Quick answer

Cyber libel is generally committed when a person publishes through a computer system an identifiable and defamatory imputation, with the required malice, and a third person sees or receives it. It is punishable under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, read with Articles 353 and 355 of the Revised Penal Code.

If you are the complainant, preserve the post and related electronic evidence immediately, identify the author and witnesses, and file a properly supported complaint-affidavit with the prosecution office that has territorial jurisdiction. Reporting first to the NBI Cybercrime Division or the PNP Anti-Cybercrime Group may help when authorship, account ownership, or technical records must be investigated, but a police or NBI report is not always a prerequisite to filing with the prosecutor.

If you are accused, do not ignore a subpoena or casually answer the accusation online. Preserve the complete context, obtain the complaint and attachments, note the deadline for your counter-affidavit, and have counsel examine authorship, publication, identification, defamatory meaning, malice, privileged communication, truth, venue, prescription, and constitutional protections.

Time is critical. The Supreme Court has held that cyber libel ordinarily prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to rules on interruption and fact-specific disputes over when discovery occurred. Filing should not be delayed while waiting for a platform to respond or for the post to be deleted. See Causing v. People, G.R. No. 258524 and the Supreme Court’s official case summary.

What must generally be proved

A cyber-libel prosecution normally requires proof of the traditional elements of libel together with use of a computer system:

A defamatory imputation. The statement attributes a crime, vice, defect, real or imaginary condition, status, act, omission, or circumstance tending to dishonor, discredit, or expose a person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the statement. A private message sent only to the subject may fail this element, although forwarding it to someone else can change the analysis.
Identification. The complainant must be identifiable from the words, images, surrounding facts, or circumstances. A name is not always necessary, but a statement about a large or indefinite group may not sufficiently identify an individual.
Malice. Article 354 generally presumes malice from a defamatory imputation unless the communication falls within a recognized exception. Constitutional protections may require proof of actual malice—knowledge of falsity or reckless disregard for truth—where the statement concerns a public official or public figure and a matter of public concern.
Authorship or legally attributable participation. The prosecution must connect the accused to the creation and publication of the particular defamatory content.
Use of information and communications technology. The publication was made through a computer system or comparable online technology, such as a social-media post, website, online article, email, or internet-based message.

The prosecution must ultimately prove guilt beyond reasonable doubt. At the prosecutor level, the governing DOJ standard is whether the evidence establishes a prima facie case with reasonable certainty of conviction under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings.

Not every offensive online statement is cyber libel

Rudeness, criticism, satire, exaggeration, or an unpopular opinion is not automatically criminal. Courts examine the words in their entire setting, including the audience, language used, accompanying images, conversation, and whether a reasonable reader would understand the statement as asserting a discreditable fact about the complainant.

Important distinctions include:

Fact versus opinion. A statement that can reasonably be understood as asserting a provably false fact carries greater risk. Pure opinion may be protected, but attaching “in my opinion” does not shield a disguised factual accusation.
Public concern versus private attack. Robust criticism of government and public officials receives strong constitutional protection. That protection does not create a license to knowingly publish false factual accusations.
The subject’s feelings versus legal defamation. Embarrassment or anger alone does not establish all elements of libel.
A private complaint versus public shaming. A good-faith report made to a person with a corresponding duty or legitimate interest may be privileged. Broadcasting the same accusation to an unnecessary audience may not be.
Quoting or repeating another person. Repeating, captioning, or adopting a defamatory allegation can create exposure even when the publisher was not the original source.

Likes, shares, comments, and reposts

In Disini v. Secretary of Justice, G.R. No. 203335, the Supreme Court sustained the cyber-libel provision as applied to the original author but rejected, in that challenge, extending liability through the Cybercrime Prevention Act’s general aiding-or-abetting clause to people who merely receive, react to, or share a post.

That does not mean every repost or comment is automatically safe. A person who adds a new defamatory caption, materially alters the content, presents the allegation as their own, or independently republishes defamatory matter may be evaluated as an author or publisher of that new statement. Liability depends on the precise act charged and the evidence, not merely the platform’s label for a “share,” “repost,” or “comment.”

