Quick answer

A Philippine cyber libel case usually begins with a sworn complaint and supporting evidence filed with the proper city or provincial prosecutor, often after assistance from the NBI Cybercrime Division or PNP Anti-Cybercrime Group. The prosecution must establish that the respondent authored an online statement that:

made a defamatory imputation;
was communicated to at least one person other than the person defamed;
identified, expressly or by context, the person allegedly defamed;
was malicious under the applicable legal standard; and
was published through a computer system or information and communications technology.

Cyber libel is punishable under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, applying the libel provisions of the Revised Penal Code.

Act quickly. In its final April 2026 ruling in Causing v. People, the Supreme Court held that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Posting online does not automatically create a presumption that the offended party discovered the post that same day. A formal complaint or information interrupts prescription, but a demand letter, platform report, or informal police inquiry may not. See the Supreme Court’s 2026 resolution.

A person who receives a subpoena should obtain counsel immediately and submit a complete counter-affidavit on time. Deleting the post, apologizing, settling the civil claim, or obtaining an affidavit of desistance does not automatically terminate the criminal case.

What legally counts as cyber libel?

Article 353 of the Revised Penal Code defines libel as a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.

Cyber libel applies when the imputation is made through a computer system or ICT. Depending on the facts, this may include a social-media post or comment, blog entry, online article, email, group message, uploaded image, video, caption, or other online communication.

Insulting or unpleasant speech is not automatically cyber libel. The statement must be assessed as a whole, in its actual language and context, including accompanying images, hashtags, earlier exchanges, audience, and the ordinary meaning understood by readers.

The elements the prosecution must prove

Element	What must be established
Defamatory imputation	The statement attributed a crime, vice, defect, misconduct, or other discreditable condition to a person or organization.
Publication	At least one third person—not only the person allegedly defamed—received, read, heard, or viewed it.
Identification	The complainant was named or was reasonably identifiable from the words and surrounding circumstances.
Malice	The applicable form of malice existed. The required proof changes when the communication is privileged or concerns a public official or public figure.
Online authorship	The respondent authored, posted, or caused the publication through a computer system or ICT. Account ownership alone may not conclusively prove authorship.

A one-to-one private message sent only to the person criticized may lack the publication element, although its contents could implicate a different law. A group chat or copied email can satisfy publication if another person received the statement.

A complainant need not always be named. Identification may exist if readers familiar with the circumstances could determine who was being discussed. Conversely, a vague statement about a large, undefined group may fail to identify a particular complainant.

Original authors, commenters, likes, and shares

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but declared it unconstitutional as applied to people who merely receive and react to the post. It also invalidated aiding or abetting liability under Section 5 insofar as it applied to cyber libel.

This does not give blanket immunity to every commenter or sharer. A person who adds a new defamatory caption, accusation, or comment may become the author of that new statement. Liability must be based on what that person actually composed or caused to be published, not merely on being tagged, following the account, or pressing a reaction button.

Malice, public officials, and privileged communications

The general rule

Article 354 generally presumes a defamatory imputation malicious, even if true, unless the accused shows good intention and a justifiable motive or the communication falls within a recognized privilege.

Truth alone is therefore not always a complete defense. Under Article 361, acquittal generally requires proof both that the imputation was true and that it was published with good motives and for justifiable ends. Proof of the truth of an imputation involving an act or omission that is not a crime is subject to an additional statutory restriction, except when it concerns a government employee’s discharge of official duties.

Public officials and public figures

A stricter constitutional standard applies to statements concerning public officials or public figures, particularly matters involving official conduct or public concern. The prosecution must prove actual malice beyond reasonable doubt: knowledge that the statement was false or reckless disregard of whether it was false.

Reckless disregard requires evidence of a high awareness of probable falsity or that the author seriously doubted the truth of the publication. Mere failure to investigate or verify is not automatically enough.

In July 2026, the Supreme Court acquitted a person who had criticized a municipal mayor because actual malice was not proved beyond reasonable doubt. Personal resentment and failure to verify did not, without more, establish knowledge of falsity or reckless disregard. See Tan v. People, G.R. No. 265929.

