Quick answer

Cyber libel is committed when a person publishes through a computer system a defamatory statement that identifies another person or organization and is legally malicious. A Facebook post, X post, blog entry, online article, video caption, email circulated to third persons, or similar digital publication may qualify. A private message seen only by the person criticized ordinarily lacks the required publication to a third person.

To file a case, preserve the complete digital evidence immediately, identify when and how the post was discovered, and submit a sworn complaint with supporting evidence to the proper city or provincial prosecutor. The NBI Cybercrime Division or PNP Anti-Cybercrime Group may assist with investigation and digital evidence.

To defend a case, do not ignore the prosecutor’s subpoena. Obtain the complaint and attachments, preserve—not alter—your accounts and records, and file a sworn, evidence-supported counter-affidavit by the stated deadline. Possible defenses include failure to prove authorship, identification, publication, defamatory meaning, or malice; privileged communication; protected fair comment on a matter of public interest; and prescription.

The current Supreme Court rule is especially important: cyber libel prescribes in one year from discovery of the allegedly defamatory publication by the offended party, the authorities, or their agents. Filing the complaint or information interrupts prescription. The discovery date and any interruption are factual matters that must be proved; the posting date is not automatically the controlling date. (lawphil.net)

What the prosecution must prove

Section 4(c)(4) of Republic Act No. 10175 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or a similar future technology. The prosecution must establish every element beyond reasonable doubt:

Defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the statement.
Identification. The complainant is named or is sufficiently identifiable from the words, images, context, or surrounding circumstances. Naming someone is not indispensable, but evidence—not guesswork—must connect the statement to that person.
Malice. As a general rule involving a private complainant, a defamatory imputation is presumed malicious unless it falls within a recognized privilege. Different rules apply to privileged communications and speech involving public officials, public figures, or matters of public interest.
Use of a computer system or information and communications technology. The prosecution must connect the publication to the relevant online account, device, platform, or other digital means.

The Supreme Court summarizes the traditional elements as defamatory imputation, publication, identity, and malice. (lawphil.net) Cyber libel uses those elements but adds publication through a computer system or ICT. (lawphil.net)

An offensive, rude, sarcastic, or embarrassing statement is not automatically criminal. Courts examine the words as a whole, their ordinary meaning, context, audience, and surrounding circumstances. A case may also fail where the post expresses protected opinion rather than a provably defamatory factual assertion, although simply labeling an accusation “opinion” does not make it immune.

Malice, truth, public officials, and privileged communications

The general rule

Article 354 of the Revised Penal Code generally presumes malice from a defamatory imputation, even if the statement is true, unless the communication is privileged. Truth is therefore not an automatic, all-purpose defense. Under Article 361, proof of truth must be considered together with good motives and justifiable ends, subject to the article’s particular rules.

Public officials, public figures, and public-interest speech

Where the complainant is a public official or public figure and the statement concerns public conduct or a legitimate matter of public interest, the prosecution must prove actual malice: that the accused knew the statement was false or acted with reckless disregard of whether it was true.

Mere mistake or negligence is not necessarily enough. Reckless disregard requires evidence that the publisher entertained serious doubts about the truth or had a high degree of awareness of probable falsity. The prosecution bears this burden beyond reasonable doubt. (lawphil.net)

This protection is not a license to invent accusations. Fabricating facts, ignoring obvious contrary evidence, relying on a source known to be unreliable, or publishing despite serious doubts may support a finding of actual malice.

Privileged communications

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of specified official proceedings or acts of public officers, subject to the statutory conditions.

Fair comment on matters of public interest may also receive constitutional protection. A qualified privilege removes the ordinary presumption of malice, but it does not provide absolute immunity: liability may remain if actual malice is proved. (lawphil.net)

Whether a communication is privileged is highly fact-dependent. Its recipients, purpose, wording, source, factual basis, and relevance to the duty or public issue all matter.

