Quick answer

To file a Philippine cyber libel case, preserve the complete online post and account data, document when and how it was discovered, identify evidence linking the post to its author, and file a sworn complaint with the proper city or provincial prosecutor’s office. If technical investigation is needed—especially for an anonymous account—seek help promptly from the NBI Cybercrime Division or PNP Anti-Cybercrime Group.

To defend a case, do not ignore a prosecutor’s subpoena. Preserve the account and surrounding conversation, obtain the complete complaint and attachments, and submit a sworn, evidence-backed counter-affidavit by the stated deadline. Possible defenses include lack of authorship, failure to prove an element, privilege, fair comment, truth coupled with good motives and justifiable ends, absence of actual malice where constitutionally required, improper venue, and prescription.

The most urgent deadline is prescription. In April 2026, the Supreme Court En Banc confirmed that cyber libel generally prescribes in one year from discovery by the offended party, the authorities, or their agents—not automatically from the date of posting. There is no legal presumption that an online post was discovered as soon as it appeared. The discovery date and any interruption of prescription are factual matters that must be proved. See Causing v. People, G.R. No. 258524, April 8, 2026.

Because one year can expire while evidence, venue, or authorship is still being investigated, consult counsel and act well before the anniversary of discovery.

What qualifies as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, applies the Revised Penal Code’s libel provisions when the defamatory material is published through a computer system or another similar technological means.

The prosecution must establish all of the following beyond reasonable doubt:

Element	What it generally requires
Defamatory imputation	An allegation of a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person or juridical entity to contempt
Publication	Communication to at least one person other than the person defamed
Identification	The complainant must be named or reasonably identifiable from the words, images, circumstances, or surrounding context
Malice	The legally required form of malice, taking account of privilege, the complainant’s status, and whether the statement concerns a public matter
Use of a computer system	The material was published online or through information and communications technology
Authorship or responsibility	Competent evidence connects the respondent to the creation or legally relevant publication of the material

These elements were recognized in the Supreme Court’s decision in Disini v. Secretary of Justice.

A public Facebook post, video caption, blog entry, online article, group message, email copied to others, or defamatory image may qualify. A message sent only to the person allegedly defamed ordinarily lacks publication to a third person. A “private” group does not prevent publication if another member received the statement.

Courts consider the complete context. Adding “allegedly,” “in my opinion,” emojis, quotation marks, or a question mark does not automatically protect a statement that conveys or implies a provably false defamatory fact. Conversely, criticism, rhetorical exaggeration, satire, or an opinion with no provably false factual connotation may receive constitutional protection, depending on context.

Who may be charged?

The Cybercrime Prevention Act’s online-libel provision is constitutionally enforceable against the author of the libelous statement or article. In Disini, the Supreme Court invalidated aiding-and-abetting liability under Section 5 as applied to online libel because ordinary online reactions are too uncertain a basis for criminal punishment.

A person is therefore not automatically guilty merely for:

Receiving or reading a post;
Clicking a reaction button;
Following an account; or
Reacting to content without independently authoring a defamatory statement.

This protection should not be stretched too far. Someone who writes a new defamatory caption, adds a fresh accusation, creates an edited defamatory image, or independently publishes or causes the publication of defamatory material may be treated as an author based on the evidence. Liability cannot be decided from the platform’s “share” label alone.

Malice, truth, privilege, and public-interest speech

The general rule

Article 354 of the Revised Penal Code generally presumes a defamatory imputation to be malicious, even if true, unless good intention and justifiable motive are shown or the communication is privileged.

Truth is therefore not an automatic, all-purpose defense. Under Article 361, proof of truth must generally be accompanied by proof that the publication was made with good motives and for justifiable ends. The admissibility of truth regarding a non-criminal act is subject to additional statutory limitations, including the rule concerning government employees and facts related to their official duties.

Qualified privilege

Potentially privileged communications include:

A private communication made in the performance of a legal, moral, or social duty;
A fair and true report, made in good faith and without unnecessary comments, of a non-confidential judicial, legislative, or official proceeding; and
Fair comment on a matter of public interest, as developed in Supreme Court decisions.

