Quick answer

To file a cyber libel complaint, preserve the post and its digital context, identify evidence linking it to the author, record when you discovered it, and file a sworn complaint with the proper City or Provincial Prosecutor’s Office. If the account is anonymous or technical records are needed, seek prompt assistance from the NBI Cybercrime Division or another authorized cybercrime investigator.

To defend against a complaint, do not ignore a subpoena, NBI invitation, warrant, or court notice. Obtain the complete complaint and attachments, calendar the deadline, and submit a sworn counter-affidavit addressing every element—defamatory meaning, publication, identification, authorship, malice, use of a computer system, venue, and prescription.

Time is critical. The Supreme Court has definitively ruled that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Filing the proper complaint interrupts prescription. A platform report, demand letter, barangay complaint, or informal police inquiry should not be assumed to stop the period. The discovery date and any interruption are fact-dependent and should be documented carefully. See Causing v. People, G.R. No. 258524, April 8, 2026.

What Philippine law considers cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the unlawful publication is made through a computer system or a similar future technology. A smartphone, social-media platform, website, blog, email system, or internet-connected computer may supply the cyber element.

At trial, the prosecution must prove beyond reasonable doubt:

A defamatory allegation concerning another person or organization;
Publication or communication of that allegation to at least one third person;
Identification of the person or entity defamed;
Malice; and
Use of a computer system or information and communications technology.

A statement may be defamatory when, read in its full context and ordinary meaning, it imputes a crime, vice, defect, or circumstance tending to cause dishonor, discredit, or contempt. An insult is not automatically criminal; the complete wording, audience, context, and predictable effect on third persons matter.

The complainant need not always be named. Identification may be established if readers familiar with the circumstances could recognize the person from a position, location, relationship, photograph, nickname, or other details. But a vague statement about an unidentifiable person will not satisfy this element.

Publication requires a third person. A message sent only to the person allegedly defamed ordinarily lacks publication, while a group chat, public post, email copied to others, or message sent to another person may satisfy it.

Not every false, offensive, or critical online statement is cyber libel

The prosecution must prove the accused was the author

A profile name or photograph alone does not conclusively establish authorship. Fake accounts, shared devices, compromised credentials, page administrators, and multiple account users must be considered.

The Supreme Court permits direct or circumstantial proof of account control or authorship, including:

An admission of ownership, access, or authorship;
A witness who saw the person use the account or compose the post;
Information in the post known only to the alleged author or a limited group;
Distinctive language, writing habits, or other identifying characteristics;
Platform, internet-service-provider, telecommunications, geolocation, device, or forensic records;
Conduct consistent with the post or contemporaneous messages; and
Other evidence connecting the person, account, device, and publication.

Technical records are useful but are not indispensable in every case. The complete guideposts appear in XXX v. People, G.R. No. 274842, October 22, 2025.

Likes, shares, and reactions are treated differently from new defamatory posts

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but declared it unconstitutional as applied to people who merely receive and react to a post. It also invalidated aiding or abetting liability in relation to cyber libel.

A mere like, reaction, or routine share therefore should not be treated as authorship of the original statement. But a person who adds a new, independently defamatory accusation may become the original author of that new content.

The same material should not result in separate traditional-libel and cyber-libel prosecutions merely because it appeared both in print and online; the Court held that dual prosecution for the identical libel would violate double jeopardy.

Truth is not always enough by itself

For a private complainant, Article 361 of the Revised Penal Code generally requires not only truth but also good motives and justifiable ends. A person should not assume that possessing one document, repeating a rumor, or sincerely believing a claim automatically defeats liability.

Different constitutional standards apply when the complainant is a public official or public figure and the statement concerns public conduct or a matter of public interest. The prosecution must prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false. Criticism may be sharp or unpleasant without becoming criminal, but public status is not a license to invent accusations or attack unrelated private matters.

In July 2026, the Supreme Court acquitted an accused because actual malice concerning statements about a mayor’s official conduct was not proven beyond reasonable doubt. It also reiterated that insulting words are not actionable automatically and must be assessed in context. See Tan v. People, G.R. No. 265929.

Privileged communications may defeat the presumption of malice

Potentially protected communications include:

A private, good-faith communication made in the performance of a legal, moral, or social duty to a person with a corresponding duty or interest;
A fair and true good-faith report, without added defamatory commentary, of a non-confidential official proceeding or official act; and
Fair comment on a matter of public interest when the opinion is based on established facts.

