Quick answer

A Philippine cyber libel case normally starts with a sworn complaint before the proper city, provincial, or regional prosecution office—not with a direct private filing in court. The complainant must present credible, admissible, and preservable evidence showing a defamatory online statement, publication to another person, identification of the complainant, malice, use of a computer system, and the respondent’s responsibility for the statement. If the prosecutor finds sufficient evidence, an Information is filed in the appropriate Regional Trial Court designated as a cybercrime court.

Act quickly. The Supreme Court’s controlling 2026 ruling is that cyber libel prescribes in one year from discovery of the defamatory material by the offended party, the authorities, or their agents, subject to interruption and other rules in Article 91 of the Revised Penal Code. Publication and discovery may occur on the same date, but discovery is not automatically presumed merely because a post was public or widely accessible. The date of discovery is often a factual issue requiring proof. Filing the complaint or Information interrupts prescription. The period may run again if proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused; it does not run while the offender is absent from the Philippines. See the Supreme Court’s signed resolution in Causing v. People, G.R. No. 258524, April 8, 2026.

A person who receives a subpoena should not ignore it or answer only through a social-media post. The current DOJ rules generally require the counter-affidavit on the hearing date stated in the subpoena, which must be at least 10 days after receipt of the subpoena and complaint. Any extension is discretionary and, when justified, may not exceed 10 days.

What Philippine law treats as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 covers libel, as defined under the Revised Penal Code, committed through a computer system or a similar means that may be developed in the future.

The underlying definition remains Article 353 of the Revised Penal Code: a public and malicious imputation of a crime, vice or defect, or another act, omission, condition, status, or circumstance tending to dishonor, discredit, or bring a natural or juridical person into contempt. In practical terms, the prosecution must establish:

A defamatory imputation. The statement must reasonably tend to damage reputation. The entire post, caption, image, video, conversation, language, audience, and surrounding context matter.
Publication. At least one person other than the person defamed must have received, read, heard, or seen the statement. A message sent only to the subject ordinarily lacks this element, but a group chat, copied email, public post, or message shown to someone else may satisfy it.
Identification. The complainant must be identifiable. Naming the person is not always necessary if readers familiar with the circumstances can reasonably determine who was meant.
Malice. Article 354 generally presumes malice from a defamatory imputation unless a recognized privilege applies and subject to constitutional protections for speech about public officials, public figures, and matters of public concern.
Use of a computer system or information and communications technology. Examples may include websites, social-media platforms, online forums, email, or messaging applications.
Responsibility for the statement. The evidence must reliably connect the respondent to the account and the act of writing, uploading, or otherwise publishing the statement.

These requirements come from Articles 353 to 362 of the Revised Penal Code, read with Republic Act No. 10175 and Supreme Court decisions.

Offensive speech is not automatically cyber libel

A rude, unfair, embarrassing, or critical post is not automatically criminal. Courts examine what an ordinary reader would understand from the full context—not simply whether the complainant felt insulted.

Important distinctions include the following:

A verifiable accusation of criminal conduct is different from loose rhetoric, obvious exaggeration, satire, or an opinion that does not imply undisclosed defamatory facts.
A person must be identifiable, even if indirectly.
The statement must reach someone other than the person allegedly defamed.
The prosecution must prove the respondent’s authorship or legally relevant participation; ownership of a similarly named account is not enough by itself.
The statement must be evaluated in its original language and context. Selective screenshots that omit the surrounding thread may give a misleading impression.
Cyber libel cannot be imposed retroactively for online conduct completed before Republic Act No. 10175 took effect. The Supreme Court applied that protection in Peñalosa v. Ocampo, G.R. No. 230299, April 26, 2023. Whether a later edit, re-upload, new caption, or other act constitutes a new publication depends on the evidence and should not be assumed.

Privilege, public-interest speech, and truth

Privileged communications

Article 354 recognizes two qualified privileges:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments or remarks, of a non-confidential judicial, legislative, or other official proceeding, an official statement or speech made there, or an act performed by a public officer in the exercise of official functions.

