Quick answer

To file a cyber libel case, preserve the online evidence and file a sworn complaint—with witness affidavits and supporting records—before the proper city, provincial, regional, or state prosecution office. Act quickly: the Supreme Court has confirmed that cyber libel generally prescribes in one year from discovery of the defamatory publication by the offended party, authorities, or their agents.

To defend a case, do not ignore a prosecutor’s subpoena. Submit a sworn counter-affidavit and evidence by the date stated in the subpoena, examine whether every legal element is supported, and promptly raise defenses such as lack of authorship, identification, publication, defamatory meaning, or malice; privilege; truth with good motives and justifiable ends; prescription; improper venue; or violation of constitutional protections.

Cyber libel remains a criminal offense under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, read with Articles 353 to 355 of the Revised Penal Code. Liability is never established merely because someone felt offended. The prosecution must ultimately prove every element beyond reasonable doubt.

What counts as cyber libel?

Cyber libel is libel committed through a computer system or a similar information-and-communications technology. It may involve a social-media post, online article, blog, video caption, comment, email sent to third persons, group-chat message, or another electronically published statement.

The prosecution ordinarily must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. Someone other than the person defamed received, read, heard, or viewed the statement. A message seen only by its subject ordinarily lacks publication, but sending it to a group, employer, customer, relative, or other third person may satisfy this element.
Identification. The complainant was named or was reasonably identifiable from the words, images, context, or surrounding circumstances. A person need not be expressly named, but a vague criticism of an unidentifiable group is not automatically actionable.
Malice. The applicable form of malice must be shown. Article 354 generally presumes malice in a defamatory imputation unless a recognized privilege applies, but constitutional and jurisprudential protections may require proof of actual malice in cases involving public officials, public figures, official conduct, or matters of public concern.
Use of a computer system or similar technology. If the alleged defamation was published online, it must be charged under the cyber libel provision rather than treated simply as traditional written libel. The law cannot be applied retroactively to punish an online publication made before the Cybercrime Prevention Act took effect.

The statement is evaluated as a whole, in its language and context, and according to how an ordinary reader would understand it. Labels such as “opinion,” “satire,” “forwarded,” or “for awareness only” do not control if the post communicates or adopts a defamatory factual accusation.

Criticism, opinion, and public-interest speech

Not every harsh, embarrassing, mistaken, or unpopular statement is libelous. The Constitution protects criticism, opinion, fair comment, and discussion of public affairs.

A pure opinion that does not assert or imply a provably false fact may be protected. Fair comment on a matter of public interest is also qualifiedly privileged when based on established facts and made without actual malice. But disguising a factual accusation as “just my opinion” does not necessarily protect it.

When a statement concerns a public official’s official conduct or a qualifying public figure and matter of public concern, the prosecution may have to establish actual malice—knowledge that the statement was false or reckless disregard of whether it was false. Reckless disregard is more than an ordinary research mistake or negligence; it concerns the speaker’s state of mind and the circumstances showing serious doubt about the statement’s truth.

The Supreme Court has recognized these protections while also holding that knowingly false or malicious personal attacks are not immunized merely because the subject holds public office. The result depends heavily on the exact words, factual basis, subject, purpose, sources, and publication circumstances.

Privileged communications and truth

Article 354 recognizes qualified privileges that include:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or other official proceeding, or of an act performed by a public officer in the exercise of official functions.

Qualified privilege removes the ordinary presumption of malice, but it may be defeated by proof of actual malice. Publication must also be reasonably connected to the duty or occasion. Broadcasting a workplace complaint to people who have no legitimate interest in it may exceed the privilege.

Truth is important, but “it was true” is not always a complete criminal defense. Under Article 361, proof of truth is admissible under the statutory conditions—particularly where the imputation concerns a crime or a public officer’s acts connected with official duties—and acquittal requires both truth and publication with good motives and justifiable ends.

Preserve the records that support the statement: official documents, complete interviews, messages, recordings, source material, research notes, and evidence of verification. A link to an unreliable post, rumor, or anonymous screenshot is not equivalent to proof.

Who may be liable for a post, reaction, or share?

In Disini v. Secretary of Justice, the Supreme Court sustained the cyber libel provision as applied to the original author but invalidated the Cybercrime Act’s general aiding-or-abetting provision as applied to cyber libel. The implementing rules likewise distinguish the original author from people who merely receive and react to a post.