These are usually qualified privileges. They may be lost through actual malice, unnecessary circulation, irrelevant personal attacks, fabrication, or reckless publication. A complaint sent privately and in good faith to the proper regulator is materially different from posting the accusation publicly to shame the subject.

The one-year deadline

Cyber libel prescribes one year from the date the alleged offense is discovered by the offended party, the authorities, or their agents—not automatically from the date of posting.

The posting date and discovery date may coincide, particularly when the complainant saw the post immediately. If discovery allegedly occurred later, that date becomes a factual issue. Preserve:

The message or notification through which the post was first reported;
The date and time it was opened;
The identity and affidavit of the person who discovered it;
Platform emails, reports, or download records;
Police, NBI, or prosecutor receiving stamps; and
Any earlier evidence suggesting that the complainant or authorities already knew about it.

Prescription is a defense. If it is not clear from the Information, the accused may have to present evidence establishing the discovery date and the absence of a timely interrupting complaint. The defense is not necessarily waived by arraignment, but it should be raised promptly.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. Its computation, interruption, venue, and relationship to a criminal case should be reviewed separately.

How to file a cyber libel complaint

1. Preserve the evidence before requesting deletion

Capture the post while it is still accessible. Keep:

Full-page screenshots showing the entire statement, account name, date, time, reactions, comments, and surrounding context;
The exact post, profile, page, group, and media URLs;
A screen recording showing navigation from the profile or page to the post;
Original downloaded images, videos, emails, chat exports, and attachments;
The device used to view or receive the content;
Names and contact details of people who independently saw it;
Platform notifications and complaint acknowledgments; and
Backup copies stored without editing, cropping, annotation, or compression.

Record who captured each item, when, on what device, and how. Screenshots are useful, but their integrity, accuracy, source, and connection to the alleged author may still need authentication under the Rules on Electronic Evidence.

Do not hack an account, guess passwords, impersonate another person, install spyware, or secretly intercept private communications to obtain evidence.

2. Identify the exact defamatory statement and each required element

Quote the challenged words exactly rather than merely saying that the respondent “destroyed my reputation.” Explain:

What the words mean in context;
Why they concern the complainant;
Who read or received them;
Why the accusation is false or unsupported;
What proves authorship or account control;
When and where the publication and discovery occurred; and
What harm followed.

Attach records disproving the accusation where available—for example, official certifications, employment or business records, court dispositions, audit records, or statements from witnesses with personal knowledge.

3. Obtain investigative assistance when needed

A complainant may proceed directly to the proper prosecutor if the evidence and respondent’s identity are sufficiently established. NBI assistance is especially useful when the account is anonymous, account attribution is disputed, a device examination is needed, or service-provider records must be lawfully obtained.

The NBI’s published procedure includes an intake interview, complaint form, sworn statements, supporting documents, and possible examination of a relevant device. See the NBI procedure for victims of computer crimes and its online complaint portal.

Under Section 13 of RA 10175, service providers must preserve specified subscriber information and traffic data for a minimum period, and law-enforcement authorities may issue statutory preservation orders. Because data may not remain available indefinitely, ask counsel or investigators about preservation immediately. A personal request to a platform is not a substitute for the legal process required to obtain protected records.

4. File in the correct place

Cyber libel falls within Regional Trial Court jurisdiction. Under the Rule on Cybercrime Warrants, the criminal action is filed before a designated cybercrime court in the province or city where:

The offense or any element was committed;
Any part of the computer system used is situated; or
Damage to the natural or juridical person occurred.

Venue in criminal cases is jurisdictional. Mere ability to access a post in a locality does not by itself make every court in the Philippines a proper venue. The complaint and eventual Information need specific venue facts. The interaction between cybercrime venue rules and Article 360’s special rules for written defamation can be technical; Tieng v. People explains the governing principles.

File the complaint-affidavit with the City or Provincial Prosecutor’s Office serving the legally proper venue. Do not choose a distant office merely for convenience or pressure.

5. Prepare the complaint package

The DOJ’s published checklist ordinarily calls for:

Two copies of the sworn NPS Investigation Data Form;
A sworn complaint-affidavit;
Sworn affidavits of witnesses;
Supporting documentary and electronic evidence; and
Copies for the prosecution office and every respondent.

The central DOJ checklist currently states five copies plus the number of respondents for complaint-affidavits, witness affidavits, and supporting documents. Confirm the exact copy, media, fee, and electronic-filing requirements with the receiving office before filing. See the DOJ filing checklist.

The affidavit should be chronological, factual, based on personal knowledge, and properly sworn before an authorized officer. Mark and describe every annex clearly.

