Quick answer

Cyber libel is generally committed when a person publishes a defamatory statement through Facebook, Messenger, X, TikTok, YouTube, a website, email, or another computer system. The prosecution must establish the elements of libel under the Revised Penal Code, the use of a computer system, and the accused’s responsibility for the publication.

If you are the complainant, preserve the original online evidence immediately, identify the author and witnesses, and file a properly supported complaint-affidavit with the prosecution office that has legal venue. A police or NBI cybercrime unit can assist when account attribution, subscriber information, or forensic evidence is needed.

If you are accused, do not ignore a subpoena. Obtain the complaint and attachments, preserve your own evidence, and submit a counter-affidavit within the deadline stated in the subpoena or applicable prosecution rules. Possible defenses include failure to prove authorship, lack of identification or publication, privileged communication, protected opinion, truth accompanied by good motives and justifiable ends, absence of actual malice where constitutionally required, improper venue, and prescription.

Act quickly. In Causing v. People, the Supreme Court ruled—and in April 2026 reaffirmed—that cyber libel prescribes in one year from discovery of the offense by the offended party or authorities. Whether a particular complaint is already time-barred depends on provable dates and any legally recognized interruption of prescription.

What Philippine law treats as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 penalizes libel, as defined under Article 355 of the Revised Penal Code, when committed through a computer system or similar means.

A cyber-libel prosecution ordinarily requires proof of:

A defamatory allegation. The statement attributes a crime, vice, defect, act, omission, condition, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Identification. The complainant must be identifiable, even if not expressly named. Identification may arise from context, photographs, job titles, surrounding posts, or testimony from readers who understood who was being discussed.
Publication to another person. Someone other than the complainant must have seen, received, or understood the statement. A message sent only to the person being criticized ordinarily lacks this element, although sending it to a group chat or copying another recipient may constitute publication.
Malice. Article 354 generally presumes malice from a defamatory imputation, subject to privileged communications and constitutional protections. In cases involving public officials, public figures, or matters of public concern, the applicable malice standard can require closer analysis.
Use of a computer system. The publication must have been made through an internet-connected device, platform, electronic message, website, or comparable computer system.
Responsibility of the accused. The evidence must connect the accused to the account and the particular publication. A profile name or screenshot alone does not necessarily prove who operated the account.

Context matters. Courts assess the words as a whole, their ordinary meaning, the audience, the surrounding conversation, and whether the statement conveyed a factual accusation rather than mere insult, rhetoric, satire, or opinion.

Who may be held liable

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the person who originally posts the unlawful material. It did not uphold an automatic extension of criminal liability to everyone who merely receives, “likes,” reacts to, or shares it under the Cybercrime Prevention Act’s aiding-or-abetting provision.

That does not make every repost or comment safe. A person who adds a new defamatory caption, makes an independent accusation, materially republishes the claim as their own, or participates in creating the original publication may face a different factual and legal assessment. Liability cannot be decided from the platform button used alone.

Administrators, editors, employers, media organizations, and corporations are not automatically criminally liable merely because material appeared on an account or page associated with them. Their actual participation, authority, knowledge, and the governing provisions must be proved.

Criminal exposure and possible civil liability

Cyber libel carries the penalty for libel increased by one degree under Section 6 of Republic Act No. 10175. The precise imposable sentence depends on the applicable penal provisions, mitigating or aggravating circumstances, and the Indeterminate Sentence Law. Courts may also impose a fine and civil damages when legally supported.

Imprisonment is therefore a real possibility, but it is not correct to assume that every conviction automatically results in immediate incarceration. Sentencing and eligibility for probation or other relief depend on the judgment, the sentence imposed, the accused’s circumstances, and the procedural choices made after conviction.

A defamatory online publication may also create civil liability. Under the Rules of Criminal Procedure, the civil action arising from the offense is generally deemed instituted with the criminal case unless it was waived, reserved when legally permitted, or filed beforehand. Separate claims may also be considered under the Civil Code, including Articles 19, 20, 21, 26, and 33. Filing both criminal and civil proceedings requires careful coordination to avoid procedural conflicts and double recovery.

The Supreme Court has also held that a person may not be punished for both ordinary libel and cyber libel for the same single publication when doing so would violate the prohibition against double jeopardy.

The one-year prescriptive period

The current controlling rule is that cyber libel prescribes in one year from discovery, not automatically from the date the material was uploaded. The Supreme Court explained this in Causing v. People and reaffirmed it in its April 2026 resolution.

