Quick answer

A cyber libel case may arise when a person authors and publishes through a computer system a defamatory statement that identifies another person, reaches at least one third party, and is made with the legally required malice. It is governed principally by Articles 353 to 361 of the Revised Penal Code and Sections 4(c)(4) and 6 of the Cybercrime Prevention Act of 2012.

If you intend to complain, preserve the post and proof of authorship immediately, record when you first discovered it, and file a properly supported complaint-affidavit with the appropriate prosecution office. Do not wait for the content to disappear: under the Supreme Court’s current ruling, criminal cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to interruption by the filing of the complaint or information.

If you receive a prosecutor’s subpoena, do not ignore it. The subpoena should include the complaint and supporting evidence and give you at least 10 days from receipt before the scheduled submission of your counter-affidavit. A missed deadline can cause the prosecutor to decide the case using the complainant’s evidence alone.

Cyber libel carries a possible imprisonment of four years, two months and one day to eight years, or a fine of ₱40,000 to ₱1,500,000, or both. A court may impose a fine alone in appropriate circumstances, but this is discretionary—not guaranteed. The Supreme Court confirmed the present fine range and the possible use of a fine instead of imprisonment in Ang v. Court of Appeals.

What the prosecution must establish

The prosecution ultimately must prove every element beyond reasonable doubt:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to cause dishonor, discredit, or contempt. Courts read the words as a whole, in context, and according to their ordinary meaning.
Publication. The statement was communicated to at least one person other than the person allegedly defamed. A message sent only to the subject ordinarily lacks this element; a group chat, public post, email copied to others, or content shown to another person may satisfy it.
Identifiability. The offended person was named or was reasonably recognizable to third persons from descriptions, surrounding facts, photographs, tags, or other circumstances. Naming the person is not indispensable, but suspicion based only on the complainant’s personal belief is insufficient. The Supreme Court applied this requirement strictly in Lastimosa v. People.
Malice. Article 354 generally presumes malice from a defamatory imputation unless a recognized privilege applies. Different rules apply to qualifiedly privileged communications, matters of public interest, and statements concerning the official conduct of public officers or public figures.
Use of a computer system or similar technology. This may include a social-media post, online article, email, digital message, image, video, or other publication made through a computer, smartphone, or connected system.
Authorship by the respondent. The prosecution must connect the accused to the allegedly defamatory online statement. A display name, profile photograph, or screenshot of an account may not, by itself, conclusively prove who controlled or used the account at the relevant time.

The absence of any essential element defeats criminal liability.

Who may be liable for reactions, comments, and shares?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel only as applied to the original author of the assailed statement and declared it unconstitutional as applied to people who merely receive and react to the post. The Court also invalidated “aiding or abetting” liability in relation to cyber libel.

Accordingly, merely liking, reacting to, or sharing an existing post is not automatically cyber libel. But a person who adds a new defamatory accusation—for example, a comment that tells an independent defamatory story—may be treated as the author of that new publication. Copying an allegation and publishing it as one’s own statement also presents a materially different situation from a simple platform reaction.

The one-year deadline is critical

The Supreme Court’s April 8, 2026 final resolution in Causing v. People confirmed that cyber libel prescribes in one year, not 12 or 15 years.

The period runs from the date the allegedly defamatory material is discovered by:

the offended party;
the authorities; or
their agents.

Publication and discovery may occur on the same day, but they are not legally presumed to be the same merely because the post was public. Discovery is determined from evidence such as messages forwarding the post, reactions or comments by the complainant, demands for removal, communications threatening suit, and other conduct showing actual knowledge.

The filing of a complaint or information interrupts prescription. If proceedings later end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may run again. Because the computation can depend on disputed evidence, file well before the apparent deadline and obtain advice on the exact dates.

A separate civil action for defamation is also generally subject to a one-year limitation under Article 1147 of the Civil Code. Its accrual and interaction with a criminal case require separate analysis.