6. Participate in preliminary investigation

Because cyber libel carries a possible maximum imprisonment exceeding six years, it is covered by regular preliminary investigation under the 2024 DOJ–National Prosecution Service Rules.

The prosecutor assesses whether the evidence establishes a prima facie case with reasonable certainty of conviction—meaning evidence that appears admissible, credible, preservable, and sufficient to establish every element and the responsible person if left uncontradicted. The Supreme Court upheld these rules in Meking v. Remulla, G.R. No. 280455, November 11, 2025.

If the complaint is sufficient, the prosecutor issues a subpoena requiring the respondent’s counter-affidavit. A clarificatory hearing, reply-affidavit, or rejoinder may be required when the investigating prosecutor considers it necessary.

An aggrieved party may generally move for reconsideration of the prosecutor’s resolution within 15 days from receipt under DOJ Department Circular No. 015, series of 2024. A petition for review may also be available under the applicable DOJ rules. These remedies do not permit a party to disregard court proceedings if an Information has already been filed.

How to defend a cyber libel complaint

Act immediately upon receiving a subpoena

The subpoena should give the respondent at least 10 days from receipt to prepare and submit a counter-affidavit. Follow the exact hearing and filing date stated in the subpoena.

An extension is not automatic. Under the current DOJ rules, an extension may be allowed when the interests of justice require time to obtain counsel, examine voluminous material, verify authenticity, or address complicated issues, but a granted extension for a responsive submission may not exceed 10 days.

Request and review the complete complaint, witness affidavits, and annexes. Do not answer only the accusations summarized in the subpoena.

Submit evidence with the counter-affidavit

A preliminary investigation is principally conducted through sworn written submissions. Do not reserve an obvious defense or supporting record for trial without legal advice.

Depending on the facts, preserve and attach:

The original post, including text omitted from the complainant’s screenshot;
Drafts, source documents, research notes, and official records relied upon;
Account and device security records;
Evidence of hacking, impersonation, shared access, or loss of a device;
Witness affidavits concerning authorship or context;
Proof of the complainant’s earlier discovery;
Evidence supporting truth, good motive, public interest, or privilege;
Proof that no third person received the message;
Evidence that readers could not identify the complainant; and
Evidence showing proper or improper venue.

Do not delete accounts, wipe devices, fabricate explanations, coach witnesses, or pressure the complainant. Such conduct may destroy favorable evidence and create separate legal problems.

Test every element

A focused defense asks:

Defamatory meaning: Do the words, read as a whole, actually impute a discreditable fact, or are they rhetorical criticism, satire, hyperbole, or a non-defamatory opinion?
Publication: Did anyone other than the complainant receive or read the statement?
Identification: Could a third person reasonably identify the complainant?
Authorship: What evidence connects the accused—not merely an account name—to the post?
Authenticity: Do the screenshots accurately and completely represent the content? Were objections to admissibility raised on time?
Malice: Was the communication privileged or made with good motives? If it concerned a public official or public figure, can the prosecution prove actual malice?
Cyber element: Was the charged publication actually made through a computer system?
Venue: Do the complaint and evidence establish a legally proper locality?
Prescription: When did the complainant or authorities first discover the post, and when was the proper complaint filed?
Retroactivity: Was the publication made before RA 10175 took effect? Cyber libel cannot be applied retroactively to an earlier online publication.

A bare denial is usually weaker than a denial supported by device records, witnesses, account-recovery notices, employment logs, travel records, or other objective evidence.

If an Information has already been filed

Once a prosecutor files an Information, the judge independently determines whether a warrant should issue. Obtain counsel immediately to assess voluntary surrender, bail, arraignment, a motion to quash, preservation issues, and available pretrial remedies.

Do not assume that a pending motion for reconsideration at the DOJ automatically suspends the court case. A separate motion to suspend proceedings may be necessary.

Possible penalties and civil liability

Article 355, as amended by RA 10951, permits imprisonment, a fine, or both for traditional libel. Section 6 of RA 10175 raises the penalty by one degree when committed through information and communications technology.

For cyber libel, the statutory imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years.

A court may impose a fine instead of imprisonment. The Supreme Court has fixed the cyber-libel fine range at ₱40,000 to ₱1,500,000 under the amended law and Article 75 of the Revised Penal Code. Fine-only treatment is a judicial option, not an automatic entitlement. See People v. Soliman, G.R. No. 256700.

The offended party may also seek civil damages. The amount is not automatic and depends on the pleaded injury and supporting evidence. Lost income, medical or psychological expenses, business effects, platform reach, corrective costs, and other claimed losses should be documented rather than merely estimated.