The discovery date is a factual matter. An offended person is not necessarily presumed to have discovered a social-media post on the day it was published because visibility can depend on privacy settings, group membership, internet access, or platform connections.

Do not calculate prescription casually. Relevant questions include:

When did the complainant or authorities actually discover the publication?
What proof establishes that date?
Was a complaint filed with the prosecutor or another proper authority within the period?
Did a later edit amount to a legally significant republication?
Was the material newly posted, merely still accessible, or independently republished?
Did any event recognized by law interrupt the running of prescription?

The continuing online availability of an old post should not automatically be treated as a fresh offense every day. Because a wrong calculation can end an otherwise valid case—or expose someone to a stale prosecution—obtain legal advice well before the apparent deadline.

How to file a cyber-libel complaint

1. Preserve the publication before requesting removal

Capture and retain:

full-page screenshots showing the statement, account name, date, time, and surrounding context;
the complete URL or platform link;
the original message, email, video, audio, or webpage—not only a cropped image;
comments, captions, edits, reposts, audience or group information, and engagement records;
the device on which the material was received or viewed;
downloaded account data, message exports, email headers, and original media files;
the names and contact details of people who saw the publication;
records showing when and how you first discovered it;
proof identifying you as the person referred to;
proof connecting the account to the suspected author; and
evidence of harm, such as lost work, cancelled contracts, customer messages, medical records, or contemporaneous communications.

Keep an untouched original copy and work from duplicates. Record how each item was obtained and who handled it. Do not alter dates, add annotations to the only copy, or rely entirely on screenshots forwarded by someone else.

Electronic evidence must be authenticated. The Rules on Electronic Evidence allow electronic documents, but the party offering them must still establish authenticity, integrity, and relevance.

2. Assess the complete statement and possible defenses

Save the entire thread, article, video, or conversation. A cropped sentence can hide qualifiers, sources, humor, questions, replies, or surrounding facts that materially change its meaning.

Before filing, consider whether the statement was:

substantially true;
an opinion that did not imply undisclosed false facts;
a fair comment on a matter of public interest;
made in a private or official setting protected by privilege;
a fair and true report of an official proceeding made without improper remarks;
directed at a public official’s official conduct; or
unsupported by evidence identifying the alleged author.

Truth alone is not an automatic defense in every criminal-libel case. Article 361 generally requires proof of the truth together with good motives and justifiable ends, subject to its special treatment of imputations involving public officers and official duties.

3. Identify the correct office and venue

A complainant may seek investigative assistance from the:

NBI Cybercrime Division or an appropriate NBI office;
PNP Anti-Cybercrime Group or a local cybercrime unit; and
city, provincial, or DOJ prosecution office with legal authority over the case.

The NBI and PNP are designated cybercrime law-enforcement authorities under Republic Act No. 10175, but they do not decide guilt. Prosecutors determine whether the evidence warrants filing an information, and the Regional Trial Court tries the case.

Venue is jurisdictional in criminal cases and should not be selected merely for convenience. The rules governing libel venue may consider the complainant’s actual residence, official station in qualifying public-officer cases, or where the material was printed and first published. In Bonifacio v. RTC of Makati, the Supreme Court held that mere online access in a city was not equivalent to an allegation that the material was printed and first published there.

Cybercrime jurisdiction under Section 21 of Republic Act No. 10175 is broad, but jurisdiction and proper territorial venue are not identical. Cross-border publication, anonymous accounts, travel, multiple residences, and posts made abroad require individualized analysis before filing.

4. Prepare the complaint-affidavit and supporting affidavits

The complaint-affidavit should clearly state, from personal knowledge:

the exact words, images, or statements complained of;
where and how they appeared;
why they are defamatory;
how the complainant was identified;
who received or viewed them;
why the respondent is believed to be the author or publisher;
when the publication was discovered;
facts supporting proper venue; and
the harm caused.

Attach properly marked evidence and affidavits from witnesses who saw the publication or can authenticate relevant records. Avoid exaggeration and do not omit contextual material that may be unfavorable.

The prosecutor applies the current DOJ-NPS evidentiary standard of prima facie evidence with reasonable certainty of conviction, not merely the existence of an accusation. Filing an incomplete complaint in the hope that authorities will later find all missing evidence is risky.