Possible defenses and exceptions

No defamatory imputation

Read the exact words—not a paraphrase supplied in the complaint. Ambiguous language, rhetorical criticism, parody, or statements incapable of a defamatory meaning may not satisfy Article 353.

The complainant was not identifiable

The prosecution must show that readers could reasonably connect the statement to the complainant. Evidence may include tags, photographs, job descriptions, nicknames, prior posts, or testimony from people who understood the reference.

No publication to a third person

Publication requires communication beyond the person allegedly defamed. Check recipient lists, group membership, privacy settings, access logs, and testimony from supposed readers.

Lack of authorship or account attribution

An account name or screenshot alone does not necessarily prove who composed or uploaded a post. Relevant issues may include account access, device possession, impersonation, hacking, editing history, and admissible platform or telecommunications records.

Do not fabricate a hacking claim, delete account records, or alter a device. If unauthorized access genuinely occurred, preserve security alerts, login history, password-reset notices, device lists, and reports made promptly to the platform or authorities.

Privileged communication

Article 354 recognizes qualified exceptions, including:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of specified official proceedings or acts.

Privilege is not automatic merely because a statement was sent to an employer, barangay official, regulator, journalist, or government office. The recipient’s duty or interest, the scope of publication, good faith, and unnecessary publicity matter. Qualified privilege may be defeated by proof of actual malice.

Truth, good motives, and justifiable ends

Truth can be important but is not a universal, stand-alone answer to every libel charge. Article 361 regulates proof of truth and may also require good motives and justifiable ends, depending on the imputation and circumstances. Preserve the reliable records and sources actually available when the statement was published; material assembled only after publication may not establish the publisher’s original good faith.

Fair criticism and constitutional protection

Criticism of official conduct, public affairs, and matters of legitimate public concern receives substantial protection. Courts distinguish protected criticism from false factual imputations made with actual malice. The speaker’s sources, verification efforts, wording, and response to known contradictions may be important.

Prescription

Under the Supreme Court’s controlling ruling in Causing, cyber libel generally prescribes in one year from discovery by the offended party, the authorities, or their agents. Publication and discovery may occur on the same day, but that should not be assumed.

Prescription can involve disputed facts and rules on interruption. Unless prescription is evident from the face of the Information, the accused may need to prove the relevant discovery date and procedural chronology. Preserve evidence showing when the complainant first knew of the post, including replies, messages, takedown demands, reports, and earlier complaints.

The law was not yet effective

Applying the cyber-libel law to a publication made before the law took effect raises the constitutional prohibition against ex post facto laws. Whether an later edit or republication constitutes a new publication is highly fact-sensitive and should be assessed from the actual online record.

Double jeopardy or duplicative punishment

The Supreme Court has characterized ordinary libel and cyber libel as the same underlying offense committed through different means. Identical material should not be used to impose separate punishment for ordinary libel and cyber libel contrary to double-jeopardy protections. Different statements, publication dates, or acts require separate analysis.

How to prepare and file a complaint

1. Preserve the complete publication

Capture more than the insulting sentence. Preserve:

the full post, article, video, message, or thread;
the account name, profile page, and visible account identifiers;
the exact URL or permalink;
publication date and time, including the time zone if relevant;
comments, captions, tags, images, edits, and quoted material;
the audience, group name, recipient list, or privacy setting;
visible reactions, shares, or view information;
the device’s date and time when the capture was made;
the surrounding discussion needed to understand context; and
any takedown, apology, correction, threat, or admission.

Take screenshots and, where possible, save the original webpage, message export, video, audio, email headers, and unedited files. Keep an untouched copy. Record who collected each item and when. Do not crop away details that may later be needed for authentication.

A screen recording can show how the page was reached, but it should supplement—not replace—clear captures and original electronic records.

2. Identify proof of publication and identification

List people who personally saw the material and understood it to refer to the complainant. Their sworn statements may help prove publication, identification, date of discovery, and reputational effect.

Do not coach witnesses or ask them to exaggerate. A witness should distinguish what they personally saw from what another person told them.

