Quick answer

Cyber libel is committed when the original author publicly makes a defamatory imputation through a computer system—such as a social-media post, website article, email, video caption, or online message—and the prosecution can establish the person defamed, publication to a third person, malice, and the author’s identity.

A complainant should preserve the post and proof of authorship, determine the correct venue, and file a sworn complaint with the proper prosecutor’s office without delay. The Supreme Court has definitively ruled that cyber libel prescribes in one year from actual discovery by the offended party, authorities, or their agents. Filing the complaint interrupts prescription. A respondent who receives a subpoena should obtain the complete complaint, preserve contrary evidence, and file a detailed counter-affidavit by the deadline stated in the subpoena—generally with at least 10 days’ notice under the current DOJ rules.

Not every harsh, embarrassing, or false-looking online statement is cyber libel. The statement must satisfy every legal element. Fair comment on a matter of public interest, certain privileged communications, lack of publication, failure to identify the complainant, lack of proof of authorship, prescription, and constitutionally protected criticism may defeat a charge depending on the evidence.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on written libel to defamatory material published through a computer system or a similar future technology.

The prosecution must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the author and the person defamed received, read, viewed, or heard the imputation. A private message sent only to the person being insulted ordinarily lacks this element. A group chat, public post, copied email, or message sent to another person may satisfy it.
Identification. The complainant need not always be named, but readers must reasonably understand who is being referred to. Nicknames, photographs, job descriptions, family relationships, surrounding posts, or other context may establish identity.
Malice. As a general rule, a defamatory imputation is presumed malicious if no good intention or justifiable motive is shown. That presumption may disappear when the communication is privileged or involves protected commentary, in which case actual malice may have to be proved.
Use of a computer system or information and communications technology.
Identity of the original author. The prosecution must connect the accused—not merely a profile name or photograph—to the account and the specific post or message.

Courts assess the complete statement in its context and according to how an ordinary reader would naturally understand it. Selective screenshots, isolated words, satire, rhetorical exaggeration, and statements of opinion require careful contextual analysis. Calling something an “opinion” does not automatically protect it if it implies a false, provable fact.

Original authors, sharers, commenters, and page users

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author, but invalidated its application to people who merely receive a post and react to it. The Court also struck down the provisions on aiding, abetting, or attempting cyber libel.

Accordingly, merely pressing “Like,” reacting, or sharing an existing post without creating a new defamatory imputation is not automatically cyber libel. But a person who adds an independently defamatory caption, comment, edited image, video, or accusation may become the original author of that new material. Liability depends on what the person actually authored, not simply which platform button was used.

The same defamatory material should not be prosecuted once as ordinary print libel and again as cyber libel merely because identical content appeared in both formats; the Supreme Court has treated that as the same libel offense for double-jeopardy purposes.

Statements about public officials and matters of public interest

Public criticism is not automatically libel. Courts apply stronger constitutional protection when speech concerns public officials, public figures, official conduct, public funds, or another genuine matter of public interest.

Qualifiedly privileged communications include:

A private communication made in performing a legal, moral, or social duty;
A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or official proceeding;
Fair commentary on a matter of public interest; and
Fair reporting on a matter of public interest.

Privilege is not an absolute license to fabricate accusations. It generally prevents malice from being presumed, requiring the complainant to prove actual malice—knowledge of falsity or reckless disregard of whether the statement was true or false. Mere error, inaccuracy, or falsity does not by itself always establish actual malice. The Supreme Court explains these distinctions in Philippine Daily Inquirer, Inc. v. Enrile.

Truth can be a defense, but “it was true” should not be treated as a complete answer without legal analysis. Articles 354 and 361 of the Revised Penal Code also examine good intention, justifiable motive, the kind of imputation, and whether allegations against a public officer relate to official duties. Preserve the documents and witnesses showing both the factual basis and the legitimate reason for publication.