Qualified privilege is not absolute immunity. It generally removes the ordinary presumption of malice and requires proof of actual malice. Excessive publication, personal spite, fabrication, misleading omissions, or unnecessary defamatory comments can defeat the defense.

Public officials and public figures

When the allegedly defamatory statement concerns a public official’s conduct or a public figure and a matter of legitimate public concern, the prosecution may have to prove actual malice beyond reasonable doubt. Actual malice means knowledge that the statement was false or reckless disregard of whether it was false. Mere error, poor research, or even serious negligence does not automatically equal actual malice; the question is whether the author actually had a high awareness of probable falsity or serious doubts about the claim.

The Supreme Court applied this standard in Guingguing v. Court of Appeals. Whether someone is a public figure, and whether a statement concerns public rather than purely private affairs, depends on the evidence.

The one-year deadline

Cyber libel prescribes in one year from the day the alleged offense is discovered by the offended party, the authorities, or their agents. Publication and discovery may occur on the same day, but the law does not presume that they did.

Article 91 of the Revised Penal Code also provides that:

Filing the proper complaint or information interrupts prescription;
The period may begin running again if the proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused; and
The period does not run while the offender is absent from the Philippines.

Do not assume that a platform report, demand letter, barangay blotter, police inquiry, consultation with a lawyer, or informal agency intake necessarily has the same interruptive effect as properly instituting the criminal action. File with the proper prosecution office as early as possible and obtain a stamped or electronic acknowledgment showing the filing date.

The complainant should preserve evidence of discovery, such as the original message forwarding the post, notification email, witness communication, or sworn account of when and how the material was first seen. The respondent may contest that date with contrary evidence—for example, an earlier reply, reaction, takedown demand, or communication showing prior knowledge.

Continued online availability, a later view, an edit, or republication can raise separate factual and legal issues. Do not assume that every new view restarts the one-year period or that an old post is automatically immune.

A separate civil action for defamation also generally has a one-year prescriptive period under Article 1147 of the Civil Code. Its accrual, interruption, and relationship to a criminal case should be evaluated independently.

Evidence to preserve immediately

Preserve evidence before asking the platform to remove the material. Screenshots alone can be challenged if they omit context or cannot be authenticated.

Keep, where available:

Full-page screenshots showing the exact statement, images, account name, date, time, and surrounding conversation;
The post’s direct URL and the account or profile URL;
A screen recording showing how the post is reached from the account;
Original downloaded photos, videos, audio, emails, or message exports;
Visible comments, captions, edits, replies, and audience settings;
Platform notifications and emails;
The device on which the material was received or viewed;
Names and affidavits of people who personally saw the post and recognized the complainant;
Evidence connecting the account to the alleged author, such as admissions, prior messages, linked contact details, consistent account activity, or lawfully obtained platform records;
Evidence of the discovery date;
For the defense, drafts, source records, research notes, communications, and documents showing verification, good faith, context, privilege, or lack of account control;
Evidence of actual harm, including lost contracts, employment consequences, medical or counseling records, and identifiable third-party reactions, if damages are sought.

Retain unedited originals. Make working copies, keep a simple evidence log, and note who collected each item and when. The Rules on Electronic Evidence require electronic documents to be authenticated; a readable printout may qualify as an original only when shown to reflect the electronic data accurately.

Do not hack an account, install spyware, impersonate another person, secretly access private data, or alter metadata to obtain evidence. Subscriber information, traffic data, and private content may require lawful preservation, disclosure, or cybercrime warrants.

How to file a criminal complaint

1. Confirm the correct offense, deadline, and venue

Before filing, determine:

The exact defamatory words, images, or audiovisual content;
Whether the complainant is identifiable;
Who authored or caused the relevant publication;
When the material was actually discovered;
Whether the statement was communicated to a third person;
Whether the complainant is a private person, public official, or public figure;
Whether privilege, fair comment, or public-interest speech is involved; and
Which prosecution office can properly lay venue.