Accordingly, a bare “Like” or reaction is not automatically cyber libel, and a person cannot be punished merely under a vague aiding-or-abetting theory for another person’s defamatory post. However, someone who writes a new defamatory comment or caption, adopts an accusation as their own, or makes a separate republication may face a fact-specific allegation of direct authorship or publication. Traditional rules on responsibility for an author, editor, or publication manager may also matter in institutional publications.

Authorship must be proved. A profile name or screenshot alone does not conclusively establish who controlled the account at the relevant time. Admissions, account-registration information, linked contact details, devices, security notifications, platform records, witnesses, metadata, and other circumstantial evidence may become important.

The filing deadline

The controlling rule is now clear: cyber libel generally prescribes in one year under Article 90 of the Revised Penal Code.

In Causing v. People, G.R. No. 258524, October 11, 2023, the Supreme Court held that cyber libel is the same libel contemplated by Articles 353 and 355 when committed through a computer system and therefore carries the one-year prescriptive period. In its April 8, 2026 Resolution, the Court rejected requests to apply a 15-year period and reaffirmed that the period runs from discovery.

Important qualifications apply:

Discovery is a factual question. Publication online does not automatically create presumed or constructive notice to the complainant.
A reaction, comment, warning, takedown demand, message, consultation, or other conduct may help establish when the complainant actually discovered the post.
If publication and discovery occurred on the same day, that is ordinarily the reckoning date.
Filing the proper criminal complaint with the prosecution office interrupts prescription. A private demand letter, platform report, or informal police inquiry should not be assumed to do so.
Under Article 91, prescription may begin running again if proceedings terminate without conviction or acquittal or are unjustifiably stopped for a reason not imputable to the accused.
The prescriptive period does not run while the offender is absent from the Philippines.
Prescription may require evidence and may not be resolved from the face of the charge if the discovery date is disputed.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code, but accrual, interruption, and the relationship between civil and criminal proceedings require individual analysis. Do not wait until the end of the year to obtain advice.

How to preserve online evidence

Electronic evidence can disappear, change, or become difficult to authenticate. Preserve it before demanding deletion, blocking the account, or engaging publicly.

Keep:

Full-page screenshots showing the exact words, images, account name, profile photograph, date, time, URL, post identifier, privacy setting, and surrounding comments;
A screen recording that begins at the account profile and navigates to the post, showing the browser address or app context;
The original link, profile link, username, account ID, and any changes in account names;
Copies of the original image, audio, or video at the highest available quality;
Messages showing who first sent the post to the complainant and when it was discovered;
Names and contact details of people who saw the publication;
Platform notifications, emails, download archives, account-security logs, and lawful data exports;
The device on which the post was received or created, where relevant;
Records showing harm, such as cancelled contracts, customer messages, employment communications, medical records, receipts, or other provable losses;
For a defense, the complete source materials, drafts, research notes, editorial communications, verification efforts, and contextual posts preceding and following the disputed statement.

Do not crop away important context, alter timestamps, create reconstructed conversations, access another person’s account without permission, or represent that a screenshot came directly from a platform when it did not. Preserve original files and make backed-up working copies.

Electronic documents must be authenticated. Under the Rules on Electronic Evidence, the party offering a private electronic document must show its integrity and reliability through a recognized authentication method or other satisfactory evidence. A readable printout may qualify as an original if it accurately reflects the electronic data, but accuracy and authorship still have to be established.

How to file a complaint

1. Identify the correct offense and respondent

Separate the exact defamatory words from background disagreements. Identify who wrote or directly published each statement and whether different posts may constitute different alleged acts.

If the account is anonymous or disputed, seek investigative assistance rather than guessing. The NBI Cybercrime Division accepts requests for investigation and supporting devices, documents, affidavits, and witness statements. An NBI investigation can help identify an account holder or preserve evidence, but it is not a substitute for timely filing with the proper prosecution office.

2. Establish the proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action is filed before the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of other eligible courts. At the complaint stage, use the corresponding prosecution office and state concrete facts supporting venue. The complainant’s preferred location alone does not create venue.

Cases involving conduct abroad require special analysis. Section 21 of the Cybercrime Prevention Act permits Philippine jurisdiction in specified circumstances, including certain cases involving Filipino nationals, computer systems situated in the Philippines, an element occurring here, or damage here. Jurisdiction does not eliminate practical issues involving identification, service, evidence, or international assistance.

3. Prepare the complaint-affidavit

The affidavit should clearly state:

The parties’ identities and addresses;
The exact words, images, audio, or video complained of, with a faithful translation where necessary;
When, where, and through what account or system the material was published;
Why the statement is defamatory;
How the complainant was identified;
Who received or viewed it;
Facts supporting authorship;
When and how the complainant discovered it;
Facts supporting malice and answering any expected claim of privilege;
The legal and factual basis for venue; and
The harm caused and the relief sought.