The one-year deadline

The current controlling rule is unusually important: cyber libel prescribes in one year from discovery of the alleged defamatory material by the offended party, the authorities, or their agents.

In its April 8, 2026 final resolution in Causing v. People, the Supreme Court En Banc rejected both a 12-year and a 15-year period and reaffirmed that:

The applicable period is one year;
It begins on actual discovery, not automatically on the date the material was posted;
A public social-media post does not create a legal presumption that the offended party immediately saw it; and
Filing the complaint or information interrupts prescription.

The discovery date is a factual issue. Relevant evidence may include the message that first alerted the complainant, a dated screenshot, the complainant’s first reaction or comment, a demand letter, a threat to sue, or testimony from the person who showed the post. An accused asserting prescription should present evidence of an earlier discovery date; relying only on the posting date may be insufficient.

Do not wait until the final weeks of the period. Venue errors, incomplete affidavits, holidays, rejected filings, or filing with an office that lacks authority can create serious prescription problems. A takedown request, private demand, barangay complaint, platform report, or settlement discussion should not be assumed to interrupt the criminal prescriptive period.

A separate civil action for defamation also generally has a one-year period under Article 1147 of the Civil Code. Its accrual, interaction with a criminal case, and reservation of civil remedies require separate analysis.

How to preserve online evidence

Preserve the evidence before asking for deletion or confronting the account owner.

Save, without cropping or altering:

Full-page screenshots showing the content, account name, profile photograph, date, time, reactions, comments, and surrounding context;
The exact post, profile, page, video, or channel URL;
Screen recordings showing how the post is reached from the account or page;
The original image, audio, video, email, or message file;
Platform notification emails and messages containing links or timestamps;
The account’s username, numerical user ID if visible, profile history, linked pages, and contact details;
Comments or messages indicating that other people saw and understood the post;
The message or event showing when the complainant first discovered it;
Lawfully obtained admissions that the respondent owns the account or wrote the material;
Documents supporting truth, good faith, privilege, or actual malice;
Employment, business, medical, or financial records relevant to claimed damage; and
The original phone or computer on which the evidence was received.

Keep an untouched master copy and record who collected each item, when it was collected, and from which device. Do not add annotations to the only copy. If an annotation is useful, place it on a duplicate.

Electronic evidence must still be authenticated. A readable printout can qualify as an electronic original if shown to reflect the data accurately, but the party offering it must establish integrity, reliability, and connection to the alleged author under the Rules on Electronic Evidence.

The Supreme Court’s current guideposts for linking a person to a social-media account include:

Admission of ownership, access, or authorship;
A witness seeing the person access the account or compose the post;
Information in the communication known only to that person or a small group;
Distinctive language or writing style;
Provider records, geolocation information, device history, or forensic results;
Conduct consistent with earlier or contemporaneous posts; and
Other circumstantial evidence showing control or authorship.

A name and photograph alone may not conclusively prove authorship because dummy and impersonation accounts can be created. The guideposts appear in XXX v. People, G.R. No. 274842.

How to file a criminal complaint

1. Check the elements, discovery date, and venue

Prepare a timeline covering:

When the content was posted;
When and how the complainant discovered it;
Who else received it;
Why readers understood it to refer to the complainant;
What connects the respondent to the account and post; and
Where the relevant devices, acts, and damage were located.

Cyber libel cases fall within the jurisdiction of a designated cybercrime Regional Trial Court. Under the Rule on Cybercrime Warrants, venue may lie in the city or province where:

The offense or any element was committed;
Any part of the computer system used was situated; or
Damage to a natural or juridical person occurred.

The first properly seized court acquires jurisdiction to the exclusion of other courts. Internet accessibility in a location, by itself, should not be treated casually as sufficient venue. Venue allegations must be supported by facts. Tieng v. Palacio-Alaras discusses the application of the cybercrime venue rule.