Calling a statement an “opinion” does not automatically protect it if the statement reasonably implies undisclosed defamatory facts. Courts examine the substance and context, not the label placed on the post.

Qualifiedly privileged communications

Article 354 recognizes, among others:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without added defamatory comments, of a non-confidential judicial, legislative, or official proceeding or of an official act.

Privilege is not unlimited. Excessive publication, irrelevant accusations, added malicious remarks, knowledge of falsity, or lack of good faith may defeat it. When a qualified privilege applies, the prosecution must establish actual malice.

The one-year deadline

Cyber libel prescribes in one year, counted from the date the offended party, the authorities, or their agents actually discovered the publication.

Important consequences include:

The date of posting and the date of discovery may be different.
A public privacy setting does not create an automatic legal presumption of same-day discovery.
Discovery can be proved or disputed through reactions, comments, messages, demand letters, threats to sue, witness testimony, and other conduct showing knowledge.
The period is interrupted by the filing of the proper complaint or information.
If proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may run again.
Under Article 91, prescription does not run while the offender is absent from the Philippines.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. Because criminal, civil, and independent civil claims interact in technical ways, obtain advice before choosing whether to reserve or separately file a civil action.

Do not wait for a platform to answer a takedown request or for settlement negotiations to finish. Neither necessarily protects the filing deadline.

Where the case should be filed

Cyber libel cases are tried by a Regional Trial Court designated as a special cybercrime court. Under the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 may be filed in the designated cybercrime court of the province or city:

where the offense or an element occurred;
where any part of the computer system used was situated; or
where damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others.

Online accessibility everywhere does not necessarily permit filing anywhere. The facts supporting venue must be specifically alleged and ultimately proved. Special venue rules under Article 360 of the Revised Penal Code also affect libel-related civil actions and certain complainants, including public officers. Have counsel confirm venue before filing because choosing the wrong prosecutor’s office or court can jeopardize the case.

The Philippines may also exercise jurisdiction in circumstances specified in Section 21 of Republic Act No. 10175, including when an element occurred here, a relevant computer system was wholly or partly situated here, or damage was caused to a person who was in the Philippines. The statute also covers violations committed by Filipino nationals outside the country, although cross-border investigation and service may be difficult.

How to file a cyber libel complaint

1. Preserve the complete publication

Before requesting deletion or contacting the author, preserve:

the entire post, article, comment thread, image, or video;
the full URL, not merely a cropped screenshot;
the profile name, username, account URL, user ID if visible, and profile details;
the displayed publication date and time, including the time zone if known;
preceding and succeeding posts necessary to show context;
comments, shares, audience or privacy settings, and visible engagement;
messages showing when and how the complainant first discovered the publication;
the original files received or downloaded; and
the device on which the material was first seen.

Take screenshots and, when possible, a continuous screen recording showing navigation from the profile or webpage to the material. Keep untouched copies. Do not annotate, crop, compress, rename, or repeatedly resave the only copy.

Record who captured each item, when it was captured, on what device, and how it was stored. A printout can be useful, but screenshots are not automatically self-authenticating. The proponent must show that the electronic evidence is genuine, reliable, and accurately reflects the original. The Supreme Court has emphasized this requirement in its discussion of Facebook screenshots and electronic authentication.

Do not hack an account, impersonate another person, secretly intercept communications, or access private content without authority. Ask investigators or counsel about lawful preservation and disclosure procedures.

2. Establish authorship

Save evidence connecting the account to the proposed respondent, such as:

the respondent’s admission;
consistent identifying details, photographs, contact information, or linked accounts;
messages sent from the account;
witnesses familiar with how the account was used;
earlier posts acknowledging ownership; or
provider records lawfully obtained through investigators and a court warrant.

A profile bearing someone’s name or photograph can be fake, compromised, or shared. A strong complaint explains why the identified person—not merely the account—authored or caused the publication.

3. Gather evidence for every element

The complaint should address:

the exact words or material alleged to be defamatory;
their meaning in context;
who received or viewed them;
how readers identified the complainant;
why the statement was false, misleading, or malicious under the applicable standard;
the facts linking the respondent to the account or publication;
when discovery occurred;
why the chosen place of filing is proper; and
the harm caused, including lost work or business, messages from third persons, reputational injury, or medical and counseling records where relevant.

