Quick answer

To file a Philippine cyber libel case, preserve the online evidence and file a sworn complaint-affidavit with the proper City or Provincial Prosecutor’s Office within one year from discovery of the allegedly defamatory publication. If the account is anonymous or technical records are needed, seek prompt assistance from the NBI Cybercrime Division or PNP Anti-Cybercrime Group—but do not assume that a platform report, police blotter, demand letter, or informal agency inquiry stops the one-year period.

To defend a case, do not ignore the prosecutor’s subpoena. The submission date for the counter-affidavit must be at least 10 days after receipt of the subpoena and complete complaint records. File a sworn, evidence-supported response addressing every element, including authorship, publication to a third person, identifiability, defamatory meaning, malice, privilege, venue, and prescription.

Cyber libel is punished under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, in relation to Articles 353 and 355 of the Revised Penal Code. Outcomes depend heavily on the exact words, context, audience, account evidence, dates, and documents.

What counts as cyber libel?

Cyber libel is libel committed through a computer system or information and communications technology—for example, through a social-media post, online article, caption, comment, email, forum, or group chat.

The prosecution must establish:

Required element	What it generally means
Defamatory imputation	The content attributes a crime, vice, defect, dishonorable act, condition, status, or circumstance to someone, tending to cause dishonor, discredit, or contempt.
Publication	At least one person other than the person defamed received, saw, or read the imputation.
Identifiability	Readers can reasonably identify the person or juridical entity concerned, even if no name is used.
Malice	Malice is generally presumed from defamatory words unless a privilege or applicable higher constitutional standard removes that presumption.
Use of a computer system	The defamatory matter was published online or through comparable ICT.
Identity of the author	The evidence must connect the accused—not merely an account name or profile picture—to the publication.

Words are assessed as a whole, in their ordinary meaning and context. Not every insult, curse, criticism, joke, or angry remark is defamatory. A statement may be offensive yet fail to impute any crime, vice, defect, or dishonorable circumstance.

A one-to-one private message ordinarily lacks the publication element if no third person receives it. A closed group, group chat, shared email, or restricted social-media audience can still satisfy publication because other people received the statement.

Broad criticism of a large, undefined class ordinarily does not identify an individual. Conversely, initials, a photograph, job title, location, tag, nickname, or surrounding details may make a person identifiable without naming them.

Likes, shares, and comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but invalidated Section 5’s aiding-or-abetting provision insofar as it applied to online libel. A person is not criminally liable for cyber libel merely for an ordinary like, reaction, or share of someone else’s post.

The protection has limits. A person who adds a new defamatory caption, comment, accusation, or story becomes the author of that new content and may face liability for it. Whether a repost is merely mechanical or contains an independently defamatory publication is a factual question.

The same defamatory material should not be charged simultaneously as both ordinary libel and cyber libel merely because it appeared in print and online; the Supreme Court has treated them as the same offense when based on the identical publication.

Important defenses and exceptions

No defamatory imputation

The words may be criticism, opinion, hyperbole, general abuse, or an unpleasant personal remark without attributing a crime, vice, defect, or dishonorable circumstance. Courts examine context, not isolated words.

Calling something an “opinion” is not automatically a defense. An opinion that implies undisclosed, false facts—such as accusing someone of corruption while presenting the accusation as a conclusion—may still be defamatory.

No publication to a third person

A message seen only by its sender and the person criticized ordinarily lacks publication. Preserve proof of the recipient list, privacy setting, delivery status, and whether anyone else actually had access.

The complainant was not identifiable

The prosecution must show that readers could reasonably understand the publication as referring to the complainant. Mere resemblance, speculation, or a weak connection to an alias may be insufficient.

The respondent was not the author

An account bearing a person’s name or photograph does not by itself settle authorship. Accounts may be impersonated, compromised, shared, or managed by several people.

Under the Supreme Court’s 2025 guideposts for social-media evidence, ownership, access, or authorship may be proved through admissions, eyewitness testimony, information known only to the suspected author, distinctive language patterns, earlier account activity, ISP or platform records, geolocation, device examination, or other direct and circumstantial evidence. Technical records are valuable but are not always indispensable. See the Supreme Court’s official summary of XXX v. People.

A bare denial is usually weak. A stronger defense identifies who had access, documents account compromise or shared administration, preserves login alerts and device records, and explains the circumstances with corroborating evidence.

Privileged communication

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty to a person with a corresponding interest or duty; and
A fair and true report, made in good faith and without additional comments, of specified official proceedings or acts of public officers.

Privilege depends on purpose, audience, manner, relevance, and good faith. Sending a legitimate workplace complaint to the responsible officer may be privileged; broadcasting the accusation to people with no corresponding duty may not be.

Statements in judicial proceedings, legislative debate, and certain official communications may receive absolute privilege, but only within the recognized scope of that privilege.