2. Prepare a sworn complaint-affidavit

The affidavit should clearly state:

The complainant’s and respondent’s identifying information and addresses, if known;
The exact statement complained of, preferably quoted and translated when necessary;
The complete context in which it appeared;
The URL, account, page, platform, and date of publication;
The date and circumstances of discovery;
Facts showing publication to at least one third person;
Facts showing identification of the complainant;
Facts linking the respondent to authorship or account control;
Facts supporting malice and answering any apparent claim of privilege;
The venue facts; and
A numbered description of every attachment.

Attach witness affidavits and evidence that can be authenticated and preserved for trial. Do not exaggerate, omit material context, or label every unfavorable statement as defamatory.

The current DOJ standard is prima facie evidence with reasonable certainty of conviction. The evidence should be admissible, credible, capable of preservation, and sufficient—if uncontroverted—to prove every element and the offender’s identity. These rules appear in DOJ Department Circular No. 015, series of 2024, which the Supreme Court upheld in 2025.

3. File with the proper prosecution office

A complaint is ordinarily filed with the City or Provincial Prosecutor’s Office having authority over the chosen, legally supportable venue. The office may require the NPS Investigation Data Form, original sworn affidavits, identification, and sufficient copies for the respondents and office records. Check the receiving office’s current requirements before filing; do not assume that an ordinary email completes a valid filing.

The DOJ publishes a general filing checklist for preliminary investigations.

A complainant may first seek investigative and forensic assistance from the NBI Cybercrime Division or another authorized cybercrime unit, especially when the account is anonymous, technical attribution is disputed, or provider data may disappear. This is useful but not invariably required before filing with the prosecutor. The NBI describes its process for investigative assistance to computer-crime victims.

4. Request timely preservation through law enforcement

Under Section 13 of Republic Act No. 10175, law-enforcement authorities may order service providers to preserve specified traffic data, subscriber information, and content data for six months. The period may be extended once for another six months. Disclosure and search generally require the appropriate judicial warrant.

A private complainant should not attempt to obtain restricted account data through hacking, deception, or unauthorized access. Ask the investigating agency or prosecutor whether lawful preservation or a cybercrime warrant is warranted. Preservation does not guarantee that deleted or old records still exist, so early action matters.

5. Participate in the preliminary investigation

For cyber libel, the regular DOJ-NPS preliminary-investigation procedure generally applies because the prescribed imprisonment can exceed six years.

If the complaint is not dismissed outright, the prosecutor issues a subpoena with the complaint and supporting evidence. The preliminary-investigation setting should give the respondent at least 10 days from receipt to prepare and submit a counter-affidavit. The exact date on the subpoena controls.

The prosecutor may:

Require additional evidence;
Issue subpoenas for relevant records or testimony;
Conduct a clarificatory hearing;
Permit limited reply and rejoinder affidavits when necessary; or
Use authorized electronic filing or virtual procedures where available.

This stage is generally affidavit-based; it is not yet a full trial with ordinary cross-examination.

6. Await the prosecutor’s resolution

The prosecutor may dismiss the complaint or recommend filing an Information in court. An aggrieved party in a regular preliminary investigation generally has 15 calendar days from receipt to move for reconsideration under the current DOJ-NPS rules. Appeals or petitions for review involve additional technical requirements and should be assessed immediately. Do not assume that filing a review automatically stops court proceedings.

If an Information is filed, the RTC judge independently evaluates judicial probable cause. The judge may dismiss the case, require further evidence, or issue a warrant of arrest. A prosecutor’s finding does not itself establish guilt; conviction still requires proof beyond reasonable doubt.

How to defend against a cyber libel complaint

Act immediately on a subpoena

A prosecutor’s subpoena is not an arrest warrant, but ignoring it can cause the complaint to be resolved without your evidence. Record the date and manner of receipt, obtain all attachments, and calendar the stated hearing and filing deadline.

Extensions are not automatic under the current DOJ rules. If genuinely necessary to secure counsel, examine evidence, or verify authenticity, request an extension before the deadline and explain the specific reason.