An apology, correction, deletion, compromise, or affidavit of desistance does not automatically extinguish criminal liability after publication. It may affect civil claims, damages, penalty, motive, or the parties’ practical resolution, depending on timing and circumstances.

Evidence worth preserving

Whether filing or defending, keep:

Unedited screenshots and screen recordings;
Exact URLs, usernames, account identifiers, and timestamps;
Original digital files and exports;
The viewing or posting device;
Platform notifications, security alerts, and recovery emails;
The full conversation or thread—not isolated excerpts;
A written record of discovery and capture;
Witness names and sworn statements;
Documents supporting or disproving the accusation;
Evidence of authorship, account access, or impersonation;
NBI, police, prosecutor, and platform reference numbers;
Receiving stamps, email acknowledgments, subpoenas, and envelopes showing receipt dates; and
Proof of reputational, financial, medical, or professional impact.

Keep an untouched master copy. Work from duplicates when preparing exhibits.

Common mistakes

Waiting because the post remains online, despite the one-year prescriptive period;
Assuming a demand letter or platform report stops prescription;
Submitting cropped screenshots that omit dates, URLs, or context;
Naming the account holder without proof that they authored the post;
Treating every insult, criticism, opinion, or false statement as automatically libelous;
Assuming truth alone is always a complete defense;
Assuming criticism of a public official is automatically protected;
Filing wherever the post was accessible instead of establishing proper venue;
Ignoring the subpoena while planning to explain everything at trial;
Filing an unsworn narrative rather than an element-by-element affidavit;
Deleting posts, accounts, messages, or devices before preserving them;
Secretly accessing another person’s account to obtain evidence;
Believing an apology or affidavit of desistance automatically ends the criminal case; and
Suing people merely for liking, receiving, or routinely sharing the original post without assessing the rule in Disini.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year anniversary of discovery is approaching;
You received a prosecutor’s subpoena, NBI summons, warrant, or court notice;
The respondent or account holder is unknown;
Service-provider or platform records may soon disappear;
A device may be searched or forensically examined;
The post concerns a public official, public figure, journalist, election, or public controversy;
Several people administer the account or page;
The same statement appeared in print, broadcast, and online;
The case involves a child, intimate images, threats, stalking, identity theft, hacking, or exposure of private information;
The complainant or respondent is abroad; or
A civil action, protection order, privacy complaint, or another criminal charge may be more appropriate than—or necessary in addition to—cyber libel.

Qualified indigent respondents may inquire with the Public Attorney’s Office. Complainants may ask the prosecutor’s office, NBI, or local legal-aid providers about available assistance.

Frequently asked questions

Can I file because someone called me a scammer online?

Possibly, but the complete statement, context, audience, identification, authorship, malice, and supporting facts must be examined. If the word was a factual accusation of criminal fraud, the risk is greater than if it was obvious rhetoric or an opinion based on disclosed facts.

Is a one-to-one private message cyber libel?

Ordinarily not if only the person allegedly defamed received it, because publication to a third person is missing. A copied email, group chat, or message sent to someone else may be different.

Is a screenshot enough?

It may help prove what appeared online, but it does not necessarily prove completeness, authenticity, account ownership, or authorship. Preserve the URL, context, original file, capture method, device, and corroborating witnesses or records.

Can the complainant file more than one year after posting?

Possibly, if discovery occurred later and the complaint was filed within one year of that discovery. The claimed discovery date must be supported and may be disputed. If publication and discovery occurred on the same day, the period normally runs from that discovery.

Does deleting the post prevent a case?

No. The offense may already have been completed upon publication. Deletion can limit continuing harm, but preserved copies, witnesses, admissions, and technical records may remain.

Can I be charged merely for sharing someone else’s post?

Under Disini, cyber libel is constitutional as to the original author, not people who merely receive and react to the post. A new caption or comment containing an independently defamatory accusation may create separate exposure.

Will an apology or settlement dismiss the case?

Not automatically. Cyber libel is prosecuted by the State. A settlement may resolve the civil aspect and may influence practical decisions, damages, or penalty, but the prosecutor or court controls the criminal proceeding.

Can cyber libel result only in a fine?

A fine may be imposed instead of imprisonment, but the court decides based on the law and circumstances. Imprisonment remains legally possible.

Official sources

This article provides general legal information, not legal advice or an attorney-client relationship. Cyber libel outcomes depend on the exact words, audience, documents, authorship evidence, discovery date, venue, and procedural history. Sources and current rules were checked as of August 3, 2026.