Under Section 2.1 of the Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, the criminal action is filed in the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where any damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Access to a webpage from an arbitrary location should not be treated casually as sufficient venue; the Information must allege and the evidence must support a legally recognized connection to the chosen place.

2. Seek technical investigation when necessary

For an anonymous, impersonated, hacked, or disputed account, request investigative assistance promptly. The NBI’s official procedure for computer-crime victims includes an initial interview, sworn statements, supporting documents, and examination of relevant devices. See the NBI Cybercrime Division’s citizen service and NBI online complaint page.

Law enforcement may seek preservation and disclosure orders or cybercrime warrants. A private complainant ordinarily cannot compel a foreign platform to release subscriber or traffic data simply by sending a demand.

An investigative report can strengthen the case, but do not let investigation consume the one-year period. Coordinate the investigative and prosecutorial filings with counsel.

3. Prepare the complaint-affidavit

The sworn complaint should state specific facts rather than conclusions. It should ordinarily cover:

Complete identities and available addresses of the complainant and respondent;
The exact publication and its complete context;
The platform, account, URL, date, and computer-based means used;
How third persons received or saw the material;
How the complainant was identified;
Why the statement is defamatory;
Evidence connecting the respondent to the account or publication;
The date and circumstances of discovery;
Facts supporting malice or, when required, actual malice;
The factual basis for venue;
The harm caused and civil relief sought, if applicable; and
A numbered list of annexes and witnesses.

If the case concerns public affairs, address the statement’s falsity, the sources available to the respondent, any warning that the information was unreliable, and other evidence of knowledge or reckless disregard. Merely describing criticism as “malicious” is not a substitute for facts.

4. File with the proper prosecution office

A cyber libel charge carries a prescribed maximum exceeding six years, so it ordinarily proceeds through preliminary investigation before the proper Office of the City or Provincial Prosecutor.

The DOJ’s general checklist for complaints directly filed by private persons currently calls for:

Two copies of the sworn NPS Investigation Data Form;
A complaint-affidavit or sworn statement;
Separate witness affidavits;
Complete supporting documents; and
The required number of copies for the office and each respondent.

The current published central checklist specifies five copies plus the number of respondents for the complaint, witness affidavits, and supporting documents, but local offices may prescribe electronic formats, storage media, identification, or additional requirements. Confirm the receiving office’s current checklist and keep proof of filing. See the DOJ’s official preliminary-investigation filing guidance.

Barangay conciliation is generally not a prerequisite for cyber libel because its prescribed imprisonment exceeds the one-year limit for offenses within the lupon’s authority. The statutory exceptions are summarized in Supreme Court Administrative Circular No. 14-93.

5. Participate in preliminary investigation

Under DOJ Department Circular No. 015, series of 2024, prosecutors apply the standard of prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, capable of preservation and presentation, and sufficient—if unrebutted—to establish all elements and the responsible person’s identity.

The prosecutor may dismiss an insufficient complaint or issue a subpoena requiring a counter-affidavit. Clarificatory proceedings and limited reply and rejoinder affidavits may follow. If the evidence meets the standard, the prosecutor prepares an Information for filing in the designated Regional Trial Court acting as a cybercrime court.

A private complainant does not personally control the criminal prosecution. Once an Information is filed, the case is prosecuted in the name of the People of the Philippines under the direction and control of the public prosecutor.

How to defend a cyber libel complaint

Act immediately after receiving a subpoena

A prosecutor’s subpoena is not an arrest warrant, but ignoring it can cause the complaint to be resolved without the respondent’s evidence.

Immediately:

Record the date, time, and manner of receipt.
Check whether the complaint-affidavit, witness affidavits, and every cited annex were included.
Preserve the account, device, source files, messages, drafts, and complete context.
Stop discussing the complainant or case publicly.
Consult criminal-defense counsel before giving an interview, apology, admission, or informal statement.
Calendar the submission and hearing dates.

