Quick answer

To file a Philippine cyber libel case, preserve the online material and proof of authorship, then file a sworn complaint with the proper Office of the City or Provincial Prosecutor—or seek investigative assistance from the NBI or PNP cybercrime unit. To defend one, do not ignore the subpoena: secure the full complaint and annexes, preserve your account and device records, and submit a properly supported counter-affidavit on time.

The most urgent rule is the deadline. In its April 8, 2026 en banc resolution in Causing v. People, the Supreme Court confirmed that cyber libel generally prescribes one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Filing the proper complaint or Information interrupts prescription. The Court also ruled that discovery cannot automatically be presumed merely because a post was publicly available online. The actual discovery date is a factual question that may require evidence. Read the Supreme Court decision.

A takedown request, platform report, demand letter, barangay complaint, or informal report to an investigator should not be assumed to stop the one-year period. If the deadline is close, obtain legal advice and file with the proper prosecution office without delay.

What counts as cyber libel

Cyber libel is libel under Articles 353 and 355 of the Revised Penal Code committed through a computer system or similar information and communications technology. The prosecution must establish:

A defamatory imputation. The post attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt, or to blacken the memory of a deceased person.
Publication. At least one person other than the person defamed received, saw, or understood the statement. A direct message seen only by its subject ordinarily lacks this element, although forwarding it to another person or posting it in a group may constitute publication.
Identification. The complainant must be identifiable from the words, images, circumstances, or information known to readers. Naming the person is not indispensable, but it must be shown that third persons understood who was being discussed.
Malice. A defamatory publication is generally presumed malicious unless it is a privileged communication. When a qualified privilege or protected public-interest commentary applies, the prosecution must prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false.
Use of a computer system or ICT. This may include a social-media post, blog, online article, video caption, digital image, email, forum entry, or other online publication.
Authorship or responsibility. The evidence must connect the respondent—not merely a display name or profile photo—to the account and the challenged content.

Whether words are defamatory is judged in context, including their ordinary meaning, tone, audience, surrounding statements, accompanying images, and relevant circumstances. Calling something an “opinion,” adding “allegedly,” using a pseudonym, or posting inside a private group does not automatically prevent liability.

Mere reactions and shares are treated differently

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author but struck down liability for people who merely receive and react to a post. A simple like, reaction, share, or similar response is not, by itself, punishable as aiding or abetting cyber libel. Read Disini.

The protection is not a license to add new accusations. A commenter who writes a separate defamatory allegation may become the original author of that new statement. Responsibility for editors, publishers, corporate officers, coordinated account operators, and materially altered or republished content depends on the evidence and the applicable statutory provisions.

The same allegedly defamatory material should not be charged both as traditional libel and cyber libel. Disini held that doing so for the same offense violates the rule against double jeopardy.

The one-year deadline

The criminal prescriptive period is generally:

One year from discovery by the offended party, the authorities, or their agents;
Interrupted by filing the proper complaint or Information; and
Potentially restarted if proceedings terminate without conviction or acquittal, or are unjustifiably stopped for reasons not attributable to the accused, subject to Article 91 of the Revised Penal Code.

Keep proof of the discovery date: the first message alerting the complainant, email notification, report from a colleague, screenshot creation date, affidavit of the first viewer, or other contemporaneous record.

For the defense, compare:

The publication date;
Every alleged republication or material edit;
The claimed discovery date;
The date and office where the complaint was filed; and
Whether the filing legally interrupted prescription.

Do not assume that a post’s continuing availability creates a new offense every day. Conversely, do not assume that a later repost, material edit, or added accusation has no legal effect. Each alleged publication must be examined separately.

A separate civil action for defamation ordinarily also has a one-year prescriptive period, generally counted from accrual of the cause of action. Civil Code remedies and the civil liability arising from the criminal offense may overlap, so the filing date, reservation of the civil action, and venue should be reviewed before choosing a route.

How to file a cyber libel complaint

1. Preserve the complete online evidence

Before asking for deletion, preserve:

Full-page screenshots showing the post, account name, date, time, comments, reactions, and surrounding context;
The exact URL or permalink;
A screen recording showing how the post is accessed from the profile or page;
Original images, audio, or video files in their native format;
The device used to view or receive the material;
Notifications, messages, emails, and conversations about the post;
Names and contact details of people who saw and understood it;
Evidence showing why readers identified the complainant;
Evidence connecting the account to the suspected author;
Records of business loss, cancelled work, medical treatment, threats, or other claimed harm; and
A written chronology stating when, where, and how the complainant first discovered the material.

