Quick answer

To file a cyber libel case in the Philippines, preserve the online material and proof of who authored, controlled, published, and saw it, then file a sworn complaint with the proper prosecution office. Investigative help may be requested from the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DOJ Office of Cybercrime.

Act immediately. The Supreme Court now holds that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Filing the proper complaint or information interrupts prescription. The date of discovery is a factual issue, so keep evidence showing exactly when and how the post was first found. Do not assume that a demand letter, platform report, police blotter, or informal request for investigation stops the one-year period. See Causing v. People, G.R. No. 258524, April 8, 2026.

To defend a case, do not ignore a subpoena, invitation, information, or arrest warrant. Preserve the account, device, complete conversation, and all evidence of context or account compromise. Obtain counsel before submitting a counter-affidavit, giving a statement, deleting content, contacting the complainant, or surrendering a device.

Cyber libel is serious but not established merely because an online statement was insulting, embarrassing, or false. The prosecution must prove every legal element and identify the accused as the responsible author beyond reasonable doubt at trial.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or similar technology.

The prosecution must establish:

A defamatory imputation. The material imputes a crime, vice, defect, or another act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the material. A message sent only to the person concerned ordinarily lacks this element, although another offense or civil claim may still apply.
Identification. The complainant is named or can be identified from the words, images, surrounding facts, or circumstances. Naming the person is not indispensable if people familiar with the situation would reasonably know who was being discussed.
Malice. As a general rule, a defamatory imputation is presumed malicious even if true, unless a recognized privilege or constitutional standard applies. In some cases, the prosecution must affirmatively prove actual malice.
Use of a computer system or information and communications technology. This includes online posts, articles, captions, videos, comments, emails, group messages, and similar electronic communications.
Authorship or legally attributable publication by the accused. A profile name, photograph, or screenshot does not by itself prove who controlled an account or wrote a post.

The material must be read as a whole and in its actual context. Courts consider the language used, audience, accompanying image or video, conversation, surrounding posts, and circumstances of publication—not merely an isolated word or sentence.

Important exceptions and defenses

Truth is not automatically a complete defense

Article 361 of the Revised Penal Code permits proof of truth in a criminal libel prosecution, but acquittal generally requires both:

that the matter charged as libelous was true; and
that it was published with good motives and for justifiable ends.

Proof of the truth of an imputed act or omission that is not a crime is generally inadmissible unless the imputation concerns a government employee and facts related to the discharge of official duties. Documentary proof and reliable witnesses are much stronger than a claim that the author “believed it was true.”

Privileged communications

Article 354 recognizes two principal forms of qualified privilege:

a private communication made to another person in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of a nonconfidential judicial or official proceeding, a statement made in it, or an act performed by a public officer in an official function.

Privilege is fact-dependent. Circulating an accusation beyond people with a legitimate interest, adding unsupported accusations to an official report, or publishing mainly to injure the person may defeat the defense. When a communication is qualifiedly privileged, malice is not presumed; malice in fact must be proved.

Public officials, public figures, and public concerns

When criminal libel concerns a public figure—particularly a public officer—and a matter of public concern, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was true or false. The burden remains with the prosecution. Honest criticism of official conduct receives greater constitutional protection, but fabricated factual accusations and statements made with reckless disregard for readily available contrary information may still be actionable. See Daquer v. People, G.R. No. 206015, June 30, 2021.

Opinion and fair comment

Calling a statement an “opinion” does not automatically protect it. Courts examine whether it is genuine comment, rhetorical criticism, or an assertion of facts capable of being proved true or false. Fair comment on a matter of public interest may be protected when based on facts honestly stated and not motivated solely by an intention to injure.

Lack of publication or identification

A defense may exist when:

no third person received the communication;
the complainant cannot reasonably be identified;
the material was altered or taken out of context; or
the words, understood in their complete setting, were not defamatory.

Failure to prove the online author

The prosecution must connect the accused to the account and the specific publication. Relevant proof may include admissions, eyewitness testimony about account use, information known only to the author, writing patterns, prior consistent activity, device forensics, platform or telecommunications records, IP data, and other circumstantial evidence.

The Supreme Court’s guideposts in XXX v. People, G.R. No. 274842, October 22, 2025, are summarized in this official Supreme Court guidance on social-media identity.

Prescription, venue, and other procedural defects

Possible defenses include:

filing more than one year after legally proven discovery, subject to interruption and statutory exceptions;
filing in a place unsupported by the facts;
failure of the complaint or information to allege an offense;
prosecution of a post made before the Cybercrime Prevention Act took effect;
charging the same online publication both as traditional libel and cyber libel; or
serious defects in the acquisition, authentication, or handling of electronic evidence.

