Quick answer

To file a Philippine cyber libel case, act promptly: preserve the online material and its surrounding context, document when it was discovered, identify the original author, determine the legally proper venue, and file a sworn complaint with the appropriate city or provincial prosecution office. An NBI or other cybercrime investigation may help identify an anonymous account or preserve provider data, but a report, demand letter, or platform complaint should not be assumed to stop prescription.

To defend a case, do not ignore a prosecutor’s subpoena or court process. Preserve the account, device, login records, complete conversation, source materials, and evidence supporting truth, good faith, privilege, lack of authorship, improper venue, or prescription. Submit a detailed counter-affidavit by the stated deadline and obtain counsel immediately if an Information, warrant, summons, or search involving digital devices has been issued.

Cyber libel is libel committed through a computer system or information and communications technology. The prosecution must establish all elements of libel and connect the accused to the original online publication. A hostile, embarrassing, or false post is not automatically criminal cyber libel; the precise words, context, audience, person identified, authorship, malice, privilege, venue, and dates all matter.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to publication through a computer system or a similar future technology. Computers include smartphones and other devices capable of processing and communicating data.

For a conviction, the prosecution generally must prove beyond reasonable doubt:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the statement. A message sent only to its subject generally lacks this element, although another law may apply.
Identifiability. The offended person must be named or sufficiently identifiable from the words and surrounding circumstances. A nickname, photograph, position, or contextual clues may be enough.
Malice. As a general rule, Article 354 of the Revised Penal Code presumes a defamatory imputation malicious—even if true—unless good intention and a justifiable motive are shown or a recognized privilege applies. In public-official, public-figure, privileged-communication, and public-interest cases, a more exacting inquiry into actual malice may apply.
Use of a computer system or ICT. The publication must have been made online or through the covered technology.
Authorship and attribution. The respondent must be proved to be the original author or publisher of the statement charged. A profile name or screenshot alone does not necessarily prove who controlled the account or made the post.

The words are assessed in their complete setting, not by isolating one phrase. Courts consider their ordinary meaning, the thread or conversation, images and captions, the audience, and relevant events. Labeling an accusation “opinion,” “allegedly,” “for awareness,” or “just asking” does not automatically protect it if the overall message asserts or implies a defamatory fact.

Likes, shares, reactions, and comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author but declared it unconstitutional as applied to people who merely receive and react to the post. It also invalidated the Cybercrime Prevention Act’s aiding-or-abetting provision insofar as it applies to cyber libel.

Accordingly, merely pressing “Like,” reacting, or sharing another person’s post does not by itself establish cyber libel under that ruling. The situation changes when a person writes a new caption, comment, post, or other statement containing their own defamatory imputation. That person may be treated as the original author of the new statement. Liability must be assessed statement by statement and person by person.

The same act should not be used to punish an accused under both ordinary libel and cyber libel. Disini held that charging the same online publication under both regimes would violate the protection against double jeopardy.

The one-year deadline is critical

The Supreme Court’s final April 8, 2026 ruling in Causing v. People confirms that cyber libel prescribes in one year from discovery of the alleged defamatory material by the offended party, the authorities, or their agents. Publication and discovery may occur on the same date, but they are not legally presumed to coincide merely because a post was public or widely accessible.

The date of discovery is factual. Messages forwarding the post, reactions or replies by the offended person, requests to remove it, consultation with counsel, threats of a libel case, and similar conduct may show when discovery occurred.

Under Article 91 of the Revised Penal Code:

Prescription is interrupted by filing the criminal complaint or Information.
It may run again if the proceedings end without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused.
The period does not run while the offender is absent from the Philippines.

Do not wait until the final days. Venue errors, incomplete affidavits, holidays, rejected filings, or uncertainty about the discovery date can be fatal. Do not assume that reporting the account to the platform, sending a demand or takedown request, executing a barangay complaint, or making an informal police report interrupts prescription. Have counsel determine what must be filed, where, and by what date.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. Criminal and civil deadlines and interruption rules are not identical in every situation, so each remedy should be evaluated separately.

