Quick answer

Cyber libel is committed when the original author publishes through a computer system a defamatory statement that identifies a person or organization, reaches at least one third person, and is legally malicious. It is punishable under Section 4(c)(4) of the Cybercrime Prevention Act in relation to Articles 353 and 355 of the Revised Penal Code.

A complainant should preserve the complete online evidence, document when the post was discovered, identify the author, and file a sworn complaint with the proper prosecution office without delay. A respondent should note the exact date the subpoena was received, obtain the complete complaint and attachments, and submit a sworn, evidence-supported counter-affidavit by the stated deadline.

The most important deadline is prescription. The Supreme Court has definitively ruled that cyber libel generally prescribes in one year from discovery of the allegedly defamatory material—not automatically from the upload date. Filing the proper complaint or information interrupts prescription. Do not assume that a platform report, demand letter, barangay complaint, or informal police inquiry stops the clock.

What the prosecution must establish

Cyber libel uses the elements of traditional libel, with the additional fact that the publication was made through a computer system or information and communications technology. The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. The statement was communicated to at least one person other than the person defamed. A public social-media post, group chat, email copied to others, online article, video, caption, or similar communication may satisfy this element.
Identification. The complainant was named or was reasonably identifiable from the words, images, surrounding facts, or context.
Malice. The applicable kind and proof of malice depend on whether the communication is privileged and whether the complainant is a private person, public officer, or public figure.
Use of a computer system. The material was published through a computer, smartphone, social-media platform, website, messaging service, or comparable technology.
Authorship attributable to the respondent. The evidence must connect the accused—not merely an account name—to the creation or publication of the statement.

The statement must be considered as a whole and in context. Offensive language, criticism, sarcasm, or an unfavorable opinion is not automatically libel, but labeling a factual accusation as “opinion” does not necessarily protect it. Courts consider what a reasonable reader would understand, the words used, the surrounding discussion, the audience, and whether the statement implies provably defamatory facts.

Who may be held liable online

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel only as applied to the original author of the defamatory post or article. It declared unconstitutional the application of aiding-or-abetting liability to people who simply receive and react through features such as Like, Comment, or Share.

That protection has limits. A person who writes a new defamatory caption, comment, accusation, edited image, or narration may become the original author of that new material. Liability therefore depends on what the person actually authored, not merely which platform button was used.

An identical defamatory item cannot ordinarily support separate convictions for traditional libel and cyber libel merely because it appeared in print and online. The Supreme Court has treated them as the same offense for double-jeopardy purposes. Distinct publications or newly authored statements require separate factual analysis.

The one-year deadline

The Supreme Court’s April 8, 2026 resolution in Causing v. People affirmed with finality that cyber libel prescribes in one year under Articles 90 and 91 of the Revised Penal Code.

The period generally begins when the alleged cyber libel is discovered by:

the offended party;
the authorities; or
their agents.

Discovery is factual. It may be shown by a screenshot, message forwarding the post, a reaction or comment by the complainant, a demand for removal, a threat to sue, or another act demonstrating actual knowledge. Posting material publicly does not by itself create an automatic presumption that the complainant immediately discovered it.

Prescription is interrupted by the filing of the proper complaint or information. It may run again if the proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused. The period does not run while the offender is absent from the Philippines.

Because the computation can turn on the exact discovery date, filing office, procedural history, and any interruption, both sides should prepare a dated chronology. A complainant should not wait until the last weeks of the period. A respondent should not assume the prosecution’s stated discovery date is correct.

A separate civil action for defamation is also generally subject to a one-year prescriptive period under Article 1147 of the Civil Code. Its computation and interaction with a criminal case should be assessed separately.

How to preserve online evidence

Preserve evidence before requesting a takedown, blocking the account, responding publicly, or losing access to the page.

Keep:

screenshots showing the complete statement, account name, profile image, date, time, reactions, comments, and visible URL;
a screen recording that starts from the account profile and navigates to the post;
the direct link and any platform-specific post, message, channel, or account identifier;
the entire thread or conversation, not only selected lines;
original downloaded images, videos, audio, emails, attachments, and exported chat data;
the device on which the material was received or viewed;
messages showing who first sent the material to the complainant and when;
names and contact details of people who personally saw or received it;
evidence linking a pseudonymous account to its possible operator;
records of corrections, edits, deletion, re-uploading, retraction, or apology;
proof of resulting harm, such as lost work, cancelled contracts, customer messages, medical consultations, or reasonable corrective expenses; and
a written record of the exact date, time, and circumstances of discovery.