Some objections must be raised before arraignment or may be waived. Counsel should examine them before the accused enters a plea.

Who may be liable for likes, reactions, shares, and comments

In Disini v. Secretary of Justice, the Supreme Court sustained cyber libel as applied to the original author, while rejecting liability based merely on aiding or abetting by people who simply receive and react to online material.

A like, emoji reaction, or unadorned receipt of a post is therefore not automatically cyber libel. Sharing is not automatically equivalent to authorship of the original statement. However, someone who adds a new defamatory caption, comment, accusation, edited image, or narration may become the original author of that separate material. Liability depends on the person’s own words and conduct, not the platform’s label for the interaction.

How to file a cyber libel complaint

1. Preserve the complete digital evidence

Preserve the evidence before requesting removal or blocking the account.

Preserve	Why it matters
Full screenshots showing the statement, username, date, time, and surrounding content	Establishes the words used and their context
Exact post, profile, article, video, and comment URLs	Helps locate and verify the source
Screen recording showing navigation from the profile or page to the material	Reduces disputes about cropping or fabrication
Original image, audio, video, email, or message export	Preserves better-quality and metadata-bearing files
Complete thread and posts before and after the disputed material	Shows context and avoids selective presentation
Profile page, account ID, linked email or number, and earlier account activity	Helps establish control or authorship
Comments, shares, audience settings, group membership, and witness details	Helps prove publication to third persons
Date, time, device, and person who first discovered the material	Critical to the one-year prescriptive period
Messages admitting authorship or discussing the post	May help establish identity and intent
Records disproving the accusation and evidence of reputational or financial harm	Supports the merits and possible damages
The original device and untouched files	Allows authentication or forensic examination

Do not crop, enhance, annotate, translate over, or otherwise alter the only copy. Keep untouched originals and make separate working copies. Record who collected each item, when it was collected, and where it has been stored. A person with firsthand knowledge should be available to authenticate the material.

Do not hack an account, install spyware, guess passwords, impersonate another person, or secretly intercept private communications to obtain evidence. Illegally obtained material can create evidentiary problems and possible criminal or civil exposure.

2. Record the discovery date

Prepare a short sworn-ready chronology stating:

when the material was posted, if known;
when the complainant first learned of it;
who showed or sent it to the complainant;
when authorities or their agents first discovered it;
when screenshots and recordings were made; and
when each complaint or request for investigation was filed.

Under Article 91 of the Revised Penal Code, the one-year period is interrupted by filing the complaint or information and may begin running again if proceedings end without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused. The period does not run while the offender is absent from the Philippines. Because these rules can produce difficult factual questions, file well before the apparent deadline.

3. Identify the proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 is filed in the designated cybercrime court of the province or city:

where the offense or any element occurred;
where any part of the computer system used was situated; or
where any damage to a natural or juridical person took place.

The first properly filed court acquires jurisdiction to the exclusion of the others. Venue must be supported by specific facts; merely alleging that online material could be viewed everywhere is unsafe. File the preliminary-investigation complaint with the prosecution office corresponding to a legally supportable venue.

4. Prepare the complaint-affidavit and supporting affidavits

A useful complaint-affidavit should clearly state:

the complainant’s and respondent’s identifying details and addresses, if known;
the exact defamatory words, image, video, or other material;
an accurate translation where relevant, while retaining the original;
why the imputation is defamatory;
how the complainant was identified;
how and to whom it was published;
facts connecting the respondent to the account and post;
facts showing malice, or actual malice where required;
why any claimed privilege does not apply;
the posting and discovery dates;
facts supporting venue;
the harm caused; and
a numbered list of attached evidence.

Include affidavits from people who personally saw the post, can identify the complainant, know who controlled the account, or have firsthand knowledge relevant to falsity, malice, publication, and harm.

The DOJ’s current intake page lists the requirements for filing a preliminary-investigation complaint, including the sworn Investigation Data Form, complaint-affidavit or sworn statement, witness affidavits, and supporting evidence. Confirm current copy, identification, fee, notarization, and local filing requirements directly with the receiving office.

5. Consider investigative assistance

Anonymous, deleted, impersonated, or compromised accounts often require technical investigation. The NBI Cybercrime Division, PNP Anti-Cybercrime Group, and DOJ Office of Cybercrime can assist with investigation and lawful preservation or acquisition of computer data.

Service-provider records may be time-sensitive. Law-enforcement authorities may seek preservation orders and cybercrime warrants for disclosure, search, seizure, or examination where legally justified. A private complainant normally cannot compel a platform to disclose subscriber or traffic data simply by making a private request.