What evidence should be preserved?

Preserve evidence before asking for deletion or confronting the account holder. Online content can be edited, hidden, or removed within minutes.

Keep the following where available:

Full-page screenshots showing the exact words, images, profile name, username or handle, date and time, URL, audience or privacy setting, reactions, comments, and surrounding thread.
A screen recording that begins at the account profile, shows the account’s identifying details, opens the post, and scrolls through its complete context.
The direct link to the post, comment, video, story, group, channel, or account.
Original downloaded photographs, videos, voice recordings, emails, messages, and attachments—not only compressed copies forwarded through another app.
The device on which the material was first viewed, with the original files and browser or application history left intact.
Affidavits or contact information of people who personally saw the publication.
Proof of when and how the offended person, an agent, or an authority first discovered it.
Evidence linking the account to its alleged user: prior admissions, consistent contact details, account history, photographs, known writing patterns, linked pages, payment records obtained lawfully, or witnesses with personal knowledge.
Evidence of reputational harm, such as cancelled engagements, customer messages, employer communications, loss of work, or questions from colleagues. Actual financial loss is not always an element, but it may matter to damages and credibility.
For the defense, drafts, research files, official records, interview notes, communications with sources, fact-checking efforts, and the complete exchange that preceded the post.
If hacking or impersonation is claimed, password-reset notices, security alerts, login-location records, device lists, reports to the platform, and proof of steps taken to regain the account.

Do not crop away context, alter timestamps, annotate the only copy, or rely exclusively on a printed screenshot. Under the Rules on Electronic Evidence, electronic material must satisfy ordinary admissibility rules and be authenticated. A person offering a private electronic document bears the burden of showing its integrity and reliability.

Do not hack an account, impersonate someone, secretly obtain passwords, or unlawfully access private data to build a case. Illegally obtained evidence can create separate criminal and evidentiary problems.

How to file a cyber libel complaint

1. Identify the exact statement and legal theory

Quote or reproduce the specific words charged. Explain:

What they mean in ordinary language and in context.
Why they are defamatory.
Who understood the words to refer to the complainant.
Who received or viewed them.
Why the respondent is believed to be the original author.
What computer system or online platform was used.
What facts show malice, if malice must be proved.
When and how the statement was discovered.
Why the selected place is the proper venue.

Avoid filing a complaint built only around conclusions such as “the post ruined my reputation.” The affidavit should establish every element through facts and supporting evidence.

2. Determine the proper venue before filing

Cyber libel cannot be filed wherever a post happened to be viewed. Under Section 2.1 of the Rule on Cybercrime Warrants, as discussed by the Supreme Court in Tieng v. Palacio-Alaras, a criminal action under Sections 4 or 5 of the Cybercrime Prevention Act is filed in the designated cybercrime court of the province or city:

where the offense or any element was committed;
where any part of the computer system used was situated; or
where damage to a natural or juridical person took place.

The first court in which the action is properly filed acquires jurisdiction to the exclusion of the others. Venue must be supported by concrete allegations and evidence; internet accessibility alone should not be used to manufacture venue.

Because the prosecutor ordinarily files the Information in the court serving the proper locality, confirm the correct city or provincial prosecution office before submitting the complaint. Public officers, private individuals, juridical persons, multiple offended parties, and cross-border facts may require closer analysis.

3. Decide whether law-enforcement assistance is needed

A complainant may approach the appropriate prosecution office directly with a sufficiently supported complaint-affidavit. Assistance from the NBI Cybercrime Division or another authorized cybercrime unit is especially useful where:

the account is anonymous or impersonating someone;
subscriber or traffic data may be needed;
forensic examination is necessary;
content is likely to disappear;
the publication involves coordinated accounts or foreign service providers; or
other offenses, such as identity theft, illegal access, threats, extortion, or unlawful disclosure of intimate material, may be involved.

The NBI provides investigative assistance for victims of computer crimes and maintains an online complaint page. Cybercrime incidents may also be referred through the DOJ Office of Cybercrime.