Who may be liable online

The Supreme Court upheld cyber-libel liability as applied to the original author of the online post. In Disini v. Secretary of Justice, it did not sustain the use of Section 5’s general aiding-or-abetting provision to criminalize the ordinary reactions of readers who merely clicked “Like,” commented on, or shared the original post. (lawphil.net)

That does not mean every repost or comment is automatically safe. A person who writes a new defamatory accusation, adds defamatory material, or independently republishes content may be assessed based on that person’s own words and conduct. Liability should not be assumed merely from the platform’s label—“share,” “repost,” or “comment.” The actual content and evidence of authorship and publication control.

Account ownership alone may not conclusively prove authorship. Relevant issues can include unauthorized access, impersonation, account sharing, device access, metadata, platform records, admissions, and witness testimony.

The one-year deadline

Cyber libel has a one-year prescriptive period under Articles 90 and 91 of the Revised Penal Code. In its April 8, 2026 resolution in Causing v. People, the Supreme Court sitting en banc maintained that rule. (lawphil.net)

The period:

Begins when the allegedly defamatory matter is discovered by the offended party, the authorities, or their agents;
Is interrupted by the filing of the complaint or information;
May begin running again if the proceeding ends without conviction or acquittal, or is unjustifiably stopped for a reason not attributable to the accused; and
Does not run while the offender is absent from the Philippines, under Article 91.

Do not assume that the visible posting date proves either timeliness or prescription. Preserve evidence of the actual discovery date: messages forwarding the post, emails, affidavits, access logs, screenshots with timestamps, or testimony from the first persons who alerted the complainant.

If prescription is not apparent from the information, the accused generally bears the burden of presenting evidence for that defense. (lawphil.net) Because one year can expire quickly, both sides should obtain legal advice immediately.

A separate civil action for defamation generally also has a one-year prescriptive period under Article 1147 of the Civil Code, but its accrual, interruption, legal basis, and interaction with the criminal case require separate analysis.

How to file a complaint

1. Preserve the original evidence

Before reporting, blocking the account, requesting takedown, or engaging with the publisher, preserve:

Full-page screenshots showing the post, account name, date, time, reactions, comments, and surrounding context;
The exact URL or platform link;
Screen recordings showing navigation from the profile to the post;
Original image, audio, or video files;
Messages or emails through which the post was sent;
Names and contact details of people who saw it;
Evidence connecting the account or device to the suspected author;
The date and circumstances of discovery;
Prior exchanges that explain identity, motive, meaning, or malice; and
Evidence of harm, such as lost work, cancelled contracts, customer messages, medical records, or reasonable expenses.

Keep original files. Do not crop, annotate, compress, rename, or repeatedly forward the only copy. Make working copies and record who collected each item, when, from what device, and how.

A screenshot is useful but may be challenged as incomplete or manipulated. Corroborate it with URLs, witnesses, source files, admissions, platform records, or lawful forensic examination. Do not obtain evidence by hacking an account, stealing a device, or unlawfully recording or accessing private communications.

2. Identify the proper respondent and legal theory

Distinguish the original author from page administrators, editors, employees, account owners, commenters, and people who merely reacted. State the particular act and evidence attributable to each respondent. Avoid naming everyone associated with a page without evidence of participation.

Quote or reproduce the exact words complained of, identify the post, explain why the complainant is identifiable, name persons who received it, and state when it was discovered.

3. Determine the proper venue

Cybercrime cases are tried in a designated cybercrime Regional Trial Court in the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of other courts. (lawphil.net)

Venue is jurisdictional in a criminal case. Do not rely only on the fact that a post could be viewed everywhere. The complaint should allege and support concrete venue facts, including the relevant place of publication, computer-system location, or damage.

4. Prepare the sworn complaint

File with the appropriate Office of the City Prosecutor, Office of the Provincial Prosecutor, or other authorized DOJ prosecution office. A typical filing includes:

The completed NPS Investigation Data Form;
A complaint-affidavit based on personal knowledge;
Supporting witness affidavits;
The preserved online material and other documentary or electronic evidence;
Copies for each respondent;
Valid identification and required certifications; and
Applicable filing fees and any locally required copies or media.

The complaint should set out facts, not merely conclusions such as “the post is libelous.” Explain each element and attach the evidence supporting it.

The DOJ’s official preliminary-investigation page lists current documentary requirements. Confirm filing hours, copies, fees, and any authorized electronic-filing procedure directly with the receiving prosecution office before filing.