6. File with the proper prosecution office

Cyber libel carries a maximum imprisonment exceeding six years, so it undergoes preliminary investigation. Under DOJ Department Circular No. 15, series of 2024, the prosecutor evaluates whether there is prima facie evidence with reasonable certainty of conviction. The Supreme Court upheld these DOJ rules in Meking v. Remulla, G.R. No. 280455, November 11, 2025.

Filing an investigative report with a law-enforcement office and filing the sworn complaint for preliminary investigation are not necessarily the same event. Have counsel ensure the correct complaint reaches the proper prosecutorial authority within the one-year period.

What happens during preliminary investigation

If the complaint is sufficient in form and its evidence is complete, it is docketed and assigned to an investigating prosecutor. The prosecutor may recommend outright dismissal or issue a subpoena attaching the complaint and evidence.

The respondent’s subpoena will state the date for submitting the counter-affidavit and supporting evidence. Under the 2024 DOJ-NPS Rules, the date must give the respondent at least 10 days from receipt of the subpoena and complaint. Treat the stated date as controlling and do not assume an extension will be granted.

A preliminary investigation is not a full trial. The prosecutor evaluates the affidavits, documents, electronic evidence, and any clarificatory matters. There is ordinarily no right to cross-examine the other party at this stage.

The DOJ rules direct the investigating prosecutor to resolve a regular preliminary-investigation complaint within 60 calendar days from assignment, with a maximum 30-day extension in specified situations such as complex issues, countercharges, consolidation, or reassignment. These are administrative disposition periods; delay does not automatically establish dismissal or acquittal.

The prosecutor may:

dismiss the complaint;
require additional case build-up;
find sufficient evidence and prepare an information for filing in the Regional Trial Court; or
resolve only the charges supported by the evidence.

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review may also be available under applicable DOJ rules. Once an information has been filed in court, a DOJ review does not automatically suspend court proceedings; the necessary motion to suspend must be filed in court. Obtain counsel immediately because these remedies have strict form, service, attachment, and timing requirements.

How to defend a cyber libel complaint

Preserve first; do not panic-delete

Save the exact post, full thread, drafts, source materials, account history, login alerts, device records, emails, and communications with page administrators. Preserve the original device. After preservation, discuss with counsel whether the material should be removed, corrected, or retracted to prevent further harm.

Deleting a post does not automatically prove guilt, but it can destroy evidence needed to establish context, authorship, privilege, truth, or account compromise. Leaving it online can also increase damage. This decision should be made promptly and deliberately.

Read the accusation element by element

A counter-affidavit should do more than deny the complaint. It should identify which elements are missing and attach admissible supporting evidence. Depending on the facts, address:

whether the statement was defamatory when read in full;
whether another person actually received it;
whether the complainant was identifiable;
whether the respondent authored or controlled the account;
whether the account was hacked, cloned, impersonated, or shared;
whether the statement was true and made with good motives and justifiable ends;
whether it was a privileged communication;
whether it concerned a public official or public figure and actual malice is unproved;
whether it was fair comment rather than an actionable factual assertion;
whether the one-year period expired;
whether venue is proper;
whether the post predates the law; and
whether electronic evidence is complete, authentic, lawfully acquired, and attributable to the respondent.

If account compromise is genuine, preserve security alerts, password-reset notices, login history, device lists, reports to the platform, contemporaneous messages, and any prompt report made to law enforcement. A bare “dummy account” defense is weak when contradicted by account history and private information known to the accused.

Avoid damaging admissions or retaliation

Do not post a public “defense” that repeats or expands the accusation. Do not pressure the complainant or witnesses, fabricate screenshots, coordinate false affidavits, or threaten a countercase. Do not sign an affidavit prepared by someone else unless every statement is accurate and personally understood.

If asked to attend a law-enforcement interview, determine whether you are being treated as a witness or respondent. During custodial investigation, insist on the right to remain silent and to competent, independent counsel.

If an information or warrant has already been issued

Once an information is filed, the RTC independently determines probable cause and may dismiss, require further evidence, or issue a warrant of arrest. Cyber libel is generally bailable before conviction, but bail must be approved and posted in the amount and form set by the court.

Do not evade service or attempt an improvised surrender. Counsel should verify the case, branch, warrant status, recommended bail, and surrender arrangements. Potential motions—including a motion to quash—must be evaluated before arraignment because some objections may be waived after a plea.

At trial, the prosecution must prove guilt beyond reasonable doubt. A finding sufficient to file an information is not a conviction.

Possible penalties and civil liability

Article 355 of the Revised Penal Code, as amended by Republic Act No. 10951, punishes traditional libel by imprisonment, a fine, or both. Section 6 of Republic Act No. 10175 raises the applicable penalty by one degree when the offense is committed through ICT.

For cyber libel, the potential penalties are:

imprisonment from four years, two months, and one day to eight years;
a fine from ₱40,000 to ₱1,500,000; or
both, depending on the judgment and circumstances.

