve the complete post and its context, obtain the complaint and attachments, and submit a sworn counter-affidavit with supporting documents by the stated deadline. Defenses may involve failure to prove authorship, publication, identification, defamatory meaning, malice, or use of a computer system; privileged communication; good intention and justifiable motive; prescription; improper venue; or constitutional protection for speech on public issues.

The most important time limit is now settled: cyber libel prescribes in one year, counted from discovery of the alleged offense by the offended party, the authorities, or their agents. The Supreme Court reaffirmed this rule in April 2026. Because the discovery date and interruption of prescription can be disputed, neither side should rely on informal assumptions about the deadline.

What legally counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to unlawful defamatory material published through a computer system or a similar technological means.

The prosecution generally must establish:

A defamatory imputation—an allegation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt;
Publication or communication of the imputation to at least one person other than the person defamed;
Identification of the offended person, whether named directly or made reasonably identifiable from the circumstances;
Malice, subject to the rules on presumed and actual malice;
Use of a computer system or information and communications technology; and
The respondent’s responsibility for the publication.

Cyber libel is therefore not established merely because an online statement is offensive, rude, embarrassing, mistaken, or critical. The words, images, context, audience, identity of the speaker, identity of the subject, and evidence of publication all matter.

A private message sent only to the person discussed ordinarily presents a publication problem because libel requires communication to a third person. A message sent to a group chat, copied to others, forwarded, or shown to another person may satisfy publication, depending on the evidence.

Who may be charged?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author of the online statement. It invalidated the application of the Cybercrime Prevention Act’s general aiding-or-abetting provision to people who merely receive a post and react through ordinary “Like,” “Comment,” or “Share” functions.

That ruling does not give blanket immunity to every user who interacts with a post. A person who adds a new defamatory caption, independently writes an accusation, edits material into a new publication, or falsely presents another person’s words as fact may become the author of a separate statement. Liability depends on what that person actually created or published, not simply on the platform button used.

Account ownership must also be proved. A profile name, screenshot, or allegation that “everyone knows who owns the account” may not be enough if authorship is genuinely contested.

Malice, truth, and protected communications

General rule on malice

Article 354 of the Revised Penal Code generally presumes malice from a defamatory imputation, even if the imputation is true, when no good intention and justifiable motive are shown.

This does not mean that truth is irrelevant. It means that “the statement was true” should not be treated as an automatic, stand-alone defense in every criminal libel case. Article 361 imposes specific conditions on proof of truth, and the accused may also need to establish good motives and justifiable ends. The applicable rule depends on what was alleged, whom it concerned, and why it was published.

Privileged communications

The presumption of malice does not attach in the same way when the communication is privileged. Article 354 recognizes, among others:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of specified official proceedings or acts, except confidential matters.

Qualified privilege is not unlimited. Unnecessary distribution, excessive language, lack of good faith, or proof of actual malice may defeat it. A workplace complaint, report to authorities, consumer complaint, or internal warning should therefore be sent only to people who have a legitimate role in receiving it and should be confined to relevant, supportable facts.

Public officers, public figures, and matters of public concern

When speech concerns the official conduct of a public officer, a public figure, or a legitimate public issue, constitutional protection for free expression becomes especially important. Depending on the case, the complainant may have to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false.

Strong criticism, opinion, satire, and rhetorical exaggeration are not automatically criminal. Courts examine the complete context and whether the statement would reasonably be understood as asserting a defamatory fact. Calling a public decision “terrible,” for example, is different from falsely asserting that a named official stole a specific amount.

The one-year deadline

In Causing v. People, the Supreme Court confirmed that cyber libel prescribes in one year under Article 90 of the Revised Penal Code.

Under Article 91, that period begins when the alleged crime is discovered by:

The offended party;
The authorities; or
Their agents.

The Court rejected an automatic presumption that an online post is discovered on the day it is uploaded. A complainant should therefore document the actual discovery date—who found the material, when it was first seen, how it was reported, and what records confirm that account. A respondent claiming prescription should obtain evidence contradicting the alleged discovery date rather than relying only on the visible posting date.

Filing a complaint or information may interrupt prescription under Article 91, but whether a particular submission was timely, valid, and filed with an office authorized to act on it can become a technical issue. File well before the anniversary and obtain a stamped or electronic acknowledgment showing the exact date of filing.

An independently filed civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code.

How to preserve online evidence

Preserve evidence before requesting removal or confronting the account owner. Save more than a cropped screenshot.