Do not crop away context or edit the files. Keep the originals and make working copies. Screenshots can be evidence, but they are not automatically conclusive. Electronic documents must be authenticated and shown to be accurate, reliable, and connected to the person alleged to have created them. The Rules on Electronic Evidence govern authentication and admissibility.

2. Identify the author with evidence

A display name, photograph, or familiar writing style may be insufficient by itself. Useful corroboration may include:

Admissions by the account holder;
Messages acknowledging the post;
A phone number, email, website, or other account linked to the profile;
Witnesses familiar with the person’s control of the account;
Consistent personal details unavailable to strangers;
Device or account records lawfully obtained; and
Subscriber, traffic, or platform data obtained through proper legal process.

Do not hack an account, impersonate another person, or unlawfully obtain private data. Those acts may create separate criminal exposure and evidentiary problems.

If the author is anonymous, promptly approach the NBI Cybercrime Division or a PNP cybercrime unit. Under Republic Act No. 10175, traffic data and subscriber information are subject to statutory preservation periods, while content may be preserved upon a law-enforcement order. Disclosure of protected data generally requires a court warrant. Delay can result in records being deleted under a provider’s retention policy. See Sections 13 and 14 of RA 10175.

3. Confirm that every legal element is supported

The complaint should explain, with evidence:

The exact words, images, audio, or video complained of;
Why they are defamatory in context;
Who saw or received them;
How the complainant was identified;
Why the respondent is the author;
Facts supporting malice;
The date and manner of discovery;
The factual basis for venue; and
The injury or damage claimed.

Attach translations where necessary and identify who prepared them. Avoid submitting selected excerpts that conceal the surrounding exchange.

4. Choose the proper office and venue

The complaint is ordinarily filed with the Office of the City or Provincial Prosecutor having territorial authority over the offense. The DOJ’s prosecution staff may exercise national jurisdiction in matters within its authority. The NBI and PNP can investigate and help obtain technical evidence, but an investigative report should not be assumed to substitute for timely filing with the proper prosecution office.

Under the Rule on Cybercrime Warrants, the eventual criminal action is filed in a designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where damage to the natural or juridical person took place.

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of the others. Venue must be supported by specific facts; mere convenience or the ability to access a post from almost anywhere is not a safe basis for forum selection. Read the Rule on Cybercrime Warrants.

Cyber libel is generally outside mandatory Katarungang Pambarangay conciliation because its prescribed imprisonment and fine exceed the exclusions in Section 408 of the Local Government Code. A demand letter is also not an element of the offense.

5. Prepare and file the sworn complaint

Current DOJ filing guidance calls for an Investigation Data Form, a complaint-affidavit or sworn statement, witness affidavits, and supporting documents. Confirm the required number of copies, identification, filing method, and local intake requirements with the particular prosecution office. See the DOJ filing checklist.

The affidavit must be truthful, based on personal knowledge or properly identified records, and complete enough to establish each element. False statements in a sworn complaint can carry serious consequences.

What happens after filing

Cyber libel falls under the DOJ’s regular preliminary-investigation process because of its prescribed penalty. Under the 2024 DOJ-NPS Rules:

The prosecutor evaluates the complaint and supporting evidence.
If the complaint proceeds, the respondent receives a subpoena with the complaint and annexes.
The respondent is generally required to submit a sworn counter-affidavit and supporting evidence within 10 days from receipt, and to comply with the scheduled preliminary-investigation hearing.
The prosecutor may ask clarificatory questions or require additional affidavits when necessary.
The current prosecutorial standard is prima facie evidence with reasonable certainty of conviction—evidence that is admissible, credible, preservable, and sufficient, if uncontradicted, to establish the offense and the responsible person.
If the prosecutor approves the charge, an Information is filed in the designated cybercrime RTC. The judge then independently determines whether probable cause exists for a warrant of arrest.
An aggrieved party may generally move for reconsideration of the prosecutor’s resolution within 15 days from receipt. Further review is governed by applicable DOJ appeal rules and does not automatically suspend court proceedings.