If the complainant is a public official or public figure, identify admissible evidence of actual malice. Examples may include proof that the author possessed authoritative contrary records, fabricated a document, admitted the accusation was false, or published despite serious doubts. Failure to verify, anger, or harsh wording alone may be insufficient.

Obtain sworn statements from people who personally viewed the publication, recognized the complainant, know the account’s author, or can authenticate relevant records.

4. Seek prompt cybercrime-investigation assistance when needed

Republic Act No. 10175 designates the NBI and PNP as cybercrime law-enforcement authorities. Their assistance is particularly important when:

the account is anonymous or appears fake;
provider data is needed to identify the user;
the post has been removed;
evidence may be deleted or altered;
a device requires forensic examination; or
the platform or relevant records are overseas.

The NBI Cybercrime Division’s citizen-service guidance allows victims to file a complaint or request an investigation. The NBI also maintains an online complaint page.

Under Sections 13 and 14 of Republic Act No. 10175, law-enforcement authorities may order preservation of content data for six months, with a one-time six-month extension, and may obtain disclosure of relevant provider data after securing the required court warrant. A private demand to a platform is not the same as a statutory preservation order.

Because investigation can consume much of the one-year period, coordinate with counsel and the proper prosecutor rather than assuming an investigative report alone interrupts prescription.

5. Prepare and file the complaint-affidavit

A complaint for preliminary investigation should normally include:

the complainant’s sworn complaint-affidavit;
the respondent’s complete name and last known address, if available;
witness affidavits;
authenticated or properly described electronic evidence;
documents proving falsity, authorship, discovery, venue, and damages;
an organized list of annexes; and
the required number of copies.

File it with the city or provincial prosecutor whose territorial jurisdiction corresponds to the proper venue, unless a legally authorized central or special prosecution office is handling the matter. Requirements and accepted filing channels can differ by office, so confirm them before the deadline. The DOJ publishes a preliminary-investigation filing checklist.

What happens during preliminary investigation?

Cyber libel carries a possible maximum imprisonment exceeding six years, so it is covered by the regular preliminary-investigation procedure under the DOJ’s 2024 rules.

The prosecutor determines whether there is prima facie evidence with reasonable certainty of conviction. This requires evidence that is admissible, credible, capable of preservation and presentation at trial, and sufficient—if uncontroverted—to establish all elements and the respondent’s identity.

The usual sequence is:

The prosecution office evaluates the complaint and completeness of the evidence.
If the case proceeds, the prosecutor issues a subpoena with the complaint and attachments.
The respondent receives at least 10 days from receipt to submit a sworn counter-affidavit and supporting evidence.
The prosecutor may consider the matter submitted or conduct a physical or virtual clarificatory hearing.
A reply-affidavit and rejoinder may be required if material new matters need to be addressed.
The prosecutor issues a resolution dismissing the complaint or recommending an information in court.

A motion to dismiss filed instead of a counter-affidavit is generally not allowed unless it is verified and contains the respondent’s defenses, in which case it is treated as the counter-affidavit.

An aggrieved party may generally move for reconsideration within 15 days from receipt of the prosecutor’s resolution. Further review may be available under the DOJ’s appeal rules. Do not assume that reconsideration or a petition for review automatically stops court proceedings; a motion to suspend may be necessary. The controlling procedure is in DOJ Department Circular No. 15, series of 2024.

How to defend a cyber libel complaint

Preserve first; do not alter the account

Keep the original device, account data, drafts, source documents, messages, and publication history. Preserve evidence of account compromise, unauthorized access, editing by another person, or shared account administration.

Do not delete the account, edit timestamps, fabricate records, ask witnesses to change their statements, or coordinate stories. Even an innocent attempt to “clean up” the account may destroy useful defense evidence or create a damaging inference.

If continued publication is causing harm, obtain advice about a carefully documented takedown or correction after preserving the original. Deletion does not erase an already completed publication.