Privilege is not a blanket license. The communication must remain connected to the duty or official proceeding, must reach appropriate recipients, and must not be used as a pretext for unnecessary publication. Malicious additions may lose the protection.

Public officials, public figures, and matters of public concern

When the challenged statement concerns a public official or public figure and relates to public conduct or a matter of public interest, the prosecution must prove actual malice—that the statement was made with knowledge of its falsity or reckless disregard of whether it was false. The burden is on the prosecution. Mere mistake, inaccuracy, or falsity does not by itself establish actual malice. The applicable standard is explained in Daquer v. People, G.R. No. 206015, June 30, 2021.

Whether someone is a public figure and whether the speech concerns a public matter are fact-specific questions. A private individual may also become involved in an event of legitimate public concern, but that does not make every statement about the person privileged.

Truth

Truth is important but should not be treated as an automatic defense in every situation. Under Article 361, an accused is acquitted when the libelous matter is proven true and was published with good motives and for justifiable ends. Special rules govern proof of imputations that do not constitute crimes, particularly when they concern a government employee’s official duties.

A responsible defense therefore identifies both:

Reliable proof that the material assertion was substantially true; and
The legitimate reason and manner in which it was communicated.

Rumor, an anonymous message, or an unverified repost is generally not proof that the accusation itself was true.

Likes, shares, comments, and reposts

In Disini v. Secretary of Justice, G.R. No. 203335, February 11, 2014, the Supreme Court upheld cyber libel as applied to the author but invalidated Section 5 on aiding or abetting insofar as it would punish ordinary online reactions to cyber libel. A simple “like,” reaction, or share should therefore not automatically be charged as aiding or abetting the original cyber libel.

The protection has limits. A commenter who writes a new and independently defamatory accusation may be treated as the author of that new statement. A new caption, edited accusation, re-upload, coordinated publication, or editorial act may require separate analysis. Liability should be based on the person’s actual words and conduct, not merely the platform button used or the person’s job title.

The same publication should not be used to punish a person separately for both ordinary libel and cyber libel. Disini held that charging both for the same defamatory material would violate the protection against double jeopardy.

The possible penalties

For an offense committed while the amended fine provisions are in force, Section 6 of Republic Act No. 10175 raises the penalty for online libel one degree above traditional written libel. The imprisonment range is generally prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

Imprisonment is not mandatory in every conviction. The court may impose imprisonment, a fine, or both, depending on the law applicable when the offense occurred and the circumstances. The Supreme Court has held that, under the presently amended fine structure, the range for online libel is ₱40,000 to ₱1,500,000. See People v. Soliman, G.R. No. 256700, April 25, 2023.

Because penal laws cannot ordinarily be applied retroactively to a person’s disadvantage, the date of the alleged publication matters when determining the applicable fine or penalty.

Before conviction by the Regional Trial Court, bail is a matter of right because cyber libel is not punishable by death, reclusion perpetua, or life imprisonment. The amount and conditions are determined by the court. A prosecutor’s subpoena alone is not an arrest warrant.

How to file a criminal complaint

1. Preserve the complete publication

Before requesting deletion or sending a demand, preserve the material as it actually appeared:

Full-page screenshots showing the account name, profile information, post, caption, comments, date and time, and visible URL;
A screen recording showing how the page or thread was accessed;
The direct link, account handle, platform, post identification number, and stated privacy setting;
Original images, videos, audio, email files, attachments, or downloaded account data;
The device on which the material was received or viewed;
Messages, notices, replies, corrections, or admissions relevant to authorship, falsity, motive, or publication;
The names and contact details of people who saw the material;
A written record of when, where, and how the complainant or an agent first discovered it; and
Evidence of resulting harm, such as lost business, cancelled engagements, employment consequences, medical records, or testimony from affected clients or colleagues.

Do not crop away context or alter the files. Keep an untouched copy and a separate working copy. The Rules on Electronic Evidence require electronic evidence to be authenticated. A screenshot may be useful, but its source, accuracy, integrity, and connection to the respondent may still need testimony or other corroboration.