Keep:

The complete post, comment, message, video, or image;
The full URL and the account or channel URL;
Visible usernames, profile identifiers, dates, times, and audience settings;
The entire conversation or thread, including material before and after the disputed words;
Screenshots and screen recordings showing how the material was accessed;
Original downloaded files, emails, chat exports, and attachments;
Metadata and device copies, without editing or renaming the originals unnecessarily;
Notifications, platform reports, takedown responses, and preservation correspondence;
Documents supporting or disproving the accusation;
Names and affidavits of people who personally saw or received the publication;
Evidence connecting the account to its alleged owner;
Records establishing when the complainant or authorities first discovered the material; and
Evidence of actual consequences, such as lost work or business, when damages are claimed.

Create working copies and retain the originals. Record the date, time, device, application, and person who collected each item. Do not fabricate a conversation, alter a screenshot, crop out qualifying context, or access another person’s account without authority.

Screenshots are not automatically conclusive. Electronic evidence must still be authenticated and shown to be reliable under the Rules on Electronic Evidence. Where authorship, deletion, impersonation, or account compromise is disputed, technical investigation and properly obtained platform or service-provider records may be important.

How to file a cyber libel complaint

1. Evaluate the exact publication

Transcribe the disputed words accurately and identify each image, video, caption, hyperlink, or comment relied upon. Explain their ordinary meaning in context. Avoid replacing the actual statement with a conclusion such as “the respondent destroyed my reputation.”

For each respondent, specify:

What that person allegedly wrote or uploaded;
When and where it was published;
How the offended person was identified;
Who other than the offended person saw it;
Why it was defamatory;
What establishes authorship; and
Why the publication was malicious or made without good intention and justifiable motive.

2. Determine the proper place to file

Cybercrime cases are tried by designated Regional Trial Courts. Under the Rule on Cybercrime Warrants and Section 21 of Republic Act No. 10175, legally relevant locations may include the city or province:

Where the offense or an element occurred;
Where a relevant part of the computer system was situated; or
Where the damage to the natural or juridical person occurred.

Venue is fact-sensitive and cannot safely be based merely on where a screenshot was opened. The complaint and, later, the Information should allege facts supporting the chosen venue.

3. Consider a cybercrime investigation

When technical identification or preservation is required, the complainant may seek assistance from:

The NBI Cybercrime Division;
The PNP Anti-Cybercrime Group; or
The DOJ Office of Cybercrime, where its coordinating or international-assistance functions are relevant.

The NBI and PNP are the principal law-enforcement authorities under the Cybercrime Prevention Act. They may pursue lawful preservation, disclosure, search, or examination procedures. Private parties cannot compel a service provider to disclose protected subscriber or content data simply by sending a demand letter.

Under Sections 13 and 14 of Republic Act No. 10175, law-enforcement preservation and court-authorized disclosure procedures have specific requirements. Because platform data may be deleted under retention policies, urgent legal advice is appropriate when account identification depends on provider records.

4. Prepare the complaint-affidavit

The complaint should ordinarily include:

A sworn complaint-affidavit containing facts based on personal knowledge;
Witness affidavits;
Copies of the electronic material and an organized exhibit list;
Supporting documents establishing falsity, malice, authorship, publication, identity, venue, discovery date, and claimed injury;
The respondent’s known address and identifying information;
The required NPS investigation form and copies for each respondent; and
Any filing requirements imposed by the particular prosecution office.

The current DOJ-NPS rules require prosecutors to determine whether the evidence establishes a prima facie case with reasonable certainty of conviction. Evidence should therefore be admissible, credible, capable of preservation and presentation at trial, and sufficient to establish every element and the identity of the responsible person.

5. File and keep proof

File with the proper Office of the City Prosecutor, Office of the Provincial Prosecutor, or other prosecutor authorized by law. Follow that office’s current rules for personal or electronic filing and payment of any applicable legal fees. Keep the docket number, official receipt, stamped copy, acknowledgment email, and complete duplicate of everything submitted.

A cease-and-desist or takedown demand is optional. It may resolve a dispute or help show notice, but it does not substitute for filing the criminal complaint and should not be allowed to consume the one-year period.

What happens during preliminary investigation?

Cyber libel carries a penalty high enough to require regular preliminary investigation before the National Prosecution Service. The governing framework is DOJ Department Circular No. 015, series of 2024, whose validity was upheld by the Supreme Court in Meking v. Remulla.