5. Consider investigative assistance

For evidence preservation, attribution, or forensic assistance, a complainant may approach the NBI Cybercrime Division or the PNP Anti-Cybercrime Group. The NBI’s published procedure requires completion and submission of its complaint form to the division. (National Bureau of Investigation)

Reporting to an investigator is not a safe substitute for ensuring that the legally effective complaint is filed within the prescriptive period. Ask in writing what filing, if any, interrupts prescription in the specific circumstances.

6. Address civil damages carefully

When a criminal action is instituted, the civil action arising from the offense is generally deemed included unless it was waived, reserved for separate filing, or filed earlier. A reservation must ordinarily be made before the prosecution starts presenting evidence. Independent civil actions may also be available under the Civil Code, but double recovery for the same act is prohibited. (Criminal Proceedure)

Discuss the choice with counsel before filing either case because it affects fees, evidence, timing, and litigation strategy.

How to defend a complaint

1. Treat the subpoena as urgent

Note the date and manner of receipt. The subpoena or prosecutor’s order should state the hearing date and deadline for the counter-affidavit. Follow that specific directive; do not assume that informal discussions, settlement talks, or a takedown suspend the deadline.

The DOJ’s 2024 rules require the prosecution to determine whether the evidence establishes a prima facie case with reasonable certainty of conviction. The prosecutor may dismiss the complaint outright or require a response. These proceedings remain serious even though they are not yet a criminal trial.

2. Obtain the complete record

Secure the complaint-affidavit, witness affidavits, screenshots, URLs, certifications, and every attachment. A fair response is difficult if evidence is missing or illegible. Raise missing service or incomplete records promptly and formally.

3. Preserve potentially favorable evidence

Keep:

Original drafts and full conversation threads;
Research notes and source materials;
Messages with editors, witnesses, or sources;
Records of verification efforts;
Account-login alerts and device records;
Evidence of hacking, impersonation, or shared access;
Unedited audio, video, and photographs;
Documents showing the complainant was not identifiable;
Evidence of limited or nonexistent third-party publication;
Official records supporting a fair report;
Proof of good faith, proper motive, and public interest; and
Evidence concerning the complainant’s actual discovery date.

Do not delete the post, messages, account, or device data solely to make evidence disappear. Deletion may not undo publication and can impair a legitimate defense. If limiting ongoing harm is necessary, preserve a forensically sound copy first and act on counsel’s advice.

4. Build the counter-affidavit element by element

Possible issues include:

The respondent did not author, control, or publish the material;
No third person received it;
The complainant was not named or reasonably identifiable;
The words are not defamatory when read in full context;
The material is protected opinion, satire, rhetorical hyperbole, or fair comment rather than a false factual accusation;
The report is fair, accurate, in good faith, and legally privileged;
The communication was made to proper recipients in the performance of a legal, moral, or social duty;
The subject is a public official, public figure, or matter of public interest, and actual malice cannot be proved;
The evidence is unauthenticated, incomplete, altered, or fails to connect the account to the respondent;
Venue is not adequately alleged or supported;
The charge is prescribed; or
The publication occurred before the relevant penal provision took effect and cannot be punished retroactively.

A denial unsupported by records is rarely the strongest response. Attach admissible documents and witness affidavits, explain the complete context, and address damaging evidence directly.

5. If an information is filed in court

Once the prosecutor files an information, the case proceeds before the designated cybercrime RTC. Counsel should examine the information for defects, including failure to allege every essential element, improper venue, prescription apparent from the allegations, duplication of charges, or lack of jurisdiction.

Possible remedies have strict timing and waiver rules. These may include a motion to quash before plea, arraignment objections, bail where required, motions concerning electronic evidence, trial defenses, and an appeal after judgment. Do not enter a plea, sign a settlement, or miss an arraignment without understanding the consequences.

Penalties and possible outcomes

Article 355, as adjusted by Republic Act No. 10951, provides for ordinary written libel an alternative penalty of imprisonment, a fine ranging from ₱40,000 to ₱1,200,000, or both. Section 6 of Republic Act No. 10175 requires a penalty one degree higher when the crime is committed through ICT. The precise lawful sentence depends on the charging allegations, applicable penalty rules, modifying circumstances, and the court’s findings.