Do not crop away context, alter files, fabricate timestamps, impersonate another person, access an account without authority, or secretly obtain data by unlawful means. Keep the original files and make separate working copies.

Service-provider data can disappear. Under Section 13 of Republic Act No. 10175, traffic data and subscriber information must generally be preserved for at least six months from the transaction, while content data is preserved for six months after a law-enforcement preservation order. Law enforcement may order one six-month extension. Disclosure of protected data generally requires the appropriate cybercrime warrant or court process. A private person should therefore seek lawful assistance promptly rather than trying to identify an account through hacking or deception.

How to file a complaint

1. Check that cyber libel is the correct offense

Identify the precise words, image, video, or audio alleged to be defamatory. Ask:

What defamatory fact or imputation does it communicate?
Who would understand that it refers to the complainant?
Which third persons received or viewed it?
Who authored it?
Was it published through a computer system?
Is it potentially privileged or related to a public controversy?
When was it discovered?
Is another offense—such as threats, identity theft, unlawful recording, voyeurism, extortion, or a Safe Spaces Act violation—more directly applicable?

Being hurt, embarrassed, or criticized is not by itself enough. The complaint must address every legal element.

2. Identify the proper filing place

Cybercrime cases fall within the jurisdiction of the Regional Trial Court and are handled by designated cybercrime courts. Under Section 2.1 of the Rule on Cybercrime Warrants, venue may lie in the province or city:

where the offense or any element was committed;
where any part of the computer system used was situated; or
where damage to a natural or juridical person occurred.

The criminal complaint ordinarily begins with the city or provincial prosecution office having territorial authority over the selected venue. Do not assume that the complaint may be filed anywhere the internet is accessible. The complaint and eventual Information should contain facts supporting the chosen venue.

For an anonymous account, disputed authorship, cross-border evidence, or platform records that require compulsory process, the complainant may first seek investigative assistance from the NBI Cybercrime Division or the PNP cybercrime unit. Republic Act No. 10175 designates the NBI and PNP as its principal law-enforcement authorities. An investigative report, however, is not a substitute for ensuring that a timely formal complaint is filed with the proper prosecution office.

3. Prepare a complete complaint-affidavit

The complaint-affidavit should be sworn and based on personal knowledge. It should clearly state:

the identities and addresses of the parties, if known;
the exact statement complained of;
the account, website, platform, group, or channel where it appeared;
the publication and discovery dates;
how the respondent is connected to the account or publication;
why the complainant was identifiable;
who else saw or received the material;
why the statement is defamatory and malicious;
facts supporting venue; and
the relief or prosecution requested.

Attach authenticated or properly identified supporting evidence, witness affidavits, the DOJ Investigation Data Form, and the copies required by the receiving office. Check the prosecution office’s current filing checklist before submission because administrative requirements and permitted electronic channels may vary.

4. Expect case assessment and preliminary investigation

Under the current DOJ-National Prosecution Service rules, the prosecution office first checks the sufficiency of the complaint and completeness of the evidence. The governing standard is prima facie evidence with reasonable certainty of conviction: the available evidence must be admissible, credible, capable of preservation and presentation at trial, and sufficient—if left uncontradicted—to establish every element and the responsible person’s identity.

If the complaint proceeds, the investigating prosecutor issues a subpoena with the complaint and supporting documents. The respondent is given the date for filing a counter-affidavit, with at least ten calendar days from receipt under the regular preliminary-investigation procedure. The prosecutor may conduct clarificatory proceedings or require further affidavits when permitted by the rules.

If the evidence meets the required standard, an Information is filed in the designated cybercrime court. Otherwise, the complaint is dismissed.

5. Use post-resolution remedies promptly

Under the 2024 DOJ-NPS rules, an aggrieved party may generally file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review may also be available under the applicable DOJ rules, depending on which prosecutor issued the decision and which court has jurisdiction.

These remedies do not justify ignoring an already-filed court case. A motion for reconsideration or petition for review does not necessarily suspend court proceedings automatically. Counsel should determine whether a separate motion to suspend proceedings is required.

How to defend against a complaint

1. Do not ignore the subpoena

Record the date, time, and manner of service. Verify that the subpoena came from the stated prosecution office and confirm the filing deadline. Obtain a complete copy of:

the complaint-affidavit;
all witness affidavits;
screenshots and digital exhibits;
investigative reports; and
every other supporting attachment.

If attachments are missing or the records are unusually voluminous, raise the issue immediately through the proper procedure. Do not assume an extension will be granted.