Public officials, public figures, and matters of public concern

Where the complainant is a public officer or public figure and the publication concerns a matter in which the public has a legitimate interest, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false.

Mere factual error or negligence does not automatically amount to actual malice. Reckless disregard requires evidence that the author entertained serious doubts or had a high degree of awareness of probable falsity. This is fact-specific; public status is not a license to knowingly spread false accusations about someone’s private life.

Truth, good motive, and justifiable ends

Truth is not a blanket defense to every defamatory publication. Article 361 limits when proof of truth may be admitted in a criminal libel case. Even where the imputation is proved true, the accused generally must also establish that it was published with good motives and for justifiable ends.

Documents showing careful verification, reliance on credible primary records, efforts to obtain the other side, corrections, and the public purpose of the publication may therefore matter. Repeating gossip or relying only on an anonymous post is much harder to justify.

Prescription

The Supreme Court has definitively held that cyber libel prescribes in one year, despite its heavier penalty. The period begins when the publication is discovered by the offended party, the authorities, or their agents—not automatically on the date it was posted. There is no presumption that a person discovered a social-media post on publication merely because it was publicly accessible.

Discovery is proved through evidence such as the date the complainant first received a link or screenshot, commented on the post, demanded its removal, threatened legal action, or otherwise acted with knowledge of it. See Causing v. People, G.R. No. 258524, April 8, 2026.

Filing the proper complaint or information interrupts prescription under Article 91. Because the deadline is short and questions can arise over what filing legally interrupts it, a complainant should file the complete complaint-affidavit with the proper prosecution office well before the anniversary of discovery. A respondent should demand proof of the alleged discovery date and compare it with the official filing date.

How to preserve online evidence

Preserve evidence before requesting takedown or blocking the account. Keep:

Full screenshots showing the exact words, images, account name, date, time, audience, group or page name, and surrounding thread;
The post’s direct URL and the account’s profile URL or unique account identifier;
A screen recording showing navigation from the account or page to the publication;
Original electronic files, downloaded data, messages, emails, and attachments—not only cropped screenshots;
The device on which the material was received, without resetting or altering it;
Notes identifying when, where, and how the publication was discovered;
Names and sworn statements of people who personally saw the publication;
Earlier messages, admissions, account interactions, distinctive expressions, and other evidence connecting the account to its operator;
Platform-report confirmations, takedown notices, deletion notices, and correspondence with the author;
Proof of harm, such as canceled contracts, client inquiries, employment action, medical records, or witnesses to reputational damage; and
For a defense, account-access logs, security alerts, device records, travel or work records, and proof identifying other authorized account administrators.

Keep an untouched master copy and work from duplicates. Do not hack an account, impersonate another person, secretly obtain protected platform credentials, or unlawfully seize someone’s device.

Screenshots are useful but may be challenged as fabricated, incomplete, or taken out of context. Witness testimony, original devices, platform or ISP records, and forensic examination can strengthen—or disprove—authorship and authenticity.

How to file a criminal complaint

1. Check the deadline and legal elements

Record the earliest provable discovery date. Review the entire publication in context and confirm that there is evidence of:

A specific defamatory imputation;
Communication to at least one third person;
An identifiable complainant;
The respondent’s authorship or control;
Use of ICT;
Malice or, where required, actual malice; and
A legally supportable venue.

Do not wait for negotiations, a barangay meeting, or platform action to finish. Cyber libel is outside mandatory barangay conciliation because its prescribed penalty exceeds the limits of the lupon’s authority under Section 408 of the Local Government Code.

2. Choose the proper venue

Cyber libel cases fall within the jurisdiction of designated cybercrime branches of the Regional Trial Court. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used is situated; or
Where any of the damage to a natural or juridical person took place.

Once a court validly acquires jurisdiction, it excludes the other possible venues. Residence alone should not be treated as an automatic choice; the complaint should allege and support the facts connecting the offense, computer system, or actual damage to the chosen place. See Tieng v. People.

Ordinarily, the complaint-affidavit is first filed with the City or Provincial Prosecutor’s Office corresponding to a legally supportable court venue.

Cross-border cases require special care. Philippine jurisdiction may exist where an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, damage was caused to a person in the Philippines, or the accused is a Filipino covered by Section 21 of Republic Act No. 10175. Jurisdiction and practical enforcement are separate questions.

3. Prepare the complaint-affidavit

Under the 2024 DOJ-NPS Rules on Preliminary Investigations, the complaint-affidavit should state:

The parties’ names and addresses;
The date and place of the alleged offense;
The material facts showing how it was committed;
The exact publication and its full context;
The discovery date and circumstances;
Why the complainant is identifiable;
How the content was published to third persons;
Facts connecting the respondent to the account and publication;
The basis for venue; and
The evidence supporting every element.