Imprisonment is not inevitable. The Supreme Court has recognized judicial discretion and a preference for a fine alone in appropriate libel cases, without abolishing imprisonment as an authorized penalty. (lawphil.net) In People v. Soliman, the Court sustained the imposition of a fine alone for online libel under the circumstances of that case. (lawphil.net)

A conviction may also carry civil liability. Conversely, dismissal of a criminal complaint does not necessarily resolve every possible civil claim because different causes of action and standards of proof may apply.

Common mistakes

Waiting for a platform response while the one-year period continues to run;
Saving only a cropped screenshot without the URL, account, date, or context;
Assuming truth alone automatically defeats libel;
Treating every insult as cyber libel without analyzing defamatory factual meaning;
Naming page owners, employees, or sharers without evidence of their individual acts;
Filing wherever the post was viewed without establishing legally proper venue;
Guessing the accused’s identity from a display name;
Omitting the discovery date or evidence supporting it;
Publicly repeating the accusation while announcing the lawsuit;
Threatening arrest or demanding money in exchange for silence;
Ignoring a subpoena or filing an unsworn, unsupported response;
Deleting accounts or messages after receiving notice of a complaint; and
Assuming an apology, takedown, or affidavit of desistance automatically ends the State’s prosecution.

When legal help is urgent

Consult a Philippine lawyer immediately if:

The one-year period may expire soon;
A prosecutor’s subpoena, resolution, information, warrant, or court notice has been received;
Police or investigators request a device, password, interview, or sworn statement;
The account may have been hacked or impersonated;
The post concerns a public official, election, corruption allegation, journalist, whistleblower, or confidential source;
A child, intimate image, threat, stalking, identity theft, or data breach is involved;
Several jurisdictions or overseas parties are involved;
The complainant seeks substantial damages or business records;
The respondent faces arrest, bail, arraignment, or trial; or
Settlement terms would require admissions, payment, deletion, confidentiality, or withdrawal of another case.

Indigent qualified persons may ask the Public Attorney’s Office about representation. A complainant may also inquire with the prosecutor’s office, NBI, or PNP about victim-assistance procedures, but agency staff cannot replace independent legal advice.

Frequently asked questions

Is a private message cyber libel?

Not ordinarily if only the sender and the person defamed saw it, because publication to a third person is generally required. A group message, forwarded message, copied email, or message shown to another person may satisfy publication depending on the evidence.

Can a true statement still be libelous?

Potentially. Under the Revised Penal Code, truth is not an absolute defense in every situation. The purpose, good motive, justifiable end, privilege, subject matter, and status of the complainant may be decisive.

Is merely sharing or liking a defamatory post a crime?

A bare “Like,” routine comment, or share is not automatically aiding or abetting cyber libel under Disini. But a person who adds a new defamatory accusation or independently authors defamatory material may face liability for that separate conduct.

Does deleting the post end the case?

No. Deletion does not erase a completed publication or copies already preserved. It may reduce continuing harm, but the original evidence and circumstances remain relevant.

Does an affidavit of desistance automatically dismiss the charge?

No. Cyber libel is prosecuted in the name of the People of the Philippines. A desistance may affect the evidence or prosecutorial assessment, but it does not automatically bind the prosecutor or court.

Can a company be defamed?

Article 353 recognizes that a defamatory imputation may injure a natural or juridical person. The complaint must still establish identification, publication, defamatory meaning, malice, and the other applicable requirements.

Is the deadline counted from posting or discovery?

The controlling rule is one year from discovery by the offended party, authorities, or their agents. Posting and discovery may coincide, but not always. The party relying on a later discovery date or a prescription defense should preserve evidence supporting that date.

Can the complainant obtain both criminal punishment and damages?

Potentially, but the procedural route matters. Civil liability arising from the offense is generally included in the criminal action unless waived, reserved, or previously filed. Independent civil remedies may exist, but there can be no double recovery for the same injury.

Official legal sources

This article provides general legal information, not legal advice or an attorney-client relationship. Cyber-libel outcomes depend on the exact words, audience, evidence, dates, venue, complainant’s status, and procedural record. Authorities and procedures were checked through September 22, 2026.