Failure to submit a counter-affidavit allows the prosecutor to resolve the case from the complainant’s evidence. A counter-affidavit also cannot safely be replaced by an unsworn letter, public post, or private message to the complainant.

2. Preserve the defense evidence

Archive the account and relevant material before changing or deleting anything. Preserve:

account-access records and security alerts;
proof that the account was hacked, impersonated, or controlled by someone else;
drafts, source materials, interview notes, official records, and fact-checking work;
the complete conversation or thread;
privacy and audience settings;
communications showing good faith, verification, correction, or retraction;
documents supporting truth, privilege, fair reporting, or legitimate purpose;
evidence that no third person received the statement; and
proof concerning the complainant’s actual discovery date.

Deletion does not necessarily end liability and may remove evidence needed for the defense. After preserving the material, obtain advice on whether a takedown, correction, or retraction is appropriate.

3. Address every element in the counter-affidavit

The counter-affidavit should be sworn, fact-specific, and supported by admissible evidence. Potential defenses include:

No defamatory imputation

The statement, read fairly and in context, did not accuse the complainant of a discreditable fact. It may have been criticism, rhetorical exaggeration, satire, or language not reasonably understood as a factual accusation. This is highly context-dependent.

No identification

The material did not name the complainant, and readers could not reasonably identify the complainant from the surrounding circumstances. Merely believing that a vague statement referred to oneself does not establish this element.

No publication to a third person

A statement communicated only to the person concerned ordinarily lacks the publication element. A group message or copied email is different because other recipients may constitute third persons.

No authorship or account attribution

A profile name or screenshot alone may not establish who operated an account at the relevant time. The defense may challenge the authenticity, completeness, or lawful acquisition of the digital evidence and present proof of impersonation, unauthorized access, shared administration, or another operator.

The respondent merely reacted or shared

Under Disini, a person who merely receives and reacts to an existing post cannot be convicted as an aider or abettor of cyber libel. But this does not protect a person who authors a new defamatory caption, comment, edit, or accusation.

Privileged communication

Article 354 of the Revised Penal Code recognizes qualified privileges, including:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without added comments or remarks, of qualifying official proceedings or acts of public officers.

Qualified privilege is not automatic immunity. The communication must remain within the occasion, audience, purpose, and conditions of the privilege. Proof of actual malice can defeat it.

Public officer or public figure; no actual malice

When the alleged defamation concerns a public officer’s official conduct or a public figure in a matter of public interest, the prosecution must prove actual malice beyond reasonable doubt—knowledge of falsity or reckless disregard for whether the statement was true or false. Careful verification, reliance on reliable records, attempts to obtain the subject’s side, and an honest public-interest purpose may be relevant. Repeating an unverified accusation from an unnamed source is not automatically protected.

Truth, good motives, and justifiable ends

Truth is not a universal stand-alone defense under Philippine criminal libel law. Article 361 specifically governs when proof of truth is admissible and requires, in the covered situations, both truth and publication with good motives and justifiable ends. Its application depends on the kind of imputation and the complainant’s status or official duties.

Prescription

The defense may show that the complainant, authorities, or their agents discovered the material more than one year before the proper complaint was filed. Preserve evidence of earlier reactions, correspondence, demands, prior complaints, meetings, or public statements demonstrating knowledge.

Improper venue or defective charge

Venue facts must connect the case to the prosecution office and designated cybercrime court selected. Counsel should also examine whether the Information alleges every element, whether the accused is being charged twice for the same identical publication, and whether procedural objections must be raised before plea.

4. If an Information has already been filed

Once the case reaches court:

do not ignore a summons, order, or warrant;
consult criminal counsel about voluntary appearance, surrender, and bail;
determine which objections must be raised before arraignment or plea;
preserve the right to challenge unlawfully obtained or unauthenticated digital evidence;
attend every scheduled hearing; and
avoid contacting or intimidating the complainant or witnesses.

Bail is generally a matter of right before conviction in this type of non-capital case, but its amount and conditions are fixed by the court. Never rely on an unofficial promise that the warrant or case has been withdrawn.

Penalties and civil exposure

Article 355, as amended by Republic Act No. 10951, provides for traditional libel a penalty of imprisonment, a fine, or both. Section 6 of Republic Act No. 10175 raises the applicable penalty by one degree when libel is committed through ICT.

For cyber libel, the prescribed imprisonment is prisión correccional in its maximum period to prisión mayor in its minimum period, approximately four years, two months and one day up to eight years, subject to the rules governing the actual sentence.