Only authorized law-enforcement processes and court warrants can compel protected subscriber, traffic, or content data. Under Sections 13 and 14 of the Cybercrime Prevention Act, law enforcement may order specified preservation and, after securing the required court warrant, require disclosure relevant to an officially docketed investigation. Contact authorities early because providers do not retain every category of data indefinitely.

4. Prepare and file the sworn complaint

A filing ordinarily includes:

The complaint-affidavit.
Affidavits of witnesses with personal knowledge.
The NPS Investigation Data Form and locally required cover sheets.
Authenticated or properly identified electronic evidence.
Translations where material statements are not in English or Filipino.
Evidence of authorship, publication, identity, malice, venue, discovery, and any claimed damage.
Copies in the number and format required by the receiving office.

Confirm current filing hours, fees, copy requirements, and whether that particular prosecution office accepts electronic filing. Do not send sensitive evidence to an unofficial email address.

5. Participate in preliminary investigation

Cyber libel carries a prescribed imprisonment range extending beyond six years, so it falls under regular preliminary investigation under the DOJ-NPS rules. The prosecutor determines whether the available evidence establishes a prima facie case with reasonable certainty of conviction—not whether guilt has already been proved beyond reasonable doubt.

The current procedure is governed by DOJ Department Circular No. 015, series of 2024, whose validity was upheld in G.R. No. 280455. If the complaint is sufficient to proceed, the prosecutor issues a subpoena and provides the respondent access to the complaint and supporting evidence.

The subpoena controls the actual deadline. Under the regular procedure, a respondent is ordinarily directed to submit a counter-affidavit and supporting affidavits within ten calendar days from receipt. Reply and rejoinder affidavits may be required when new factual or legal matters justify them. Preliminary investigation is normally affidavit-based; it is not yet the criminal trial.

The rules direct investigating prosecutors to resolve preliminary-investigation complaints within 60 calendar days from assignment, with a maximum 30-day extension in specified situations such as complex issues, countercharges, consolidation, or reassignment. These are administrative resolution periods, not a promise that every case will finish within that time.

6. Resolution, review, and filing in court

If the prosecutor finds the required evidence, an Information is prepared for the proper designated Regional Trial Court. If not, the complaint is dismissed, subject to available review.

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. A petition for review may also be available under the applicable DOJ appeal rules. The correct reviewing office, contents, filing period, fees, and need to request suspension of court proceedings depend on the resolution and case status. Seek counsel immediately rather than waiting for the reconsideration period to expire.

When an Information is filed, the judge independently determines probable cause. The court may dismiss the case for an evident lack of probable cause or may issue the appropriate process, including a warrant when legally warranted. Filing a complaint with the prosecutor does not itself mean that the respondent has been convicted or will immediately be arrested.

How to defend a cyber libel complaint

Treat the subpoena as a hard deadline

Record the date and method of receipt. Obtain the complete complaint, annexes, and subpoena. The counter-affidavit should be sworn, specific, and supported by documents and witness affidavits. A bare denial or a social-media response is not an adequate defense.

If more time is genuinely necessary, have counsel request the permitted relief before the deadline. Do not assume an informal request, absence from the hearing, or non-receipt by a lawyer automatically extends it.

Preserve first; do not retaliate online

Do not answer the complaint by reposting the accusation, attacking the complainant, pressuring witnesses, or releasing private evidence to the public. Those acts may supply evidence of malice, create additional publications, or lead to separate charges.

Preserve the complete account and device even if the post is embarrassing. If counsel advises removing content, first make reliable forensic-quality copies and document the removal. Deletion does not automatically erase a completed offense and may destroy evidence helpful to the defense.