What to preserve before filing or responding

Screenshots are useful, but they may not be enough if authenticity, completeness, authorship, or context is disputed. Preserve:

the full post, article, video, image, email, or conversation—not only the offending sentence;
the complete URL and, where visible, the account handle, profile or page identifier, date, time, time zone, and audience or privacy setting;
the surrounding thread, captions, links, edits, replies, comments, and material necessary to understand the context;
screen recordings showing how the content was accessed;
original downloaded files rather than repeatedly forwarded or recompressed copies;
notification emails or messages through which the post was discovered;
the device, browser history, account records, access logs, drafts, and original media, when relevant;
the names and affidavits of third persons who saw the publication and understood whom it concerned;
evidence linking the respondent to the account, such as admissions, communications, consistent account activity, or lawfully obtained technical records;
records establishing the precise date of discovery;
documents supporting truth, falsity, source verification, public interest, good motive, or actual harm; and
a written log of who collected, copied, transferred, or stored each electronic item.

Keep unedited copies and working copies separately. Do not crop away identifying information, overwrite original files, manufacture missing context, or access another person’s account without authority. Electronic documents must still be authenticated under the Supreme Court’s Rules on Electronic Evidence, including by evidence showing their integrity and reliability.

If content, subscriber information, or traffic data may soon disappear, consult the NBI, PNP cybercrime unit, or counsel immediately. Under Republic Act No. 10175 and the Rule on Cybercrime Warrants, law-enforcement authorities may seek preservation and court-authorized disclosure of relevant computer data. A private screenshot does not substitute for platform or forensic evidence when the identity of an anonymous account is contested.

How to file the complaint

1. Confirm that the facts amount to cyber libel

Separate insulting or offensive speech from a legally defamatory factual imputation. Determine:

the exact words or images complained of;
their complete context;
who authored them;
who received or saw them;
how the complainant was identifiable;
whether a privilege or public-interest issue applies; and
the dates of publication and discovery.

Not every harsh criticism, satire, exaggeration, opinion, or accusation is criminal. Conversely, calling a statement an “opinion” does not protect a disguised factual allegation.

2. Identify the proper place of filing

Venue in cybercrime cases is technical. Section 2.1 of the Rule on Cybercrime Warrants provides that a criminal action under Section 4 or 5 of Republic Act No. 10175 may be filed before the designated cybercrime court of the province or city:

where the offense or any element was committed;
where any part of the computer system used was situated; or
where any damage to a natural or juridical person occurred.

The first court properly acquiring jurisdiction excludes the others. Libel-specific venue rules under Article 360 and Supreme Court decisions must also be considered. Do not assume that merely opening a webpage in a convenient city establishes venue. Select the prosecution office with a genuine, provable connection to the offense and state that connection precisely.

3. Prepare the complaint-affidavit and supporting affidavits

Under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, the complaint-affidavit should state:

the parties’ names and addresses;
the date and place of the alleged offense;
the facts showing how each element was committed;
the respondent’s alleged authorship;
the date and circumstances of discovery; and
the factual basis for the selected venue.

Attach witness affidavits and all supporting evidence. Organize electronic evidence so that each attachment is identified and explained by someone with personal knowledge.

The filing ordinarily requires the original complaint-affidavit, two duplicate copies for the official file, and an additional copy for each respondent, together with a duly accomplished NPS Investigation Data Form. Confirm the receiving office’s current documentary, copying, oath, and filing requirements before submission. E-filing or virtual proceedings may be available, but an informal email should not be assumed to constitute a valid filing.

4. Consider an NBI or PNP investigation when technical assistance is needed

Direct filing with the prosecution office may be possible when the respondent and evidence are known. If the account is anonymous, hacked, spoofed, deleted, or technically disputed, law-enforcement investigation may be necessary before the evidence is complete.

The NBI Cybercrime Division accepts requests for investigative assistance, and the NBI also provides an online complaint page.

5. Respond to subsequent orders

The prosecutor may dismiss an insufficient complaint or issue a subpoena. If the respondent files a counter-affidavit raising material new matters, the complainant may be allowed or directed to file a reply-affidavit. File only authorized submissions, observe the stated deadlines, furnish the opposing party as required, and retain stamped or electronic proof of filing.