In People v. Soliman, the Supreme Court held that a court may impose a fine instead of imprisonment. The current fine range for cyber libel is ₱40,000 to ₱1,500,000. Supreme Court Administrative Circular No. 08-2008 establishes a preference for a fine alone in appropriate libel cases, but it does not abolish imprisonment. The court retains discretion to impose imprisonment, a fine, or both based on the circumstances.

A conviction or civil action may also result in damages. When a criminal action is instituted, the civil liability arising from the offense is generally deemed included unless it is waived, reserved for separate filing, or was filed earlier. Article 33 of the Civil Code also recognizes an independent civil action for defamation. The claimant may not recover twice for the same injury.

Common mistakes

Mistakes by complainants

Filing close to the one-year deadline without resolving venue or authorship.
Treating a screenshot as sufficient proof of who controlled an account.
Submitting cropped images without URLs, context, or witness identification.
Naming every person who liked, shared, or received a post.
Assuming falsity alone proves malice.
Ignoring privilege, public-interest context, or public-figure rules.
Reporting only to a platform and assuming prescription has stopped.
Demanding confidential subscriber data directly from a platform without lawful process.
Filing traditional libel and cyber libel charges for the same identical publication.

Mistakes by respondents

Ignoring the subpoena or relying on an informal denial.
Missing the counter-affidavit deadline.
Deleting the account before preserving potentially exculpatory evidence.
Contacting or threatening the complainant or witnesses.
Repeating the accusation in a “defense” post.
Assuming that “opinion,” “satire,” “shared only,” or “someone told me” automatically defeats liability.
Offering truth without evidence of lawful sources, good motive, or justifiable purpose.
Waiting until after arraignment to raise objections that may be waived.
Assuming a retraction or apology automatically dismisses the criminal case.

When legal help is urgent

Seek a Philippine lawyer immediately when:

fewer than 60 days remain before the apparent one-year deadline;
the account is anonymous or platform data may soon disappear;
a subpoena or prosecutor’s resolution has been received;
the counter-affidavit or reconsideration deadline is approaching;
an Information, arrest warrant, or court order has been issued;
several posts, respondents, jurisdictions, or countries are involved;
the complainant is a public officer or public figure;
the publication arose from journalism, whistleblowing, an employment dispute, or an official proceeding;
the material includes private sexual content, minors, doxxing, threats, blackmail, or identity theft; or
the evidence may have been obtained by accessing another person’s device or account.

If there is an immediate threat of violence, extortion, or continuing unlawful exposure of intimate material, contact law enforcement at once. Those circumstances may involve more urgent offenses and protective remedies beyond cyber libel.

Frequently asked questions

Is a demand letter required before filing?

No general provision of the cyber-libel law requires a demand letter before a criminal complaint. A demand, correction request, or opportunity to respond may nevertheless affect evidence of discovery, good faith, mitigation, or malice.

Does deleting the post prevent a case?

No. Deletion does not erase an offense that was already published, provided the prosecution can prove the publication and its contents. Preserve the evidence before seeking removal.

Is a true statement automatically protected?

No. Article 361 imposes specific conditions on the use and effect of truth in criminal libel. The statement’s subject, the complainant’s status, the publisher’s motives, and whether the ends were justifiable all matter.

Can someone be charged for merely liking or sharing a post?

A person who simply receives and reacts to another’s post cannot be prosecuted as an aider or abettor of cyber libel under Disini. A person who adds a new defamatory caption, comment, edit, or accusation may be liable as the author of that separate material.

Can a private message be cyber libel?

A message sent only to the person discussed ordinarily lacks publication to a third person. If it is sent to other people, copied to others, or posted in a group, the publication element may be present.

Can an anonymous account be investigated?

Yes. NBI or PNP cybercrime investigators may seek preservation and, when legally justified, court-authorized disclosure of subscriber or traffic data. Platform data does not necessarily identify the actual operator conclusively, so corroborating evidence remains important.

Does a retraction or apology end the case?

Not automatically. It may be relevant to mitigation, damages, good faith, settlement discussions, or prosecutorial assessment, but dismissal of a criminal case is not solely within the private complainant’s control once the State has commenced prosecution.

Where can investigative assistance be requested?

The NBI Cybercrime Division accepts requests for investigation and sworn complaints. Cybercrime incidents may also be reported through the DOJ Office of Cybercrime or the appropriate PNP cybercrime unit. Confirm current office locations and filing requirements directly with the agency.

Official legal sources

This article provides general legal information, not legal advice or an attorney-client relationship. Cyber-libel outcomes depend on the exact words, context, evidence, authorship, discovery date, venue, and procedural history. The law and official sources were checked through August 4, 2026.