The usual sequence is:

The prosecutor evaluates the complaint and supporting evidence.
If the case proceeds, the respondent receives a subpoena with the complaint and attachments.
The subpoena sets the preliminary-investigation hearing and directs the respondent to submit a sworn counter-affidavit and supporting evidence. The scheduled submission date must generally give the respondent at least 10 days from receipt of the subpoena and complaint.
When allowed or required, the complainant may submit a reply-affidavit addressing new matters, and the respondent may submit a rejoinder-affidavit.
The prosecutor may ask clarificatory questions or require further case build-up.
The prosecutor resolves whether prima facie evidence with reasonable certainty of conviction exists.

Preliminary investigation is not yet the criminal trial. It determines whether an Information should be filed in court. There is generally no right to cross-examine witnesses at this stage, and affidavits should contain the evidence the party expects the prosecutor to evaluate.

Available motions for reconsideration, petitions for review, and their deadlines depend on the governing DOJ rules, the office that issued the resolution, the offense and penalty involved, and service of the decision. Read the resolution and notice immediately; do not assume that a review automatically stops court proceedings or suspends all other deadlines.

How to defend after receiving a subpoena

Act immediately

Record the exact date and manner of service. Obtain every attachment and compare it with the prosecutor’s docket. If pages, media files, or exhibits are missing, make a prompt written request and preserve proof of that request.

Do not ignore the subpoena. Failure to submit a counter-affidavit may cause the prosecutor to resolve the complaint on the evidence presented by the complainant.

Build the defense around the elements

Possible issues include:

No authorship: The respondent did not create, control, or publish the material.
Compromised or fake account: The account was hacked, cloned, spoofed, or operated by someone else.
No publication: No third person received or understood the communication.
No identification: Readers could not reasonably identify the complainant.
No defamatory factual imputation: The material was opinion, criticism, satire, hyperbole, or innocuous when read in full context.
Missing online element: The evidence does not establish publication through the alleged computer system.
Qualified privilege: The communication was made in good faith to a proper recipient in the performance of a legal, moral, or social duty, or was another protected communication.
Public-interest speech: The case requires proof of actual malice, which the evidence does not establish.
Truth, good intention, and justifiable motive: The applicable statutory requirements are supported by admissible records.
Prescription: More than one year ran from legally provable discovery without a valid interruption.
Improper venue: The complaint or Information lacks a sufficient factual connection to the chosen place.
Pre-law publication: Penal laws cannot be applied retroactively to online publication occurring before cyber libel became punishable.
Mere reaction or sharing: The conduct falls within the constitutional limits recognized in Disini, rather than independent authorship of a defamatory statement.

A denial should be specific and supported. If the defense is hacking, preserve login alerts, device history, recovery emails, authentication records, prior reports, and provider communications. If the defense is truth or good-faith reporting, attach the underlying official records, interviews, messages, recordings, research notes, and proof of verification.

Avoid self-inflicted problems

Do not:

Delete the post or account before preserving a complete forensic copy;
Alter timestamps, captions, or message history;
Pressure the complainant or witnesses;
Publish retaliatory accusations;
Ask others to create matching stories;
Contact the prosecutor privately about the merits;
Submit an unsworn narrative in place of a proper counter-affidavit; or
Assume that taking down the material automatically ends criminal or civil exposure.

Removal, correction, apology, or settlement may be relevant to practical resolution or damages, but none automatically erases an already completed offense. Any proposal should be handled carefully, particularly if its wording could be treated as an admission.

What happens if an Information is filed?

If the prosecutor approves the charge, an Information is filed in the designated Regional Trial Court. The judge independently determines whether probable cause exists for issuing a warrant of arrest or other appropriate process.

The accused should obtain counsel immediately to address:

The court branch and case number;
Any warrant and the procedure for posting bail;
Arraignment deadlines;
A possible motion to quash, including prescription or defective allegations;
Preservation and production of electronic evidence;
Pre-trial admissions and stipulations;
Witness preparation; and
Whether civil liability is deemed instituted with the criminal action.

Do not evade service or attempt to negotiate informally with arresting officers. A lawyer can verify the warrant and arrange the lawful court process.

Cyber libel is subject to the penalty framework in Article 355 of the Revised Penal Code, as amended by Republic Act No. 10951, together with the one-degree-higher rule in Section 6 of Republic Act No. 10175. Criminal exposure may include imprisonment, a fine, or both, as determined under the applicable provisions, plus civil liability. The precise imposable penalty depends on the charge, the governing penalty rules, and the facts found by the court.

The same defamatory publication cannot constitutionally be punished twice as both ordinary libel and cyber libel merely because Section 7 of Republic Act No. 10175 mentions liability under other laws. Disini invalidated such double punishment for the same act.