3. Preserve proof connecting the respondent to the post

Useful evidence may include:

admissions in messages or public statements;
consistent account history and linked contact details;
eyewitness knowledge of who operated the account;
prior or later posts acknowledging authorship;
device or platform records lawfully obtained; and
business, employment, or editorial records showing responsibility for publication.

Private parties should not hack accounts, secretly seize devices, or impersonate another person to obtain evidence. Subscriber information and protected computer data may require lawful process under the Rule on Cybercrime Warrants.

4. Determine the proper prosecution office

Venue is jurisdictional in criminal libel cases. It cannot safely be based on the theory that an online post was “published everywhere.” The complaint should state concrete facts establishing why a particular city or provincial prosecution office—and ultimately a particular trial court—has territorial jurisdiction.

Residence, the complainant’s status as a public officer or private individual, the place of first publication, and allegations in the eventual Information may matter under Article 360 of the Revised Penal Code. Online-publication questions can be technically and legally difficult. Filing in the wrong place can cause dismissal or delay while prescription continues to be disputed.

5. Prepare a sworn complaint-affidavit

The affidavit should set out, from personal knowledge and in chronological order:

the identities and addresses of the parties, as far as known;
the exact defamatory words or content;
where and how the content was published;
why it referred to the complainant;
who saw or received it;
when and how the complainant discovered it;
facts supporting authorship;
why the accusation was false or malicious;
the facts establishing venue; and
the relief requested.

Attach legible, labeled exhibits and affidavits from material witnesses. Avoid conclusions such as “the post was obviously cyber libel” without the supporting facts.

Before filing, obtain the current checklist, number of copies, accepted file format, office hours, and any electronic-filing instructions directly from the relevant prosecution office. Electronic submission may not eliminate requirements for sworn originals or hard copies.

6. Consider an NBI or PNP cybercrime investigation

An investigation may be especially useful when the poster is anonymous, an account may be fake, technical attribution is disputed, or volatile provider records must be preserved. Contact the official NBI or PNP Anti-Cybercrime Group through its currently published channels.

Law-enforcement involvement does not guarantee that a platform will still possess the needed records. Providers apply different retention rules, and disclosure may require a warrant or other lawful process.

7. Monitor the prosecutor proceedings

If the complaint is sufficient, the prosecutor may issue a subpoena requiring the respondent to submit a counter-affidavit and supporting evidence. The prosecutor may request additional evidence or clarification and will determine whether the governing evidentiary standard is met.

Calendar every deadline from actual receipt of the subpoena, order, or resolution. Do not rely on an assumed number of days: the applicable DOJ rule, type of investigation, method of service, and specific directive must be checked from the document received.

How to respond if you are accused

Obtain the complete record

Secure a copy of the complaint-affidavit, exhibits, subpoena, proof of service, and docket information. Compare the attached screenshots with any original records in your possession. Note omissions, edits, cropped context, inconsistent dates, and unsupported claims.

Preserve—do not destroy—evidence

Keep the device, account data, drafts, messages, source materials, publication logs, and security notifications. Turning a post private or removing continuing harm may be sensible in some situations, but first preserve an authentic copy and obtain legal advice. Deletion can destroy favorable context and may be portrayed as concealment; leaving a harmful post online can create other risks.

Do not give an improvised statement

You have the right to remain silent and to counsel. Do not sign a police, NBI, barangay, employer, or platform statement you do not understand. A casual explanation may supply missing proof of authorship or intent.

This does not prevent a carefully considered correction, apology, or settlement discussion. Those steps should be planned with counsel because wording can affect criminal, civil, employment, or professional proceedings.

Prepare a fact-based counter-affidavit

A strong counter-affidavit answers each element and authenticates the defense evidence. Depending on the facts, it may address:

the exact meaning and complete context;
non-identification of the complainant;
lack of third-party publication;
disputed authorship;
account compromise;
protected opinion or fair criticism;
qualified privilege;
truth, sources, verification, and good faith;
lack of actual malice;
defective venue;
prescription;
pre-effectivity publication;
duplicative charges; or
unlawful or unreliable electronic evidence.

A counter-affidavit is not a social-media rebuttal. Avoid insults, new accusations, speculation, and unnecessary admissions.