Obtain the complete case record

The defense should compare the subpoena and complaint with the actual electronic material. Check whether annexes are missing, screenshots are cropped, timestamps are inconsistent, the URL belongs to another account, or the quoted words differ from the original.

Calendar every deadline from actual receipt. Keep the envelope, email headers, acknowledgment, or proof showing when service occurred.

Test each element separately

Potential defenses, depending on the evidence, include:

No defamatory imputation: The statement, read in full context, did not attribute a discreditable fact or condition.
No publication: No third person received or understood the communication.
No identification: Readers could not reasonably identify the complainant.
No authorship: The respondent did not operate the account or compose, approve, or cause the publication.
Account compromise: The content was posted through unauthorized access, supported by login alerts, device records, recovery emails, or forensic evidence.
No required malice: The prosecution cannot prove malice or, where required, actual malice.
Privilege: The communication was made in the performance of a legal, moral, or social duty, or was a fair and true good-faith report of a non-confidential official proceeding.
Truth with good motives and justifiable ends: The requirements of Article 361 are satisfied.
Public-official or public-figure criticism: The statement concerned official conduct or public affairs, and actual malice cannot be proved beyond reasonable doubt.
Mere receipt or reaction: The respondent only received or reacted to another person’s post and did not author a new defamatory statement.
Prescription: More than one year elapsed from provable discovery to the proper filing, subject to interruption and statutory exceptions.
Improper venue: The complaint or information lacks a sufficient factual connection to the chosen prosecutor’s office or cybercrime court.
Defective electronic proof: The screenshots, messages, or account records cannot be authenticated, are incomplete, or do not reliably establish what the prosecution claims.
Non-retroactivity: The alleged online publication occurred before the cyber libel provision became effective, subject to careful analysis of any claimed later publication.

These are not interchangeable boilerplate defenses. A counter-affidavit should state the respondent’s version under oath, address the prosecution’s evidence, and attach admissible supporting documents. Because statements in the counter-affidavit can later be used in court, it should be prepared with counsel.

If an information has already been filed

Once the prosecutor files an information, the judge independently evaluates probable cause. The court may dismiss the case, require additional evidence, issue a summons where permitted, or issue a warrant of arrest.

If there is a warrant, arrange lawful surrender and bail through counsel instead of ignoring it. Cyber libel is ordinarily bailable as a matter of right before conviction, although the court sets the amount and conditions.

Counsel should promptly examine:

the information’s allegations of authorship, publication, discovery, and venue;
whether the facts alleged constitute an offense;
prescription;
the validity of warrants and provider disclosures;
possible motions authorized before arraignment;
bail and travel restrictions;
the civil claim deemed included with the criminal case; and
evidence that must be reserved and marked at pre-trial.

Avoid discussing the merits publicly while the case is pending. New posts can become separate evidence or generate additional claims.

Possible penalties and civil liability

Cyber libel carries a statutory imprisonment range of four years, two months and one day to eight years, or a fine, or both.

Following People v. Soliman, the current fine range is ₱40,000 to ₱1,500,000. Courts may impose a fine instead of imprisonment, but fine-only treatment is discretionary, not automatic. Judges consider the circumstances and whether a fine alone would serve justice without depreciating the offense’s seriousness. Subsidiary imprisonment may apply if a lawfully imposed fine cannot be paid.

The offended party’s civil claim for damages is generally deemed included when the criminal action is filed unless it was waived, reserved for separate filing, or filed earlier. Independent civil remedies may also be available, but there can be no double recovery for the same injury.

An apology, correction, takedown, compromise, or payment may affect damages, credibility, mitigation, or the court’s choice of penalty. It does not by itself extinguish criminal liability because the criminal case is prosecuted in the name of the People of the Philippines.

Evidence worth preserving

For the complainant

complete screenshots, URLs, downloads, and screen recordings;
the device and account on which the post was discovered;
evidence showing the exact discovery date;
witness affidavits from actual viewers;
documents disproving the accusation;
proof connecting the account to its author;
messages showing knowledge of falsity or serious doubts;
takedown requests, corrections, replies, and admissions;
employment, business, medical, or counseling records supporting claimed harm; and
receipts for losses and case-related expenses.