Preserve your own evidence

Keep:

The original post, drafts, source documents, messages, and complete thread;
Account-access logs, security alerts, and evidence of hacking or impersonation;
Devices and platform data exports;
Research notes and records showing verification before publication;
Official records supporting a fair-report or public-interest defense;
Messages showing the intended audience and purpose;
Evidence concerning the complainant’s actual discovery date;
Witnesses who can testify about authorship, context, or account access; and
Prior versions showing that a screenshot was edited, cropped, or taken out of context.

Do not delete the account, factory-reset a device, coach witnesses, fabricate screenshots, or pressure the complainant. Deletion may destroy helpful defense evidence without eliminating copies held by others.

Answer every element in the counter-affidavit

A useful counter-affidavit addresses, with supporting documents:

Authorship: Did the respondent actually control the account and write the material?
Defamatory meaning: Does the complete statement genuinely impute a discreditable fact, or is it non-defamatory criticism, opinion, satire, or rhetorical exaggeration?
Publication: Was it communicated to anyone other than the complainant?
Identification: Would an ordinary reader know the statement referred to the complainant?
Malice: Was it made with knowledge of falsity, reckless disregard, spite, or an unjustifiable purpose?
Privilege: Was it a good-faith private communication in fulfillment of a duty, a fair report, or fair commentary on a public matter?
Truth and basis: What admissible records or witnesses support the statement and the reason for making it?
Prescription: What proves the complainant or an agent discovered the material more than one year before filing?
Venue: What facts, if any, connect the offense, computer system, or damage to the selected city or province?
Date of conduct: Online material posted before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. The Supreme Court applied this rule in Peñalosa v. Ocampo.
Prior prosecution: Is the charge duplicating an ordinary-libel case involving the identical publication?

Bare denials are usually weaker than specific facts supported by records and witnesses.

If the case reaches court

Before entering a plea, counsel should examine whether a motion to quash is proper—for example, because the Information does not charge an offense, the court lacks jurisdiction, the offense has prescribed, or double jeopardy applies. Some prescription issues require evidence and a hearing because the discovery date may not appear in the Information.

Do not assume arraignment is harmless or that a pending DOJ review automatically suspends it. Once a warrant is issued, arrange lawful surrender and bail through counsel rather than waiting for an unexpected arrest. Bail is generally available as a matter of right before conviction in this type of case, but the court sets the conditions and amount.

Possible penalties and civil liability

Ordinary written libel under Article 355, as amended by Republic Act No. 10951, carries imprisonment, a fine, or both. Because Section 6 of Republic Act No. 10175 raises the penalty by one degree when information and communications technology is used, cyber libel may expose a convicted person to imprisonment from four years, two months and one day to eight years, subject to the rules on the proper indeterminate sentence and circumstances of the case.

For a fine, the Supreme Court calculated the cyber-libel range as ₱40,000 to ₱1,500,000. A court may, in its sound discretion and after considering the particular facts, impose a fine alone instead of imprisonment. Fine-only treatment is not guaranteed, and imprisonment remains legally available. See People v. Soliman.

Civil liability may include proven actual damages and, when legally justified, moral, nominal, temperate, or exemplary damages. The civil action arising from the offense is generally deemed included in the criminal case unless waived, reserved for separate filing, or previously filed. Actual financial loss must be supported by competent evidence; it should not be assumed from the existence of an offensive post alone.

Retractions, apologies, and settlement

A prompt correction, retraction, apology, or takedown may reduce harm and may be relevant to intent, damages, or settlement. It does not automatically erase a completed offense, stop prescription, or require the prosecutor or court to dismiss the case.

An affidavit of desistance is also not controlling. Cyber libel is prosecuted in the name of the People of the Philippines, so the complainant cannot unilaterally terminate the criminal action after filing. A settlement may resolve civil claims or influence prosecutorial assessment, but dismissal remains subject to the prosecutor’s or court’s lawful determination.