Examine every element and procedural requirement

Possible defenses include:

The statement is not defamatory in its complete context. Mere criticism, disagreement, satire, rhetorical hyperbole, or an opinion that does not assert a defamatory fact may fall outside Article 353. Calling something an opinion is not conclusive.
No publication occurred. The allegedly defamatory message was communicated only to the complainant, or the prosecution cannot show that a third person received it.
The complainant was not identifiable. Readers could not reasonably determine that the words referred to that person or entity.
The respondent was not the original author. The respondent merely received or reacted to another person’s post, the account was falsely attributed, or competent evidence does not connect the respondent to publication.
The account was hacked or impersonated. This defense requires prompt, objective evidence; a late unsupported claim is unlikely to be persuasive.
The communication was privileged. Article 354 protects, subject to its conditions, a private communication made in the performance of a legal, moral, or social duty and a fair and true good-faith report—without comments—of a nonconfidential official proceeding or an official act. Other absolute or qualified privileges may apply to relevant judicial statements, official communications, and fair comment on matters of public interest.
Actual malice is absent where it must be proved. In cases involving public officials or public figures, the prosecution may need to show that the statement was published with knowledge of falsity or reckless disregard of whether it was false, depending on the person’s status and the subject of the publication. Being a public official does not make every private accusation fair game.
Truth, good motives, and justifiable ends are established. Article 361 permits acquittal when the accused proves the imputation true and also proves good motives and justifiable ends. Truth alone is not automatically a complete defense. Proof of the truth of an imputation that is not a crime is restricted unless it concerns a government employee and facts related to official duties.
The case has prescribed. Under Causing, the one-year period runs from actual discovery by the offended party, the authorities, or their agents. The defense must support an earlier discovery date with evidence when prescription is not apparent from the complaint or Information.
Venue is improper or insufficiently alleged. Identify where the author and device were located, where relevant damage allegedly occurred, and what venue facts appear in the complaint and Information.
The electronic evidence is incomplete or unauthenticated. Cropped screenshots, missing URLs, hearsay about who operated an account, altered files, and missing context may undermine admissibility or weight.
The required computer-system element is absent. A purely oral statement, paper document, or traditional broadcast may involve another form of defamation, but not necessarily cyber libel.

Retraction, correction, removal, or apology does not automatically extinguish criminal liability. Depending on timing and circumstances, it may demonstrate good faith, reduce harm, support settlement of civil issues, or affect the court’s choice of penalty. Do not issue an admission or apology without understanding its evidentiary consequences.

Respond immediately after an adverse resolution

A motion for reconsideration of the prosecutor’s resolution generally must be filed within 15 days from receipt. If an Information has already reached court, a DOJ review does not automatically stop judicial proceedings; the applicable rules may require a separate motion to suspend proceedings.

If a warrant has issued, have counsel verify it directly with the court and arrange the lawful response and bail. Do not evade service or rely on a screenshot of an alleged warrant circulated online.

Penalties and civil exposure

Cyber libel is punishable one degree higher than traditional written libel. The imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

Imprisonment is not automatic. In People v. Soliman, the Supreme Court held that a court may impose a fine instead of imprisonment. Based on Article 355 as amended by Republic Act No. 10951 and the one-degree increase, the Court identified the cyber-libel fine range as ₱40,000 to ₱1,500,000. Depending on the judgment, the law permits imprisonment, a fine, or both.

Civil damages may be awarded in addition to the criminal penalty. The civil claim arising from the offense is generally deemed instituted with the criminal action unless validly waived, reserved, or previously filed, subject to the special venue rules for libel and the rules governing independent civil actions. A complainant who wants damages—and a respondent facing them—should address the civil component before filing decisions or plea, not as an afterthought.

Common mistakes

By complainants

Waiting for platform action while the one-year period runs.
Counting from publication without documenting the actual discovery date.
Filing wherever the post was viewed instead of proving proper venue.
Attaching only a cropped screenshot.
Failing to prove that another person saw the post.
Assuming a username proves the respondent’s identity.
Charging people who merely liked or shared the original post.
Treating truth as irrelevant or assuming falsity alone proves cyber libel.
Publicly reposting the defamatory material and increasing its reach.
Filing before investigating privilege, public-interest context, or actual malice.
Assuming an NBI report or demand letter is the same as a prosecutor-filed criminal complaint.