The Supreme Court has held that imprisonment is not mandatory in every cyber libel conviction; a court may impose a fine alone when legally and factually justified. This is judicial discretion, not a guarantee against imprisonment. See People v. Soliman, G.R. No. 256700, April 25, 2023.

Civil liability arising from the offense is ordinarily deemed included in the criminal action unless waived, reserved, or previously filed as provided by the Rules of Court. Article 33 of the Civil Code also permits an independent civil action for defamation based on preponderance of evidence, without double recovery for the same injury.

A separate civil action for defamation is itself generally subject to a one-year prescriptive period under Article 1147 of the Civil Code. Criminal and civil deadlines and procedural choices should be calculated separately before filing.

Common mistakes

Waiting for the post to “go viral” before acting.
Assuming the one-year period runs only from the posting date or only from the date a lawyer was consulted.
Treating a platform report, demand letter, barangay complaint, or police blotter as automatically interrupting prescription.
Submitting only cropped screenshots with no URL, date, context, or authenticating witness.
Failing to prove who controlled the account or authored the material.
Alleging venue only because the internet is accessible everywhere.
Reposting the accusation while denying it.
Believing truth alone is always a complete defense.
Assuming “opinion,” “satire,” “blind item,” or “I did not name anyone” automatically defeats liability.
Ignoring a prosecutor’s subpoena or missing the counter-affidavit date.
Filing an emotional counter-affidavit without addressing each legal element.
Deleting devices, chats, account records, or source documents before preserving them.
Offering money, demanding an affidavit of desistance, or contacting witnesses in a manner that could be viewed as pressure.
Assuming an apology or withdrawal automatically ends the criminal case. An affidavit of desistance may be considered, but prosecution is controlled by the State and dismissal is not automatic.

When legal help is urgent

Seek a Philippine criminal lawyer immediately if:

the apparent one-year deadline is within the next few months;
the account is anonymous, deleted, foreign-based, or likely to lose platform records;
you received a prosecutor’s subpoena or have fewer than 10 days to respond;
an information, hold-departure issue, search, seizure, or arrest warrant is involved;
police or NBI officers want a device, password, sworn statement, or interview;
the post concerns a public official, journalist, media organization, election, official proceeding, or confidential source;
there are multiple reposts, edited publications, or possible charges under other laws;
the material includes threats, stalking, intimate images, a child, doxxing, extortion, or account intrusion; or
a settlement, retraction, correction, or affidavit of desistance is being proposed.

An accused who cannot afford private counsel may ask the Public Attorney’s Office about eligibility. Complainants may also inquire with the DOJ Action Center, prosecution office, NBI, or appropriate legal-aid provider.

Frequently asked questions

Is a demand letter required before filing?

No general rule makes a demand letter a required element of cyber libel. It may support a request for correction, retraction, or settlement, but it can consume time and does not necessarily interrupt prescription.

Is one screenshot enough?

It may help, but it is often insufficient by itself. The evidence must establish authenticity, context, publication, identification, authorship, malice, venue, and timely filing. Preserve the original source and corroborating evidence.

Can a private group chat support cyber libel?

Potentially. Publication may exist if a third person received the defamatory material, even when the audience was limited. Qualified privilege may apply if the communication was made in the performance of a legal, moral, or social duty and circulated only to people with a corresponding interest.

Can an anonymous account be charged?

An investigation may be initiated, but the responsible person must ultimately be identified and linked to the account and publication. Seek technical assistance promptly because subscriber, traffic, and content records may not remain available indefinitely.

Does deleting and apologizing end the case?

No. Deletion, correction, or apology may reduce continuing harm and may be relevant to malice, damages, settlement, or penalty, but it does not automatically erase criminal liability or compel dismissal.

Can the complainant simply withdraw the case?

The complainant may execute an affidavit of desistance, but cyber libel is prosecuted in the name of the People of the Philippines. The prosecutor or court decides the legal effect; withdrawal is not automatically controlling.

Can a person be imprisoned?

Yes. The law permits imprisonment, although a fine may be imposed instead when the court finds it appropriate. Do not treat the judicial preference for fines in some libel cases as immunity from jail.

Does every new view restart the one-year period?

Not necessarily. Continued accessibility, a later edit, a fresh repost, and a genuinely new publication present different factual and legal questions. Preserve the publication history and obtain case-specific advice rather than assuming that every view either restarts—or never restarts—the period.

Official sources

General-information disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of any case. Cyber libel depends heavily on the exact words, complete context, evidence, authorship, date of discovery, venue, privilege, and procedural record. Consult a Philippine lawyer promptly about the actual documents and deadlines. Sources and procedures were checked as of August 4, 2026.