Attach witness affidavits and documentary, electronic, or object evidence. The prosecution’s current standard is prima facie evidence with reasonable certainty of conviction: evidence that is admissible, credible, preservable, and capable of establishing every element and the offender’s identity. The Supreme Court upheld these DOJ rules in Meking v. Remulla.

The regular filing requires the original complaint-affidavit, two duplicate copies for the official file, additional copies for every respondent, and a completed NPS Investigation Data Form. Check the particular office’s current checklist before filing.

4. Get investigative help when necessary

If the author is anonymous, the account may be fake, or platform and device records are needed, seek assistance promptly from:

The NBI Cybercrime Division;
The PNP Anti-Cybercrime Group; or
The DOJ Office of Cybercrime.

Law-enforcement authorities may pursue preservation, disclosure, search, seizure, or examination of computer data through the procedures and warrants authorized by law. A private complainant cannot compel a platform or telecommunications provider to disclose protected subscriber or traffic data merely by sending a demand.

Do not assume that an investigative intake, blotter, platform report, or referral alone preserves the criminal deadline. Coordinate the prosecutor filing immediately.

What happens during preliminary investigation?

After docketing, the investigating prosecutor initially assesses whether there is a ground to continue. If there is, the prosecutor issues a subpoena containing the complaint and attachments.

The respondent’s scheduled submission must be at least 10 days from receipt of the subpoena and complaint records. Failure to appear or file a counter-affidavit without justification can result in the case being submitted for resolution on the complainant’s evidence alone.

Extensions are not automatic. When the interest of justice requires—such as to retain counsel, inspect voluminous records, or study a genuinely technical issue—the prosecutor may grant an extension of no more than 10 days.

A clarificatory hearing may be scheduled if material facts require clarification. A reply-affidavit and rejoinder-affidavit are filed only when required or allowed by the prosecutor; neither may be filed more than 10 calendar days after receipt of the pleading being answered. The rejoinder is the last pleading.

The DOJ rules direct the investigating prosecutor to resolve a regular preliminary-investigation complaint within 60 calendar days from assignment, with a possible maximum 30-day extension in specified complex situations. These are official processing periods, not a guarantee that every office will issue the final approved resolution on that exact date.

How to defend after receiving a subpoena

1. Record receipt and obtain the complete file

Keep the subpoena, envelope, delivery record, email headers, and attachments. The deadline is tied to receipt. Confirm that every annex mentioned in the complaint was actually supplied.

2. Engage counsel promptly

Cyber libel carries a possible prison term exceeding six years. Counsel can assess prescription, venue, privilege, constitutional standards, electronic evidence, and whether a response could unintentionally admit account ownership or authorship. A person who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility rules.

3. Prepare a sworn, element-by-element counter-affidavit

Do not rely on a bare denial or a motion to dismiss that avoids the facts. Under the DOJ rules, a motion to dismiss filed instead of a counter-affidavit is allowed only if verified and containing the respondent’s defenses, in which case it is treated as the counter-affidavit.

Address, as applicable:

Whether the words are actually defamatory when read in full context;
Whether any third person received them;
Whether the complainant was identifiable;
Whether the respondent wrote, posted, approved, or controlled the publication;
Whether the electronic evidence is authentic and complete;
Whether the communication was privileged;
Whether the matter involved a public official, public figure, or public concern requiring proof of actual malice;
The factual basis for truth, good motive, and justifiable ends;
Whether venue is supported by specific facts;
The publication, discovery, and filing dates; and
Any unlawful method used to obtain evidence.

Attach affidavits and records supporting the defense. Preserve any exculpatory device or account information before routine deletion or overwriting occurs.

4. Avoid conduct that worsens the case

Do not retaliate online, threaten the complainant or witnesses, fabricate records, coordinate false testimony, delete evidence after receiving legal process, or contact the complainant in a manner that can be characterized as intimidation.

If removal or correction of the post is appropriate, first preserve an accurate copy and consult counsel. Deletion does not automatically erase criminal or civil liability, but a prompt correction or apology may affect harm, motive, settlement, or sentencing.

5. Act immediately on the prosecutor’s resolution

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. A qualifying resolution may also be reviewed under the DOJ’s petition-for-review rules, but the proper reviewing office and requirements depend on the case and procedural history.

If an Information has already been filed in court, a DOJ petition does not automatically stop the court case. Any request to suspend proceedings must comply with the applicable rules and court orders.

If the case reaches court

The prosecutor files the Information with the designated cybercrime Regional Trial Court. The judge independently evaluates judicial probable cause and may dismiss the case, require additional evidence, or issue a warrant of arrest.

Cyber libel is generally bailable before conviction. Bail is not a finding of innocence and its amount and conditions are fixed by the court. If a warrant has issued, the accused should not evade it; counsel can arrange a lawful surrender, posting of bail, and appearance.