For a regular preliminary investigation under the 2024 DOJ-NPS Rules, the subpoena must give the respondent at least 10 calendar days from receipt of the subpoena and complaint-affidavit to submit the counter-affidavit. Follow the exact date stated. If attachments are missing or the period is improperly short, object and request complete records or appropriate relief in writing rather than simply missing the deadline.

Build the counter-affidavit around evidence

The counter-affidavit is a sworn evidentiary submission, not merely an argumentative letter. Address each element and attach documents and witness affidavits.

Depending on the facts, examine:

Authorship: Was the respondent the account holder and the person who made the post? Was the account compromised, shared, impersonated, or spoofed?
Authentication: Do the screenshots accurately represent an authentic post? Are the URLs, dates, metadata, and witness testimony sufficient?
Defamatory meaning: Does the complete context actually impute a discreditable fact?
Identification: Would a reasonable recipient identify the complainant?
Publication: Was the material communicated to anyone other than the complainant?
Malice: Was the communication privileged, made in good faith, or based on reasonable sources?
Public status: Is the complainant a public official or public figure, and did the publication concern official conduct or a public issue?
Actual malice: Is there evidence the respondent knew the statement was false or seriously doubted it?
Truth and motive: Can competent records establish substantial truth, good motives, and justifiable ends?
Fair report or fair comment: Was the post an accurate, good-faith report or protected commentary on a public matter?
Prescription: When was the post discovered, and when was the proper complaint filed?
Venue: What factual connection does the chosen place have to an element, computer system, or legally cognizable damage?
Prior proceedings: Is the same online publication being prosecuted twice under ordinary libel and cyber libel, contrary to double-jeopardy principles recognized in Disini?

A motion to dismiss filed in place of a counter-affidavit is generally not allowed under the current DOJ-NPS rules unless it is verified and contains the respondent’s defenses, in which event it is treated as the counter-affidavit.

A correction, apology, or settlement offer may be strategically useful, but it is not an automatic defense and may contain admissions. An affidavit of desistance also does not automatically terminate a public criminal prosecution.

Challenge an adverse prosecutor’s resolution promptly

Under the current regular preliminary-investigation rules, an aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. Further review is governed by separate DOJ requirements. If an Information has already been filed in court, a petition for review does not by itself halt the proceedings; the current DOJ rules contemplate an accompanying motion to suspend proceedings filed with the court.

Once a court summons, warrant, arraignment notice, or order is issued, obtain counsel immediately. Do not rely on a pending DOJ remedy as permission to disregard the trial court.

Possible penalties and civil liability

Article 355 of the Revised Penal Code, as amended by Republic Act No. 10951, provides for imprisonment, a fine of ₱40,000 to ₱1,200,000, or both, for written libel. Section 6 of the Cybercrime Prevention Act raises the corresponding imprisonment penalty by one degree when libel is committed through information and communications technology. The applicable imprisonment bracket is generally prisión correccional maximum to prisión mayor minimum—four years, two months and one day to eight years—although the actual indeterminate sentence can involve a lower minimum and depends on the governing sentencing rules, circumstances, and judgment.

Do not assume that a fine-only disposition, probation, or a particular bail amount is automatic. Before conviction by the RTC, bail is generally a matter of right for this offense, but the court determines the conditions and amount.

Civil liability may include proven actual, moral, or other legally recoverable damages. When the criminal action is instituted, civil liability arising from the alleged offense is generally deemed included unless it is waived, reserved, or previously filed separately. Article 33 of the Civil Code also permits an independent civil action for defamation, decided by preponderance of evidence, but there can be no double recovery for the same injury.

Common mistakes

Mistakes by complainants

Waiting while the one-year period runs;
Treating the posting date as the only relevant date without proving discovery;
Reporting the post to the platform before preserving it;
Filing cropped screenshots without URLs, context, or authentication evidence;
Naming an account holder without evidence that the person authored the post;
Assuming reputational harm alone proves all elements;
Ignoring actual-malice requirements involving public officials or public figures;
Filing in a convenient location with no valid venue facts;
Treating every liker, follower, or passive sharer as a criminal participant;
Assuming a demand letter or agency report necessarily interrupts prescription.