File on time and retain proof

Follow the subpoena and prosecution office’s filing instructions exactly. Obtain a stamped receiving copy, electronic acknowledgment, or other official proof of timely filing. If more time is genuinely necessary, request it before the deadline; an extension is not effective merely because it was requested.

Review the prosecutor’s resolution promptly

A resolution may allow a motion for reconsideration or review under applicable DOJ rules, subject to short and strictly applied periods. Obtain the complete resolution and proof of the date it was received. A review request does not always stop court proceedings or automatically suspend arraignment.

If an Information is filed in court

Cyber-libel cases are tried in a Regional Trial Court with the required territorial jurisdiction and cybercrime authority. Once the Information is filed:

the court independently evaluates probable cause for issuing process;
the accused may need to post bail if a warrant is issued;
objections that must be raised before plea should be reviewed immediately;
arraignment is followed by pretrial and, if unresolved, trial; and
guilt must be proved beyond reasonable doubt with admissible evidence.

A motion to quash may be available for grounds such as lack of jurisdiction, failure of the alleged facts to constitute an offense, extinction of criminal liability through prescription, or double jeopardy. Many objections can be waived if not raised before plea, although the Rules of Criminal Procedure preserve specified exceptions. Do not enter a plea without counsel reviewing the Information, its venue allegations, dates, and the available objections.

Penalties and civil liability

Because the use of information and communications technology raises the prescribed penalty by one degree under Section 6 of the Cybercrime Prevention Act, cyber libel carries more severe exposure than ordinary written libel. The precise range depends on the charging provision, the Revised Penal Code’s rules on graduation and application of penalties, mitigating or aggravating circumstances, and current sentencing law.

Courts have recognized a policy favoring fines over imprisonment in appropriate libel cases, but a fine is not guaranteed. See Supreme Court Administrative Circular No. 08-2008. A conviction may also include civil liability and consequential effects on employment, licenses, travel, reputation, and professional standing.

A person harmed by defamation may pursue civil remedies under provisions such as Articles 19, 20, 21, 26, and 33 of the Civil Code. Whether a civil claim is impliedly included in the criminal case, reserved, waived, or separately filed is governed by Rule 111 of the Rules of Criminal Procedure. Civil claims have their own elements, limitation periods, filing fees, venue rules, and evidentiary requirements.

Corrections, takedowns, apologies, and settlement

A prompt correction or apology does not automatically erase an already completed offense. It may nevertheless reduce harm, support good faith, affect damages or penalty, or make a negotiated resolution possible.

Before sending a demand or response:

identify the exact content complained of;
preserve it before requesting removal;
state corrections accurately;
avoid threats unsupported by law;
do not demand money in a manner that could itself create legal exposure; and
consider whether continued public exchanges will amplify the allegation.

The private complainant cannot always end a criminal prosecution simply by withdrawing the complaint. Once an offense is being prosecuted, control of the criminal case belongs to the State, although an affidavit of desistance or settlement may be considered depending on the stage and circumstances.

Evidence checklist

Preserve the following in original or native form whenever possible:

screenshots showing the full screen, URL, account, date, and time;
webpage, email, chat, and account exports;
original photographs, recordings, and videos with metadata;
complete threads and preceding conversations;
edit histories and archived versions lawfully obtained;
account login and security records;
takedown requests and platform responses;
names and contact details of people who saw the post;
proof of the complainant’s first discovery;
source documents relied on before publication;
notes showing verification efforts;
admissions, corrections, apologies, or threats;
police, NBI, barangay, employer, or regulatory reports; and
proof of filing, service, and receipt of every pleading or order.

Keep a working copy separate from the untouched original. Document transfers of devices and files. Electronic evidence must still be authenticated and shown to be reliable under the Rules on Electronic Evidence.