The usual stages are arraignment, pre-trial, trial, judgment, and any appeal. The prosecution must prove guilt and the accused’s identity beyond reasonable doubt—not merely meet the preliminary-investigation standard.

Possible penalties and civil liability

Article 355, as amended by Republic Act No. 10951, punishes ordinary libel with imprisonment, a fine from ₱40,000 to ₱1,200,000, or both. Section 6 of Republic Act No. 10175 raises the cyber libel penalty by one degree.

For cyber libel, the possible imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months, and one day to eight years. Applying the rules on increasing a fine by one degree, the fine may range from ₱40,000 to ₱1,500,000.

Imprisonment is not mandatory in every conviction. The Supreme Court confirmed in People v. Soliman that a court may impose a fine alone, depending on the law and the circumstances. A fine-only sentence is a judicial option, not an entitlement or a promise of outcome.

Civil liability for reputational and proven consequential harm may accompany the criminal case. The civil action is generally deemed instituted with the criminal action unless it was waived, reserved when legally permitted, or previously filed. Separate civil remedies may also arise under the Civil Code, but their procedure, prescription, and evidentiary standards require separate assessment.

An affidavit of desistance does not automatically end a criminal case. Once filed, the prosecution is in the name of the People of the Philippines; the prosecutor and, after court filing, the judge control its disposition.

Common mistakes

Waiting for the post to go viral before preserving it;
Counting one year from publication without examining the actual discovery evidence;
Assuming a barangay complaint, demand letter, police blotter, or platform report preserves the criminal deadline;
Filing in a place based only on convenience or residence, without venue facts;
Submitting cropped screenshots that omit the URL, audience, date, or surrounding discussion;
Treating an account name or profile picture as conclusive proof of authorship;
Assuming every insult is libel;
Assuming truth alone always defeats liability;
Ignoring the public-official or public-figure actual-malice standard;
Filing charges against everyone who reacted to or shared a post;
Ignoring a subpoena because preliminary investigation is “not yet a court case”;
Filing an unsworn explanation instead of a proper counter-affidavit;
Missing the 15-day reconsideration period;
Deleting, editing, or manufacturing evidence; and
Pressuring the other side with threats of public exposure, arrest, or unrelated criminal charges.

When legal help is urgent

Seek immediate assistance if:

The one-year anniversary of discovery is approaching;
A prosecutor’s subpoena, resolution, Information, or arrest warrant has been received;
The account is anonymous and identifying records may disappear;
A platform has announced deletion of the account or content;
A device may be lost, reset, replaced, or remotely wiped;
The publication includes threats, intimate images, child sexual-abuse material, stalking, or disclosure of sensitive personal data;
Several people or countries are involved;
The complainant is a public officer or public figure;
The publication came from a newsroom, company, school, government office, or jointly managed account; or
Settlement discussions involve payment, admissions, confidentiality, or an affidavit of desistance.

Frequently asked questions

Do I need a lawyer to file a complaint?

A person may prepare and file a complaint-affidavit without private counsel. Because the prescriptive period, venue, electronic authentication, malice standards, and authorship evidence can be decisive, legal assistance is strongly advisable.

Can I file even if the post was deleted?

Yes, if admissible evidence of the publication remains. Deletion may make proof harder, which is why full screenshots, original devices, witness affidavits, URLs, and technical records should be preserved promptly.

Is a public Facebook post automatically libelous?

No. Public accessibility supports publication but does not establish defamatory meaning, identifiability, authorship, or malice.

Can a private group-chat message be cyber libel?

Potentially. Publication exists if at least one third person received the defamatory imputation. The group’s restricted membership does not automatically prevent liability, although audience and purpose may be relevant to privilege and malice.

Is an anonymous account immune from prosecution?

No. Direct and circumstantial evidence, platform or ISP records, device forensics, distinctive knowledge, account history, and admissions may identify the operator. Obtaining protected technical data usually requires law-enforcement action and the appropriate warrant or legal process.

Does an apology end the case?

Not automatically. An apology, correction, takedown, or settlement may reduce harm or influence the parties and court, but it does not erase an already completed offense. The prosecutor or court remains responsible for the criminal case’s disposition.

When does the one-year period start?

From discovery by the offended party, the authorities, or their agents. The date is proved from conduct and surrounding evidence; it is not automatically the upload date.

Can the accused be jailed?

Yes, imprisonment is legally possible. Courts may instead impose a fine alone in an appropriate case, but that decision is made only after conviction and consideration of the circumstances.

Official sources

This article provides general legal information, not advice for a particular case. Legal conclusions may change based on the exact publication, evidence, dates, parties, and procedural record. Primary sources and procedures were checked as of August 1, 2026.