At trial, the prosecution must still prove guilt beyond reasonable doubt. A prosecutor’s finding during preliminary investigation is not a conviction.

How to defend a cyber libel complaint

Act immediately after receiving a subpoena

Note the exact date and time of receipt.
Obtain a complete copy of the complaint, affidavits, and every annex.
Consult a Philippine criminal-defense lawyer promptly.
Preserve the account, device, drafts, messages, source material, research, and version history.
Do not retaliate online, threaten the complainant, coach witnesses, or publish new accusations.
Do not delete or alter potentially relevant material without first obtaining legal advice and preserving an accurate forensic copy.
Prepare the counter-affidavit around the elements and admissible evidence, not a general denial.

Failing to appear or submit a counter-affidavit allows the prosecutor to resolve the complaint on the existing record. Because statements in a counter-affidavit may later be used as admissions, it should be prepared carefully with counsel.

Examine the available defenses

Depending on the facts, a defense may include:

No defamatory imputation. The statement, read as a whole, did not attribute a discreditable fact or condition. Satire, rhetoric, criticism, and opinion may be protected, but an “opinion” implying undisclosed defamatory facts can still create liability.
No publication. No third person received or understood the statement.
No identification. The complainant was not named and the prosecution cannot show that readers reasonably understood the statement to refer to that person.
No authorship. The prosecution cannot reliably connect the accused to the account or content. A profile name or screenshot alone may not prove who controlled the account.
Mere reaction or share. The accused only received or reacted to another person’s post and did not author a new defamatory statement.
Truth with the statutory requirements. Under Article 361, truth may support acquittal when the imputation is true and was published with good motives and for justifiable ends. Proof of a non-criminal act or omission is generally restricted unless it concerns a government employee’s official duties. Truth is therefore not an automatic, unlimited defense in every case.
Privileged communication. Article 354 protects, subject to its conditions, a private communication made in the performance of a legal, moral, or social duty and a fair and true good-faith report, without comments or remarks, of a nonconfidential official proceeding or official act.
Fair commentary on a matter of public interest. Criticism concerning public officers, public figures, official conduct, or genuine matters of public concern may be qualifiedly privileged. The prosecution must then prove actual malice. The privilege is not a shield for knowingly false accusations or statements made with a high degree of awareness of probable falsity.
Absence of malice. Source records, verification efforts, contemporaneous messages, corrections, and the circumstances of publication may be relevant. Mere insistence that the author “believed it” is not necessarily enough.
Prescription. More than one year elapsed between legally proven discovery and the filing that interrupted prescription.
Improper venue or lack of jurisdiction. The Information does not allege or the evidence does not support a legally permissible venue.
Illegal or unauthenticated evidence. Digital material was not properly authenticated, is incomplete, was altered, or was obtained through an unlawful warrant or beyond its scope.
Duplicative prosecution. The same material is being charged as both traditional and online libel.
No applicable penal law at the time. Online statements published before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel.

Qualified privilege, truth, actual malice, identity, authorship, and context are intensely fact-dependent. A defense that worked in another case may fail when the documents, audience, or surrounding circumstances differ.

Possible penalties and civil liability

For offenses committed under the present penalty provisions, cyber libel may be punished by:

Imprisonment: prisión correccional in its maximum period to prisión mayor in its minimum period—approximately four years, two months and one day to eight years;
Fine: generally ₱40,000 to ₱1,500,000; or
Both, depending on the judgment.

The Supreme Court has confirmed that a court may impose a fine alone rather than imprisonment when justified by the circumstances. Fine-only treatment is not guaranteed. Read People v. Soliman.

The applicable penalty can depend on the law in force when the offense occurred, favorable retroactive amendments, modifying circumstances, and the court’s findings. Civil indemnity and proven actual, moral, or exemplary damages may also be awarded.

Filing a complaint does not itself produce an arrest warrant. If an Information is filed, the judge must independently find probable cause. Bail is ordinarily a matter of right before conviction in a cyber libel case, but the court fixes the conditions. Anyone who learns that a warrant has issued should arrange surrender and bail through counsel rather than risk an uncontrolled arrest.

Deletion, apology, correction, settlement, or an affidavit of desistance does not automatically erase criminal liability. Once a public offense is being prosecuted, the prosecutor and court—not the private complainant alone—control its disposition. These measures may nevertheless affect evidence, damages, settlement discussions, or the eventual penalty.