Mistakes by respondents

Ignoring the prosecutor’s subpoena;
Deleting the post, account, messages, or device data after learning of the complaint;
Posting retaliatory accusations or discussing the evidence online;
Filing only legal conclusions without a sworn factual response;
Assuming “it was true” is always a complete defense;
Assuming “opinion” or “shared post” automatically defeats liability;
Missing the counter-affidavit or 15-day reconsideration deadline;
Making an apology or settlement admission without legal advice;
Assuming an anonymous or pseudonymous account cannot be traced through lawful process.

When legal help is urgent

Seek a Philippine lawyer immediately if:

The one-year anniversary of discovery is approaching;
The author is unknown and platform data may disappear;
You received a prosecutor’s subpoena, court summons, or warrant;
The complaint omits attachments or gives an unusually short deadline;
The post concerns a public official, election, government contract, corruption allegation, journalist, or other public-interest matter;
The case involves a hacked or impersonated account;
The author, platform, computer system, or complainant is outside the Philippines;
Multiple criminal counts or a separate civil case are threatened;
Law enforcement wants to inspect or seize a device;
There are related threats, stalking, doxxing, extortion, or risks to physical safety.

Qualified indigent persons may seek assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines and the judiciary’s Unified Legal Aid Service may also help locate legal-aid resources.

Frequently asked questions

Can I file if the post has already been deleted?

Yes, potentially, but proof becomes harder. Preserve any existing screenshots, links, notifications, message exports, witness affidavits, or cached copies. Law enforcement may be able to pursue platform data through lawful procedures, subject to availability and retention periods.

Can I file against an anonymous account?

An investigation may begin, but a charge ultimately needs competent evidence identifying a responsible person. Report promptly to a cybercrime investigative unit so that preservation and disclosure remedies can be assessed.

Is a demand letter required before filing?

No general rule makes a prior demand or takedown request an element of cyber libel. A carefully drafted request may support correction or settlement, but it does not replace timely filing.

Does deleting or apologizing erase criminal liability?

No. Deletion may limit continuing harm, and an apology may affect settlement or the assessment of good faith, but neither automatically extinguishes criminal liability.

Is sharing someone else’s post cyber libel?

Not automatically. Passive receipt or reaction is not enough under Disini. Liability depends on whether the person independently authored defamatory material, added a new accusation, or otherwise engaged in legally relevant publication. The exact content and conduct matter.

Can a true statement still result in a case?

A complaint may still be filed. In a criminal prosecution, truth generally must be considered together with good motives and justifiable ends, subject to Article 361 and constitutional rules for public-interest speech.

Does criticism of a public official amount to cyber libel?

Not merely because it is harsh or embarrassing. Where official conduct or a matter of public concern is involved, the prosecution may have to prove beyond reasonable doubt that a defamatory factual statement was published with knowledge of falsity or reckless disregard for truth. Knowingly fabricated accusations are not protected.

Can the complainant file both ordinary libel and cyber libel for the same post?

The same defamatory online publication cannot be punished twice as ordinary libel and cyber libel when that would violate double jeopardy. Separate publications or separate authored statements may require a different analysis.

Must the parties first go to the barangay?

Generally no for cyber libel, because its prescribed penalty exceeds the Katarungang Pambarangay limit. Other disputes accompanying the case may follow different rules.

Does a foreign post fall under Philippine law?

Possibly. Republic Act No. 10175 contains jurisdictional provisions covering, among other situations, Filipino offenders, elements committed in the Philippines, relevant computer systems situated here, and damage occurring to a person in the Philippines. Cross-border evidence, service, enforcement, and venue require case-specific advice.

Is a complainant guaranteed that charges will be filed?

No. The prosecutor must find prima facie evidence with reasonable certainty of conviction. Even after an Information is filed, guilt must still be proved in court beyond reasonable doubt.

Official legal sources

This article provides general legal information, not advice for a particular case. Facts, documents, venue, and procedural history can change the result. Philippine legal sources and procedures were checked as of 3 August 2026.