By respondents

Ignoring the subpoena because it is “only” from a prosecutor.
Filing a one-page denial without supporting evidence.
Deleting the account, device data, drafts, or messages before preserving them.
Contacting or intimidating the complainant or witnesses.
Repeating the accusation in a public defense.
Claiming hacking without security records or a timely report.
Relying on “it was true” without proving good motives and justifiable ends.
Missing the 15-day reconsideration period.
Assuming an apology automatically ends the criminal case.
Assuming that because bail is available, no warrant can issue.

When legal help is urgent

Speak with a Philippine lawyer immediately when:

One year from the earliest provable discovery date is approaching.
The account is anonymous or evidence is disappearing.
A prosecutor’s subpoena has been received.
A counter-affidavit, reconsideration, or review deadline is running.
An Information, summons, hold order, or warrant has been issued.
Authorities seek access to, seizure of, or examination of a phone or computer.
The case involves a journalist, public officer, election issue, confidential source, employer, school, or regulated profession.
The post also contains threats, doxxing, identity theft, intimate images, extortion, or allegations involving children.
The author, service provider, device, or relevant data is outside the Philippines.
A civil damages suit or takedown demand is being considered alongside the criminal case.

Qualified indigent parties may ask the Public Attorney’s Office about representation, subject to its eligibility, merit, and conflict rules.

Frequently asked questions

Is a screenshot enough to win a cyber libel case?

Not necessarily. It may show what appeared on a screen, but the proponent must still establish authenticity, completeness, publication, authorship, identity, venue, timing, and the other elements. Preserve the URL, original device, metadata where available, full context, and witnesses.

Can a case be filed against an anonymous account?

An investigation may begin, but criminal liability ultimately requires competent attribution to a person. Prompt law-enforcement assistance may be necessary to preserve and obtain subscriber or traffic data through lawful processes.

Is sharing or liking a defamatory post cyber libel?

Mere receipt, reaction, liking, or sharing is not by itself cyber libel under Disini. A person who adds a new defamatory caption or comment may be responsible as the original author of that new statement.

Is truth a complete defense?

No. Article 361 generally requires both truth and proof that publication was made with good motives and for justifiable ends. Additional restrictions apply when the imputation concerns conduct that is not itself a crime.

Can a complainant file where they currently live?

Current residence alone is not enough. Venue depends on the legally relevant facts at the time of the offense and the Rule on Cybercrime Warrants. The complaint must establish why the chosen locality is proper.

Does deleting the post prevent a case?

No. Deletion does not undo an already completed publication. It may also remove evidence needed by either side. Preserve reliable copies before taking down content.

Does an apology or settlement automatically dismiss the criminal case?

No. Cyber libel is prosecuted in the name of the People of the Philippines. An affidavit of desistance, apology, or private settlement may affect evidence, damages, or prosecutorial decisions, but it does not automatically extinguish the offense or require dismissal.

Can criticism of a public official be cyber libel?

Yes, if the legal elements are proved, but public-official and public-interest speech receives stronger constitutional protection. Depending on the subject and privilege involved, the prosecution may have to prove actual malice—knowledge of falsity or reckless disregard for truth. Sharp criticism is not automatically criminal, while knowingly or recklessly publishing a defamatory factual accusation may be.

Is imprisonment mandatory after conviction?

No. The Supreme Court has confirmed that a court may impose a fine instead of imprisonment. The sentence depends on the law, circumstances, judicial findings, and applicable sentencing rules.

Will filing a complaint cause immediate arrest?

Ordinarily, no. A regular complaint proceeds first through preliminary investigation. If an Information is later filed, the judge independently determines probable cause and whether to issue a warrant or other process.

Key official sources

This is general Philippine legal information, not legal advice or a prediction of any case. Cyber libel outcomes depend on the exact words, documents, account attribution, privilege, dates, venue, and procedural history. Sources and procedures checked as of July 28, 2026.