How to defend the case

At the preliminary-investigation stage

Upon receiving the subpoena:

Record the exact date and manner of receipt.
Obtain the complete complaint, affidavits, and attachments.
Preserve your account, devices, records, sources, drafts, and the full online context.
Consult counsel before communicating with the complainant, witnesses, platform, investigators, or the public.
File a sworn counter-affidavit with supporting affidavits and documents on the date stated in the subpoena, which must allow at least 10 days from receipt.
Furnish the complainant with the required copy and keep proof of service and filing.

The current prosecutorial standard is prima facie evidence with reasonable certainty of conviction. The prosecutor evaluates whether the evidence is admissible, credible, capable of preservation and presentation at trial, and sufficient to establish every element and the offender’s identity. The Supreme Court upheld this standard in Meking v. Remulla.

Do not file a bare motion to dismiss instead of a counter-affidavit. Under the DOJ rules, such a motion is generally not allowed unless verified and containing the respondent’s defenses, in which case it may be treated as the counter-affidavit.

Defenses and issues counsel should examine

Depending on the evidence, relevant defenses may include:

the words were not defamatory when read in full context;
no third person received the statement;
the complainant was not identifiable;
the accused did not author or control the post;
the account was hacked, impersonated, or used by someone else;
the exhibit is incomplete, altered, unauthenticated, or unreliable;
the statement was true and published with good motives and justifiable ends, subject to Article 361;
the communication was qualifiedly privileged;
the post was a fair and true good-faith report of a non-confidential official proceeding, without improper comments;
the statement concerned a public officer, public figure, or matter of public interest and actual malice was not proved;
the material was merely received or reacted to, rather than originally authored;
venue or jurisdiction is improper;
the offense has prescribed;
the same act is impermissibly being prosecuted as both traditional libel and cyber libel; or
the conduct occurred before Republic Act No. 10175 became effective and cannot constitutionally be punished retroactively as cyber libel.

A denial unsupported by records is usually weaker than a documented explanation. If hacking or unauthorized use is claimed, preserve security alerts, login history, recovery emails, device records, reports to the platform, and contemporaneous messages.

Privilege, truth, and public-interest speech

A communication made privately to an appropriate person in the performance of a legal, moral, or social duty may be qualifiedly privileged. The privilege can be lost through actual malice or unnecessary publication to people who had no corresponding interest or duty. Posting a grievance publicly when it could have been directed to the proper authority may materially change the analysis.

Truth is not an automatic defense in every situation. Article 361 generally requires proof that the imputation was true and published with good motives and for justifiable ends. Special rules govern imputations concerning government employees’ official duties.

For statements about the official conduct of a public officer or public figure, the prosecution may be required to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false. Mere negligence or an honest factual error is not necessarily reckless disregard. The Supreme Court explains this standard in Daquer v. People. The rule does not automatically protect accusations about a person’s purely private life.

If an information has already been filed in court

Cyber libel is tried in the Regional Trial Court, ordinarily a designated cybercrime court. Before arraignment, counsel should promptly examine:

whether the information alleges every element;
venue and jurisdiction;
prescription;
double jeopardy or duplicated charges;
whether a motion to quash is appropriate; and
whether an application for bail or voluntary surrender must be arranged.

Some objections can be waived by entering a plea without raising them. Do not miss arraignment or attempt to evade a warrant.

A prosecutor’s adverse resolution may be challenged through a timely motion for reconsideration. Under the 2024 DOJ-NPS Rules, it must generally be filed within 15 days from receipt. Further review may be available under applicable DOJ rules, but a petition for review does not automatically halt court proceedings; counsel may need to seek suspension from the trial court.

Civil damages and settlement

A cyber libel incident may involve civil liability in addition to criminal prosecution. A civil action arising from the offense is generally deemed included in the criminal case unless it was waived, reserved where permitted, or previously filed. Article 33 of the Civil Code also recognizes an independent civil action for defamation, subject to procedural and venue rules.

Actual, moral, exemplary, and other damages are not automatic. The claimant must establish the legal and factual basis for the particular award. Preserve employment records, cancelled transactions, client communications, medical or psychological records, and other lawful evidence of harm.