5. Seek lawful preservation or disclosure where needed

Platforms may delete or overwrite data, and subscriber or traffic records may have limited retention periods. Under Republic Act No. 10175, service providers must preserve specified traffic data and subscriber information for at least six months from the transaction, while content data may be preserved following a lawful preservation order. Disclosure of protected data generally requires the process and judicial authorization prescribed by law.

A private complainant should not impersonate another person, hack an account, secretly obtain passwords, or pressure a service provider into releasing protected records. Ask counsel or cybercrime investigators whether a preservation request, disclosure warrant, search warrant, or other remedy under the Rule on Cybercrime Warrants is appropriate.

6. Follow the prosecutor’s notices

Depending on the applicable DOJ-NPS procedure, the prosecutor may require further affidavits, clarificatory participation, electronic filing, or other submissions. Keep proof of filing and service. A prosecutor’s resolution may be subject to a motion for reconsideration or petition for review, but the correct remedy and deadline depend on the issuing office, governing circular, and case posture.

How to defend a cyber-libel complaint

1. Do not ignore the subpoena

Note the date of receipt and the deadline printed on the subpoena. Give the complete packet to counsel immediately. Failure to submit a counter-affidavit can allow the prosecutor to resolve the complaint from the complainant’s evidence, subject to the applicable rules.

Ask for legible copies of the complaint and all attachments if anything is missing. Do not answer factual accusations through social media.

2. Preserve your evidence without altering it

Keep:

the device and account records;
drafts and original files;
the full conversation or publication;
source documents and research notes;
timestamps, login alerts, and account-security records;
communications with editors, page administrators, or contributors;
proof of hacking, impersonation, shared access, or loss of account control;
documents supporting truth, good motive, privilege, or public interest; and
proof bearing on venue, discovery date, and prescription.

Do not delete or edit the disputed post merely to make evidence disappear. After preserving it and consulting counsel, removal or correction may help limit further harm, but it does not automatically erase a completed publication.

3. Address every element, not only whether the words were “true”

A useful defense analysis asks:

Is the complainant actually identifiable?
Did anyone other than the complainant receive the statement?
Is the statement defamatory when read in full context?
Is it fact, opinion, satire, rhetorical hyperbole, or a question?
Who created and controlled the account?
Can the prosecution authenticate its screenshots and electronic records?
Was the communication privileged?
If truth is asserted, can it be proved through admissible evidence?
Were good motives and justifiable ends present?
Does the subject involve a public official, public figure, or public concern?
Is there proof of actual malice where that standard applies?
Was the complaint filed in the proper venue and within one year from discovery?
Did the charged publication occur after the Cybercrime Prevention Act became effective?

A denial unsupported by records is usually weaker than a fact-specific counter-affidavit backed by authentic documents and witness affidavits.

4. Understand privileged communication and public-interest speech

Article 354 recognizes qualifiedly privileged communications, including certain private communications made in the performance of a legal, moral, or social duty and fair, true reports of official proceedings made in good faith and without added comments.

Qualified privilege does not create blanket immunity. It may be defeated by proof of actual malice, bad faith, excessive publication, knowingly false assertions, or reckless disregard of truth. The exact recipients, purpose, wording, sources, verification efforts, and additions to an official report matter.

Criticism of public officials receives strong constitutional protection, particularly when directed at official conduct. But labeling a post “public interest,” “opinion,” or “for awareness” does not protect false factual accusations made with the legally required degree of malice.

5. Challenge unlawful digital evidence appropriately

Computer data obtained without the warrant required by law, or beyond a warrant’s authority, may be inadmissible under Section 18 of Republic Act No. 10175. Separately, ordinary questions of authentication, completeness, hearsay, relevance, and chain of custody may apply.

This does not mean every screenshot requires a cybercrime warrant. A recipient may voluntarily preserve and testify about a message received, while compelled access to protected account data raises different issues. The method by which each item was acquired must be examined.

6. Prepare for the court stage

If the prosecutor finds sufficient evidence, an information may be filed in the Regional Trial Court. The court—not the prosecutor—determines guilt beyond reasonable doubt.

Once a case is filed, counsel should promptly assess:

whether the information properly alleges the offense and venue;
whether there is a basis for a motion to quash;
warrant and bail issues;
preservation and disclosure of defense evidence;
arraignment and pre-trial deadlines;
provisional dismissal, mediation, or settlement implications where legally available; and
the consequences of appeal, probation, or other post-judgment remedies.

An apology, retraction, correction, or settlement may affect the complainant’s position or the assessment of damages, but it does not automatically extinguish criminal liability after an offense has been completed.