Evidence both sides should preserve

Both complainant and respondent should retain:

Original devices and storage media;
Unedited screenshots, videos, audio, and downloadable files;
URLs, account identifiers, timestamps, and time-zone information;
Full conversation threads and surrounding posts;
Drafts and version histories;
Source documents and research notes;
Emails and messages about creation, approval, publication, discovery, correction, or deletion;
Platform notices and takedown correspondence;
Witness names and contemporaneous statements;
Records connecting—or separating—a person from the account; and
Proof of claimed loss, injury, correction, apology, or mitigation.

Maintain a simple evidence log stating who collected each item, when it was collected, from what device or account, and whether copies were made. This helps establish integrity and reliability.

Common mistakes

Waiting for a platform to decide a report while the one-year period runs;
Treating a screenshot as complete proof of authorship;
Cropping out context, timestamps, URLs, or account details;
Sending a demand letter before preserving material that may be deleted;
Filing in a convenient but unsupported venue;
Assuming every harsh opinion or insult is automatically cyber libel;
Assuming truth alone always ends the case;
Naming everyone who liked or shared a post as a respondent;
Responding to a subpoena with another social-media post;
Missing the 10-day counter-affidavit or 15-day reconsideration period;
Deleting an account or resetting a device after receiving notice of a complaint;
Paying an unverified person who promises to “fix” the case; and
Believing that an apology or desistance automatically dismisses the prosecution.

When legal help is urgent

Seek counsel immediately when:

The one-year prescriptive period is close or the discovery date is disputed;
A subpoena, prosecutor’s resolution, summons, or warrant has been received;
The post came from an anonymous or possibly compromised account;
Platform records may soon be deleted;
Several publications, edits, videos, or accounts are involved;
The complainant is a public officer or public figure;
The case also involves threats, stalking, extortion, doxxing, intimate images, a minor, identity theft, or account hacking;
The author, server, or relevant records are outside the Philippines; or
A civil case, employment proceeding, administrative complaint, or data-privacy case is being pursued at the same time.

Qualified indigent accused may seek assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid and the DOJ Action Center may also provide assistance or appropriate referrals.

Frequently asked questions

Is a demand letter required before filing?

No. It is not an element of cyber libel or a general condition for filing the criminal complaint. A carefully prepared demand may help secure correction, apology, or settlement, but preserve the evidence first and do not let negotiations consume the prescriptive period.

Are screenshots enough?

Not always. They may show what appeared on a screen, but authorship, completeness, accuracy, publication, and authenticity may still be challenged. Preserve the original device, URL, context, witness testimony, and corroborating account records.

Can I file without a lawyer?

A complainant may personally execute and file a complaint-affidavit, but cyber libel involves technical evidence, strict prescription, and venue rules. Legal assistance is strongly advisable. A respondent should obtain counsel before signing a counter-affidavit because it may contain binding admissions.

Can someone be charged for merely sharing a post?

A bare like, reaction, or share is generally not punishable as cyber libel under Disini. A person who adds a new defamatory accusation may be treated as the original author of that added content.

What if the account is fake or anonymous?

A complaint may still be investigated, but the responsible person must be identified with competent evidence. Report promptly to the NBI or PNP cybercrime unit so lawful preservation and disclosure procedures can be considered.

Does deleting the post end the case?

No. Deletion does not erase an offense that was already completed through publication. It may limit continuing harm or be considered in mitigation, but it can also eliminate useful evidence if done without proper preservation.

Can public officials file cyber libel cases?

Yes. However, criticism concerning official conduct or a genuine public issue may be qualifiedly privileged, requiring proof of actual malice. Public office does not authorize knowingly false accusations, but neither does cyber libel law prohibit fair, evidence-based criticism.

Where can investigative assistance be requested?

The NBI Cybercrime Division accepts complaints, conducts preliminary interviews, receives sworn statements, and may examine relevant devices. Its current citizen-service procedure is available in the NBI Cybercrime Division Citizen’s Charter. The PNP cybercrime unit is another authorized law-enforcement channel.

Official legal sources

This article provides general legal information, not advice for a particular case. Cyber libel outcomes depend on the exact words, context, authorship evidence, discovery date, venue, and procedural record. Consult a Philippine lawyer who can review the complete documents. Law and official procedures were checked through August 3, 2026.