For the respondent

drafts, notes, research, and sources consulted before publication;
official records or witness information supporting the statement;
messages showing good-faith purpose or performance of a duty;
the full conversation or publication context;
proof of account compromise or shared access;
earlier evidence that the complainant already knew of the post;
proof that no third person received a private message;
records showing the respondent merely reacted and did not author the statement;
the subpoena, proof of receipt, prosecutor’s resolution, and all filed pleadings; and
copies of any apology or correction, preserved with dates and circumstances.

Common mistakes

Waiting until the one-year period is almost over.
Assuming the date of posting is automatically the date of discovery.
Treating a platform report or demand letter as a criminal complaint.
Filing wherever the post was accessible without proving proper venue.
Submitting only a cropped screenshot without a URL, context, or authentication witness.
Naming account administrators, tagged users, likers, and sharers without evidence that they authored defamatory material.
Assuming truth alone always defeats liability.
Assuming every harsh criticism of a public official is criminal.
Treating failure to verify, by itself, as conclusive proof of actual malice.
Ignoring a subpoena or filing an unsworn position paper instead of a proper counter-affidavit.
Missing the 15-day reconsideration period.
Deleting accounts or altering electronic evidence.
Threatening the other party or posting accusations about witnesses, prosecutors, or the judge.
Believing an affidavit of desistance automatically dismisses the criminal case.

When legal help is urgent

Seek a Philippine lawyer immediately if:

the one-year prescriptive period is approaching;
the post or account may soon disappear;
the account is anonymous and provider records are needed;
a subpoena, prosecutor’s resolution, information, warrant, or arraignment notice has been received;
the complainant is a public official or public figure;
the publication involved journalism, whistleblowing, official records, or confidential proceedings;
the respondent claims hacking or unauthorized account access;
either party is abroad;
there are related threats, extortion, stalking, doxxing, intimate images, or violence;
investigators seek access to a device or private account; or
settlement discussions involve an affidavit, admission, payment, or public apology.

Persons who meet its qualifications may request free assistance from the Public Attorney’s Office.

Frequently asked questions

Is every false Facebook post cyber libel?

No. The prosecution must still prove defamatory meaning, publication to a third person, identification, malice, online authorship, and all jurisdictional facts. Other laws may apply to false content that does not satisfy these elements.

Can a true accusation still be libelous?

Potentially. For a private complainant, truth may need to be accompanied by good motives and justifiable ends, and Article 361 restricts when truth may be proved for certain non-criminal imputations. Statements about public officials, public figures, and matters of public concern involve additional constitutional protections.

Is a private group chat covered?

It can be. Publication exists if at least one person other than the person defamed received the statement. Privacy settings limit the audience but do not necessarily eliminate publication.

Can someone be charged for liking or sharing a post?

A mere recipient or reactor is not automatically liable under Disini. A person who adds a new defamatory accusation or caption may be treated as the author of that new publication.

Does deleting the post prevent a case?

No. Deletion does not undo publication already made. Preserve the post and relevant account data before any takedown.

Does an apology dismiss the case?

No. It may affect damages, mitigation, credibility, or penalty, but it does not automatically extinguish criminal liability.

How long does the complainant have to file?

One year from actual discovery by the offended party, authorities, or their agents, subject to interruption and the other rules in Article 91. The discovery date is a factual issue; do not rely on assumptions.

Can the author be charged if using a fake name?

Yes, if investigators can lawfully identify and prove who controlled and used the account. Attribution may require preservation orders, court-authorized disclosure, and forensic evidence.

Can a fine be imposed instead of jail?

Yes. People v. Soliman confirms that a court may impose a fine alone, but this remains discretionary. Imprisonment is still an authorized alternative.

Does settlement end the criminal case?

Not automatically. The parties may settle the civil aspect, but the prosecutor and court control the criminal action. Any settlement, apology, or affidavit should be reviewed by counsel before signing or publication.

Official legal sources

This article provides general legal information, not legal advice or an attorney-client relationship. Outcomes depend on the exact publication, documents, parties, discovery date, evidence, and procedural history. Philippine law and official procedures were checked through August 6, 2026.