Do not obtain evidence by hacking an account, stealing a password, impersonating another person, or unlawfully intercepting private communications.

2. Identify the respondent carefully

For a known account, preserve evidence connecting the account to the person, such as prior acknowledged posts, verified contact information, linked pages, admissions, or witnesses with personal knowledge.

For an anonymous or fake account, prompt law-enforcement assistance may be necessary. Subscriber information, traffic data, and content ordinarily require preservation requests and appropriate cybercrime warrants or orders. The Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC establishes procedures for preservation, disclosure, interception, search, seizure, and examination of computer data. A private complainant should not assume that a platform will voluntarily disclose identifying data.

The NBI Cybercrime Division provides investigative assistance, and the NBI also maintains an online complaint page. An investigative request does not replace timely filing with the proper prosecution office when prescription is approaching.

3. Determine the proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the designated cybercrime court of the province or city:

Where the offense or any of its elements was committed;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Venue is jurisdictional in criminal cases and must be supported by specific facts. Mere nationwide accessibility should not be treated as permission to file anywhere.

At the complaint stage, use the city, provincial, or regional prosecution office with territorial jurisdiction corresponding to a legally supportable venue. If the post, parties, servers, devices, or effects span several places, obtain legal advice before filing.

4. Prepare the complaint package

Under the 2024 DOJ–National Prosecution Service Rules on Preliminary Investigations and Inquest Proceedings, a regular preliminary investigation is initiated by filing:

The original complaint-affidavit;
Two duplicate copies for the official file;
As many additional copies as there are respondents;
A completed NPS Investigation Data Form;
Affidavits of witnesses; and
The supporting documentary, electronic, and other evidence.

The complaint-affidavit should clearly state:

The full names and usable addresses of the parties;
The exact statement complained of, preferably with an accurate translation if necessary;
When and where it was posted and discovered;
Who saw it;
Why the complainant was identifiable;
Why the statement was defamatory;
Evidence connecting the respondent to the statement;
Why any claimed privilege does not apply or was abused;
Facts supporting venue; and
The relief sought.

The affidavit must be properly sworn before a prosecutor or another government official authorized to administer oaths, or, when they are absent or unavailable, before a notary public. Confirm the receiving office’s current filing checklist, hours, and payment requirements before going. Electronic filing or a virtual preliminary investigation is available only when properly authorized by the prosecution office; sending an unsolicited email should not be assumed to complete filing.

5. Prove the date of discovery and file within one year

State the discovery date truthfully and explain how discovery occurred. Preserve the first message forwarding the post, the witness who showed it, the notification, or any contemporaneous response.

Do not postpone filing while waiting for a platform response, demand-letter negotiations, barangay proceedings, or a promised apology. Those steps do not necessarily interrupt criminal prescription. Because the correct computation can depend on facts and procedural events, file well before the apparent deadline.

6. Participate in the preliminary investigation

The current DOJ standard is prima facie evidence with reasonable certainty of conviction. Evidence must be admissible, credible, capable of preservation and presentation at trial, and sufficient—if uncontradicted—to establish the elements and identity of the responsible person. The Supreme Court upheld the DOJ’s authority to use this standard in Meking v. Remulla, G.R. No. 280455, November 11, 2025.

The prosecutor may:

Recommend dismissal after initial evaluation;
Issue subpoenas and receive counter-affidavits;
Conduct a physical or virtual clarificatory hearing;
Require a reply-affidavit and rejoinder-affidavit; or
Direct the production of material evidence.

A reply or rejoinder required by the prosecutor must be filed within the period set, which cannot be more than 10 calendar days from receipt of the pleading being answered. The rejoinder is the last pleading ordinarily allowed.

A party aggrieved by the prosecutor’s resolution may file a motion for reconsideration within 15 days from receipt. A petition for review may also be available under the applicable DOJ appeal rules. These remedies do not automatically suspend court proceedings after an Information has been filed, so counsel should assess whether a separate motion to suspend is necessary.