Before sending a demand or response, preserve the evidence and consider whether the wording could be treated as an admission, threat, or further defamatory publication.

Common mistakes

Waiting because the post remains online and assuming the one-year period has not started;
Using the posting date without investigating the actual discovery date;
Filing in a convenient location without facts establishing venue;
Submitting cropped screenshots without URLs, context, or authentication;
Assuming a profile name and photograph conclusively prove authorship;
Naming every liker or sharer despite the original-author rule;
Treating truth as an automatic defense without addressing motive, privilege, and admissible proof;
Assuming criticism of a public official is always libel—or always protected;
Reporting the post to the platform before preserving it;
Contacting an anonymous account through hacking, doxxing, or unlawful surveillance;
Posting retaliatory accusations while the complaint is pending;
Ignoring a subpoena or relying on an informal promise of settlement;
Assuming an apology or affidavit of desistance automatically ends the case; and
Filing both ordinary and cyber libel charges for the identical publication without considering double jeopardy.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year anniversary of discovery is approaching;
A prosecutor’s subpoena or court notice has been received;
The respondent is anonymous or provider records may be needed;
A warrant of arrest has been issued or threatened;
The material concerns a journalist, public official, election, public funds, or whistleblowing;
There are parallel threats, stalking, extortion, intimate images, gender-based harassment, or violence;
The post was published from outside the Philippines;
Several people operated the account or corporate page;
A child is involved; or
A settlement, retraction, or affidavit of desistance is being proposed.

Qualified indigent persons may request assistance from the Public Attorney’s Office, including representation of an accused during preliminary investigation and trial, subject to its rules and conflict checks. The Integrated Bar of the Philippines also maintains legal-aid contacts and local chapters.

Threats of immediate violence, stalking, extortion, or exposure of intimate material should be reported promptly to law enforcement; do not wait for the cyber-libel analysis to be completed.

Frequently asked questions

Is every false Facebook post cyber libel?

No. Falsity alone is insufficient. The prosecution must establish a defamatory imputation, publication, identification, malice, use of a computer system, and the accused’s authorship beyond reasonable doubt at trial.

Does a private message count?

It may. A message sent only to the person being insulted ordinarily lacks publication. If it is sent to a group, copied to another person, or intentionally communicated to a third party, publication may exist.

Can I file directly with the prosecutor?

Generally, yes. A prior barangay or police complaint is not normally required for an offense carrying cyber libel’s penalty. Investigative assistance may nevertheless be essential for anonymous accounts, forensics, or provider preservation.

When does the one-year period begin?

From actual discovery by the offended party, authorities, or their agents—not automatically from posting. The filing of the proper complaint interrupts the period. The discovery date must be proved from the facts.

Can an anonymous or dummy account be prosecuted?

Yes, if admissible direct or circumstantial evidence identifies its controller or author. A display name and photograph may not be enough by themselves. Provider records, forensic evidence, admissions, distinctive information, witnesses, and account history may establish attribution.

Is sharing someone else’s post cyber libel?

A mere reaction or share is not automatically cyber libel under Disini. A person who adds a new defamatory caption or independently authors another accusation may be liable for that new content.

Will deleting the post prevent a case?

No. Deletion does not erase screenshots, platform records, witness testimony, or an offense already completed. Preserve the evidence first. A voluntary takedown may still reduce continuing harm.

Can the court impose only a fine?

Yes, in an appropriate case, but it is discretionary. Imprisonment remains an available penalty, and civil damages may also be awarded.

Can the complainant withdraw the case?

The complainant may execute an affidavit of desistance or settle civil claims, but neither automatically dismisses the public criminal action. The prosecutor or court must still act according to law and the evidence.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Cyber-libel outcomes depend heavily on the exact words, complete context, authorship evidence, discovery date, venue, and procedural record. Sources and current rules were checked as of July 25, 2026.