Civil remedies and non-criminal options

Depending on the objective and facts, alternatives or parallel remedies may include:

A narrowly written correction or retraction request;
A platform report or takedown request;
A civil action for damages;
An injunction in an appropriate case, subject to constitutional limits on prior restraint;
A workplace, professional, school, or regulatory complaint;
A data-privacy remedy when the dispute concerns unlawful processing or disclosure of personal data; or
A different criminal complaint if the conduct independently constitutes threats, harassment, identity theft, unauthorized access, or another offense.

These remedies have different elements, venues, limitation periods, and evidentiary requirements. A hurtful online post is not automatically cyber libel, and conduct that fails as cyber libel may—or may not—fall under another law.

Common mistakes

Mistakes by complainants

Filing against everyone who liked, commented on, or shared a post without identifying an independently unlawful statement;
Submitting cropped screenshots with no URL, date, context, or authentication witness;
Failing to prove that a third person saw the material;
Assuming that a profile name proves authorship;
Treating truth as irrelevant or failing to address privilege and public-interest speech;
Filing in a convenient but legally unsupported venue;
Waiting for a platform investigation while the one-year period runs;
Failing to document the discovery date; and
Using criminal proceedings mainly to suppress criticism rather than to address a provably defamatory factual imputation.

Mistakes by respondents

Missing the counter-affidavit deadline;
Posting an angry “explanation” that repeats or expands the accusation;
Deleting evidence without first preserving it;
Giving passwords or devices to private persons without safeguards;
Relying on “freedom of speech” without addressing the elements and evidence;
Claiming hacking without contemporaneous technical proof;
Assuming that truth alone always defeats criminal libel; and
Waiting until arraignment to raise a venue or prescription issue that should have been investigated earlier.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The one-year deadline is close or the discovery date is disputed;
The author is anonymous, the post is disappearing, or provider data may be lost;
A prosecutor’s subpoena has arrived;
The respondent has only days to prepare a counter-affidavit;
Police or NBI investigators request an interview, device examination, passwords, or consent to search;
A preservation, disclosure, search, seizure, or examination warrant is involved;
An Information or warrant of arrest may already have been issued;
The publication concerns a public officer, journalist, whistleblower, election, or matter of public concern;
The case involves a child, intimate material, threats, stalking, or doxxing;
The publication occurred partly outside the Philippines; or
Settlement terms could affect admissions, civil claims, employment, or other proceedings.

Frequently asked questions

Is a screenshot enough to win a cyber libel case?

Not necessarily. It may help show content, but the proponent must still establish authenticity, authorship, publication, identity, context, venue, and the other elements. Original files, URLs, witness testimony, account records, and metadata can be important.

Can an anonymous account be charged?

A real person must ultimately be identified and linked to the publication. The NBI or PNP may use lawful investigative and court-authorized procedures to obtain relevant data. A complainant should not name a suspected person without supporting evidence.

Can I file because a post is false?

Falsity alone does not complete cyber libel. The material must satisfy all elements, including defamatory imputation, publication, identification, malice, online commission, and authorship.

Can I be charged for sharing someone else’s post?

A bare platform reaction or share is not automatically punishable as aiding or abetting cyber libel under Disini. Liability may differ if you add your own defamatory assertion or create a new publication.

Does deleting the post prevent a case?

No. Deletion does not erase a publication already seen by another person. It may also make proof harder for either side, so preserve the complete material before altering anything.

Does an apology end the case?

Not automatically. An apology, correction, or settlement may help resolve the dispute or affect damages, but prosecution and dismissal remain subject to law and prosecutorial or court action.

Is a demand letter required before filing?

No general rule makes a demand letter a required element of cyber libel. It may be useful in some cases, but it does not replace a timely complaint.

Where should the complaint be filed?

Ordinarily, it is filed with the prosecution office supported by the legally relevant venue facts. Cybercrime venue may be tied to where an element occurred, where part of the computer system was located, or where legally cognizable damage occurred. A lawyer should assess venue before filing.

How long does the respondent have to answer?

Under the current regular preliminary-investigation rules, the subpoena must generally allow at least 10 days from receipt of the subpoena and complaint before the scheduled submission of the counter-affidavit. Follow the actual lawful directive immediately and request relief before the deadline if records are incomplete or circumstances justify it.

How long does the complainant have to file?

Cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents, subject to the rules on interruption of prescription. Do not calculate the deadline solely from the upload date or wait until the last day.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber libel disputes are highly dependent on the exact words, evidence, dates, parties, and procedural record. Official sources and current rules were checked as of September 14, 2026.