How to defend against a cyber libel complaint

Act immediately upon receiving a subpoena

Record the date and manner of receipt and calculate the stated deadline. Obtain the complete complaint and every attachment. The subpoena’s hearing date must ordinarily be at least 10 days after receipt.

A justified extension may be requested when time is reasonably needed to obtain counsel, examine voluminous records, verify authenticity, or research a novel or technical issue. It is discretionary and cannot exceed 10 days. Do not rely on an unapproved request.

If a properly served respondent neither appears nor files a counter-affidavit without justification, the prosecutor may resolve the case from the complainant’s evidence alone.

Preserve evidence; do not alter the account

Keep the original device, post data, drafts, source documents, messages, and account records. Preserve proof of hacking, spoofing, loss of account control, shared-device use, automated posting, or another person’s access if any of those facts are genuine.

Do not fabricate a backdated correction, edit files, pressure witnesses, delete relevant messages, or coach people to give a false account. A takedown may reduce continuing harm, but preserve a complete evidentiary copy first and obtain legal advice when a complaint or preservation demand is pending.

Answer every required element

A useful counter-affidavit does more than deny the accusation. Depending on the evidence, it may address:

Authorship: The respondent did not control the account or did not create or publish the statement.
Authenticity: The screenshot is incomplete, edited, fabricated, or unsupported by a competent witness.
Publication: No third person received the communication.
Identification: The complainant was not named and could not reasonably be identified.
Defamatory meaning: The complete context shows protected criticism, rhetoric, satire, or a statement that did not impute a discreditable fact.
Truth and purpose: Reliable records establish substantial truth, good motives, and justifiable ends.
Privilege: The communication was made to an appropriate recipient in the performance of a legal, moral, or social duty, or was a fair and true good-faith report of a non-confidential official proceeding.
Public-interest standard: The complainant is a public official or public figure, or the statement concerns public conduct, and the evidence does not establish actual malice.
Prescription: More than one year elapsed from a provable discovery date before the complaint was filed.
Venue: The alleged facts do not connect the offense, computer system, or damage to the selected jurisdiction.
Retroactivity: The alleged online act was completed before the cybercrime law took effect.
Duplicate prosecution: The same publication is being charged as both ordinary and cyber libel.

Prescription is generally a defense. Unless it is apparent from the face of the Information, the accused may bear the burden of presenting evidence establishing the discovery date and the relevant elapsed time.

Do not substitute a motion to dismiss for the counter-affidavit

The DOJ rules generally do not allow a motion to dismiss in place of a counter-affidavit. A verified motion containing the respondent’s complete defenses may be treated as a counter-affidavit, but relying on that exception is risky. Present the factual and legal defenses under oath and attach the supporting evidence within the deadline.

If an Information has already been filed

The judge independently evaluates the prosecutor’s resolution and supporting evidence to determine judicial probable cause. The court may dismiss the case if the record clearly fails to establish probable cause, request additional evidence, or issue a warrant of arrest.

Obtain counsel immediately to:

Confirm the court and case number;
Check whether a warrant has issued;
Arrange lawful surrender and bail when appropriate;
Review the Information for defects in the alleged offense, dates, identity, and venue;
Determine whether a motion to quash or another remedy is available;
Avoid missing arraignment, pre-trial, and appeal deadlines; and
Preserve objections to electronic evidence.

Do not evade service, ignore court orders, contact the judge privately, or threaten the complainant or witnesses.

Civil damages and non-criminal options

A person harmed by online defamation may pursue civil damages. Under Article 33 of the Civil Code, an independent civil action for defamation may proceed separately from the criminal case and is proved by preponderance of evidence. A person cannot recover twice for the same injury.

When a criminal action is filed, the civil action arising from the offense is generally deemed included unless it was waived, reserved for separate filing, or filed earlier. Article 1147 generally gives civil actions for injury to rights, including defamation, a one-year prescriptive period. The correct starting point and the effect of other proceedings require case-specific analysis.