Common mistakes

Waiting for the post to go viral before preserving or filing evidence.
Counting one year only from publication without examining the discovery date.
Filing in the most convenient city without establishing statutory venue.
Submitting cropped screenshots that omit the URL, author, date, audience, or context.
Assuming an account name conclusively proves the human author.
Treating every insult or negative review as criminal defamation.
Believing truth always defeats liability without examining motive, privilege, and Article 361.
Assuming “private group” or “private account” means there was no publication.
Assuming a disclaimer such as “allegedly,” “for awareness,” or “no offense intended” neutralizes a factual accusation.
Repeating the accusation in demand letters or public rebuttals more broadly than necessary.
Ignoring a prosecutor’s subpoena or missing the counter-affidavit deadline.
Deleting devices, messages, accounts, or source materials.
Contacting witnesses to coordinate their versions.
Believing a takedown, apology, or affidavit of desistance automatically terminates the case.
Waiting until arraignment to investigate prescription, venue, or defects in the Information.

When legal help is urgent

Seek a Philippine lawyer immediately if:

the one-year prescriptive period may expire soon;
you received a subpoena, resolution, Information, summons, or warrant;
arraignment or a prosecutor deadline is approaching;
the respondent is anonymous or platform records may disappear;
police or investigators want to inspect or seize a device;
the accusation concerns a public official, journalist, election, or matter of public concern;
the same material is charged as both ordinary libel and cyber libel;
there are multiple posts, edits, reposts, or publication dates;
the content involves minors, intimate images, threats, stalking, extortion, or doxxing;
the parties are in different cities or countries;
employment, professional-license, or regulatory proceedings are also threatened; or
a settlement demand includes money, a public confession, confidentiality, or a broad waiver.

The Integrated Bar of the Philippines and the Public Attorney’s Office may be possible starting points for qualified legal assistance, subject to their rules and eligibility requirements.

Frequently asked questions

How long do I have to file a cyber-libel complaint?

Generally, one year from discovery of the alleged cyber libel by the offended party, authorities, or their agents. The discovery date and interruption of prescription can be disputed, so file promptly rather than treating the last day as a safe target.

Does deleting the post prevent a case?

No. Publication may already be complete, and another person may have preserved the content. Deletion can also remove evidence of context. Preserve an authentic copy and obtain advice before changing the account or post.

Can an anonymous account be charged?

Potentially, but the person behind the account must be identified with admissible evidence. Prompt investigation may be necessary because subscriber, login, and device records may be unavailable without legal process or may not be retained indefinitely.

Is a screenshot enough?

It can be evidence, but its weight depends on completeness, authenticity, context, and attribution. Original electronic records, witness testimony, URLs, metadata, and lawfully obtained account information can strengthen or undermine it.

Is a private group chat covered?

It can be. Publication exists if a defamatory statement is communicated to at least one person other than the subject. Privacy settings may affect context, expectation, privilege, or damages, but do not automatically eliminate publication.

Can I be charged merely for liking or sharing a post?

A mere reaction or passive share is not automatically cyber libel under Disini. Liability becomes more plausible if you create or adopt a new defamatory statement, add a defamatory caption, materially alter the content, or independently republish it. The exact act and charge matter.

Can I sue a page administrator or company?

Status as an administrator, officer, editor, or employer does not by itself establish criminal liability. The evidence must connect a natural person to the charged publication and the required mental state. Corporate and civil responsibility may involve different rules.

Does proving the accusation true automatically win the case?

Not necessarily. The admissibility and legal effect of truth depend on Article 361, the nature of the imputation, good motives, justifiable ends, and other circumstances. Reliable proof and the publisher’s basis at the time of publication are critical.

Can the complainant withdraw the case?

The complainant may submit an affidavit of desistance or enter a lawful settlement, but cannot guarantee dismissal of a public criminal action. The prosecutor or court determines the legal effect.

Is an apology an admission?

It may be offered as evidence depending on its wording and context, but an apology is not automatically conclusive proof of every element. Have proposed corrective language reviewed before publication or signing.

Can cyber libel apply to a post made outside the Philippines?

Potentially, but Philippine jurisdiction, territorial venue, the location of relevant acts, the parties’ residence or official station, service, and evidence collection must be established. Cross-border cases require individualized advice.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel disputes turn heavily on the exact words, complete online context, evidence, dates, venue, and procedural record. Official sources were checked as of 14 September 2026.