An apology, correction, takedown, or settlement may reduce conflict and can be relevant to damages or sentencing, but it does not automatically erase an already completed offense. An affidavit of desistance likewise does not compel the prosecutor or court to dismiss the criminal case, because the prosecution is brought in the name of the People of the Philippines.

Have counsel structure settlement discussions. Do not threaten wider publication, harass witnesses, demand money in exchange for silence, or pressure anyone to destroy or alter evidence.

Common mistakes

Waiting for a demand letter even though none is generally required before filing.
Counting one year only from the posting date without investigating the provable discovery date.
Filing in a convenient city without a defensible venue connection.
Submitting cropped screenshots with no URL, account details, date, context, or authenticating witness.
Assuming a profile name conclusively proves authorship.
Treating every insult or negative review as criminal defamation.
Assuming truth alone always ends the case.
Assuming “opinion,” “allegedly,” emojis, or a disclaimer automatically prevents liability.
Publicly reposting the accusation while trying to complain about it.
Deleting accounts, messages, or devices after receiving notice of a dispute.
Ignoring a subpoena because it is not yet a court case.
Filing a motion to dismiss instead of a substantive counter-affidavit.
Assuming an apology, takedown, or affidavit of desistance automatically terminates criminal proceedings.
Obtaining evidence through hacking, impersonation, unlawful access, or secret interception.
Discussing the defense publicly and creating new admissions or publications.

When legal help is urgent

Obtain immediate assistance if:

the one-year period may expire soon;
the content or account is being deleted;
the respondent is anonymous or outside the Philippines;
platform or subscriber data is needed;
you received a subpoena, prosecutor’s resolution, information, arraignment notice, or warrant;
multiple posts or respondents are involved;
the complainant is a public officer or public figure;
the publication concerns an official proceeding, confidential record, sexual content, a minor, or another possible offense;
the account was allegedly hacked or impersonated;
there are threats, doxxing, stalking, extortion, or physical danger; or
a civil action, employment proceeding, or administrative case may arise from the same publication.

Qualified indigent accused may seek representation from the Public Attorney’s Office, including during preliminary investigation and trial.

FAQ

Is a demand or takedown letter required before filing?

No general rule makes a demand letter a prerequisite to a cyber libel complaint. A carefully drafted request for correction, preservation, or removal may still be useful, but it can also establish the date of discovery and affect later litigation.

Does deleting the post prevent prosecution?

No. Deletion does not undo a completed publication, and copies or platform records may remain. Preserve the evidence before requesting or making a deletion.

Are screenshots admissible?

Potentially, but admissibility and weight depend on relevance, completeness, authenticity, and reliability. A witness should be able to explain when and how the content was accessed and preserved. Account or forensic records may be necessary when authorship is disputed.

Can I file if my name was not used?

Yes, if third persons could identify you from the description, photograph, tags, context, or surrounding circumstances. You should identify witnesses who actually made that connection.

Is every social-media share cyber libel?

No. Under Disini, mere receipt and reaction—including ordinary likes, comments, or shares—are not automatically punishable as cyber libel. A new comment or republication containing an independently defamatory accusation may constitute a new original publication.

Can an honest mistake about a public official still be cyber libel?

It depends. For protected public-interest speech, the prosecution may have to prove actual malice. Mere negligence is generally different from knowingly publishing a falsehood or acting with serious doubts about its truth. The subject matter, sources, verification, wording, and complete context are critical.

Can the complainant withdraw the case?

The complainant may communicate a change of position, but an affidavit of desistance does not automatically bind the prosecutor or court. The State controls the criminal prosecution.

Will conviction always result in imprisonment?

No. The law permits imprisonment, a fine, or both, and Supreme Court guidance allows a fine alone in appropriate circumstances. The result depends on the evidence, applicable penalties, mitigating or aggravating circumstances, and judicial discretion.

Official legal sources

This article provides general legal information, not advice for a particular case. Cyber libel outcomes depend heavily on the exact words, context, authorship evidence, discovery date, venue, and procedural record. The law and official sources were checked as of 3 August 2026.