Depending on the goal and urgency, practical alternatives may include:

A documented request for correction, retraction, apology, or takedown;
A platform report based on impersonation, harassment, or false information;
A carefully drafted cease-and-desist letter;
Mediation or a settlement that addresses deletion, correction, confidentiality, and damages; or
A civil action where damages or injunctive relief, rather than criminal punishment, is the principal objective.

An affidavit of desistance does not automatically dismiss a public criminal prosecution once instituted. The prosecutor or court still determines its legal effect.

Common mistakes to avoid

Waiting for an apology until the one-year period is nearly over;
Treating the upload date as automatically identical to the discovery date;
Filing in a convenient city without facts establishing venue;
Submitting cropped screenshots without URLs, context, witnesses, or authentication;
Naming every liker, sharer, page administrator, company officer, or group member without evidence of an independently punishable act;
Assuming that falsity alone proves actual malice in a public-interest case;
Assuming that truth alone is always sufficient without showing good motives and justifiable ends;
Reposting the accusation while publicly announcing the complaint;
Responding to a subpoena only through a motion to dismiss;
Missing the counter-affidavit or 15-day reconsideration deadline;
Deleting or editing relevant electronic evidence;
Obtaining evidence through unauthorized account access; and
Confusing an NBI or police investigative complaint with timely filing before the proper prosecution office.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year criminal or civil deadline is close or disputed;
A prosecutor’s subpoena, resolution, Information, summons, or warrant has been received;
The account is anonymous and provider data may soon become unavailable;
The post involves a journalist, public official, public figure, confidential source, whistleblower, or ongoing government investigation;
Several jurisdictions, countries, accounts, or corporate parties are involved;
The evidence may have been hacked, intercepted, edited, or unlawfully obtained;
The complaint accompanies threats, extortion, doxxing, stalking, or danger to personal safety; or
A takedown, correction, or settlement may affect admissions, defenses, or preservation duties.

People who meet the applicable indigency and merit requirements may seek assistance from the Public Attorney’s Office.

Frequently asked questions

Is a demand letter required before filing?

No general provision makes a demand letter a prerequisite to a cyber libel complaint. A demand may support a request for correction or settlement, but it does not necessarily stop prescription.

Is one screenshot enough?

Not necessarily. It may show the words and account, but the case may still require proof of authenticity, complete context, third-party publication, identity of the complainant, authorship, date of discovery, and venue.

Can a company be the victim?

Yes. Article 353 protects both natural and juridical persons, but the company must still be identifiable and prove the other elements.

Can someone be prosecuted for an anonymous account?

Potentially, but only if admissible evidence reliably identifies the person responsible. Law-enforcement preservation and disclosure procedures may be necessary.

Is sharing another person’s post automatically cyber libel?

No. Ordinary likes, reactions, comments, and shares cannot automatically be treated as aiding or abetting cyber libel under Disini. A person who adds a new defamatory accusation, however, may be treated as the author of that new material.

Does deleting the post end liability?

No. Deletion does not erase an already completed publication, although it may limit further harm. Preserve evidence before removal and comply with lawful preservation orders.

Does filing a complaint mean the respondent will be arrested immediately?

No. A prosecutor first conducts a preliminary investigation. If an Information is later filed, the judge independently determines judicial probable cause before issuing a warrant.

Can the complainant withdraw the case?

The complainant may execute an affidavit of desistance, but cyber libel is prosecuted in the name of the People of the Philippines. Withdrawal does not automatically require the prosecutor or court to dismiss a case supported by other evidence.

How long does the prosecutor have to resolve the complaint?

Under the 2024 DOJ rules, the investigating prosecutor should resolve a preliminary-investigation complaint within 60 calendar days from assignment, with a maximum 30-day extension for specified circumstances such as complex issues, countercharges, consolidation, or reassignment. Approval and promulgation have additional internal periods. These are official processing periods and should not be confused with a party’s filing deadline or the one-year prescriptive period.

Official legal references

This article provides general Philippine legal information, not advice for a particular case. Cyber libel outcomes depend heavily on the precise words, complete context, account attribution, discovery date, venue, privileges, and available electronic evidence. Sources and procedures were checked as of July 25, 2026.