Common mistakes to avoid

Waiting for the post to disappear. Platform content and account records can be removed quickly.
Saving only a cropped screenshot. Preserve the URL, full context, original file, account details, and discovery evidence.
Assuming an anonymous account cannot be traced. Lawful subscriber and traffic-data procedures may be available.
Assuming the profile name proves authorship. Account attribution still requires evidence.
Filing wherever the complainant happened to read the post. Mere access may not establish venue.
Treating every insult as libel. The statement must satisfy the legal elements of defamation.
Believing truth is always enough. Good motives, justifiable ends, privilege, public status, and admissible proof may matter.
Naming every liker or sharer as an accused. Liability must be tied to the person’s own legally punishable conduct.
Posting threats or a public rebuttal that creates a second dispute. Preserve evidence and use measured, lawful communications.
Missing a subpoena, review, court, or prescription deadline. Record receipt dates and seek counsel immediately.
Obtaining evidence by hacking or coercion. Unlawful collection may create separate liability and evidentiary problems.
Assuming deletion ends the case. Removal may stop further dissemination but does not necessarily undo an earlier publication.

When legal help is urgent

Consult a Philippine lawyer promptly when:

the one-year period may expire soon;
you received a prosecutor’s subpoena, court summons, information, or arrest warrant;
the alleged author is anonymous or account data may soon be lost;
the post involves a public official, journalist, employer, school, business, or organized campaign;
the material includes threats, intimate images, stalking, identity theft, or personal-data exposure;
the publication or parties are in different cities or countries;
substantial income, employment, safety, or reputation is at risk;
police seek access to a device or account;
a platform, employer, or government office requests a formal response; or
settlement, retraction, or public correction is being considered.

Other laws may apply alongside—or instead of—cyber libel, including laws on threats, unjust vexation, identity theft, data privacy, violence against women and children, voyeurism, child sexual-abuse material, and obstruction of justice. The correct remedy depends on the actual content and conduct.

Frequently asked questions

Is a demand letter required before filing?

No general rule makes a demand letter a required element of cyber libel. A carefully drafted request for correction, retraction, or removal may be useful, but it should not cause the complainant to miss the prescriptive period or destroy evidence.

Can a private Messenger or group-chat message be cyber libel?

It can be if a defamatory statement identifying the complainant was communicated through a computer system to at least one person other than the complainant. The group’s privacy does not necessarily eliminate publication, although it may affect privilege, context, and damages.

Are likes, reactions, and shares automatically criminal?

No. Disini rejected automatic aiding-or-abetting liability for ordinary online reactions to cyber-libel content. A person who writes a new defamatory accusation or independently adopts and republishes the claim may present a different case.

Can an opinion be cyber libel?

A pure opinion that cannot reasonably be understood as asserting a false fact may be protected. Calling something an “opinion,” however, does not control if the wording or context implies undisclosed defamatory facts.

Does deleting the post prevent a case?

Not necessarily. Cyber libel may already have been completed when another person received the publication. Preserve the material before deletion, and obtain advice about removal, correction, or retraction.

Where is the complaint filed?

Usually with the prosecution office that has proper venue, sometimes after assistance from the NBI or PNP cybercrime unit. Residence, official station, first publication, and the facts connecting the offense to the locality require legal analysis. Mere online access in a place is not automatically sufficient.

How long does the complainant have?

Under the Supreme Court’s current ruling in Causing, cyber libel prescribes in one year from discovery by the offended party or authorities. The provable discovery date and any interruption of prescription must be examined case by case.

Can the complainant recover damages?

Potentially. Civil liability arising from the offense may accompany the criminal case, and other Civil Code remedies may be available. The claimant must prove the legal basis, causation, and appropriate damages.

Can the parties settle?

They may discuss retraction, correction, apology, removal, or compensation, but private settlement does not automatically terminate a criminal prosecution. Any agreement should be reviewed for voluntariness, enforceability, confidentiality, tax consequences, and its actual effect on pending proceedings.

What if the account was hacked or impersonated?

Preserve security alerts, login histories, recovery emails, device records, reports to the platform, and contemporaneous messages. Report unauthorized access promptly. Impersonation can defeat proof of authorship and may constitute a separate cybercrime, but it must be supported by credible evidence.

Official legal sources

This article provides general legal information, not advice for a specific case and not a substitute for consultation with a Philippine lawyer. Facts, documents, venue, and procedural posture can change the result. Sources and current legal developments were checked through September 11, 2026.