Attach witness affidavits and properly labelled electronic and documentary evidence. The current DOJ filing checklist includes the NPS Investigation Data Form, sworn complaint, supporting evidence, and the required copies.

4. File with the prosecution office

Cyber libel is ordinarily subject to regular preliminary investigation because its prescribed imprisonment range reaches beyond six years. Under DOJ Department Circular No. 15, series of 2024, the complaint and evidence must establish prima facie evidence with reasonable certainty of conviction. The evidence should appear admissible, credible, preservable, presentable, and sufficient to establish the elements and the respondent’s identity.

The prosecution-office head may require missing evidence before docketing. If the complaint proceeds, the investigating prosecutor issues a subpoena and supplies the respondent with the complaint and attachments.

5. Participate in the preliminary investigation

The respondent files a counter-affidavit and supporting evidence. The prosecutor may resolve the case on the affidavits, conduct a physical or virtual clarificatory hearing, or require limited reply and rejoinder affidavits.

If the required standard is met, the prosecutor prepares an Information for filing in the designated Regional Trial Court acting as a cybercrime court. If not, the complaint is dismissed, subject to available remedies.

How to respond and defend

Do not ignore the subpoena

Check the date of actual receipt, the scheduled hearing or filing date, and whether all attachments were included. Under the 2024 DOJ-NPS Rules, the stated date must ordinarily give the respondent at least ten days from receipt of the subpoena and complaint materials. Follow the date in the subpoena rather than assuming that the tenth day is automatically the deadline.

A failure to file without justification may allow the prosecutor to resolve the complaint from the complainant’s evidence alone.

Prepare a complete counter-affidavit

The counter-affidavit should answer the allegations paragraph by paragraph and attach all available defense evidence. It must be sworn before an authorized official. A motion to dismiss cannot ordinarily replace it unless the motion is verified and contains the respondent’s defenses, in which case it may be treated as the counter-affidavit.

Potential issues include:

The respondent did not write, control, or publish the material;
The electronic records are incomplete, altered, unauthenticated, or do not establish attribution;
No third person received the communication;
The complainant was not named or reasonably identifiable;
The words, read in full context, are not defamatory;
The statement is protected opinion, rhetorical criticism, satire, or fair comment rather than a factual accusation;
The communication was privileged;
The statement was true and published with good motives and justifiable ends under Article 361;
Actual malice cannot be shown where the constitutional standard applies;
The case prescribed before a proper complaint was filed;
Venue or court jurisdiction is unsupported;
The publication predates the Cybercrime Prevention Act;
The charge attempts to punish a mere reaction or bare aiding-and-abetting theory invalidated in Disini; or
The same act is being prosecuted twice as both traditional libel and cyber libel, raising double-jeopardy concerns.

Do not fabricate a hacking claim. If an account was genuinely compromised, preserve login alerts, recovery emails, device lists, IP or location notifications, reports to the platform, and contemporaneous messages showing loss of control.

Act on the prosecutor’s resolution

Under DOJ Department Circular No. 15, an aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review may also be available under the applicable DOJ appeal rules. Once an Information has been filed in court, an administrative review does not automatically stop judicial proceedings; counsel may need to seek suspension from the court.

If the Information has already been filed, a defense lawyer should evaluate whether a motion to quash is available before plea, particularly for prescription, defective allegations, lack of jurisdiction, extinguishment of criminal liability, or double jeopardy. Some objections may be waived if not raised at the proper stage.

Possible penalties and civil liability

Article 355, as amended by Republic Act No. 10951, provides imprisonment, a fine, or both for traditional libel. Section 6 of the Cybercrime Prevention Act raises the penalty by one degree when the offense is committed through information and communications technology.

The resulting statutory penalties for cyber libel may include:

Imprisonment from four years, two months, and one day to eight years;
A fine from ₱40,000 to ₱1,500,000; or
Both, depending on the judgment and circumstances.

In People v. Soliman, the Supreme Court confirmed the ₱40,000-to-₱1,500,000 fine range and held that the judicial policy favoring a fine over imprisonment in appropriate libel cases also applies to online libel. That policy is not a guarantee: imprisonment remains legally available.

Criminal liability may carry civil liability for proven injury. Depending on the evidence, a court may consider actual, moral, exemplary, and other recoverable damages, but there is no automatic or fixed damages award. A complainant cannot recover twice for the same injury through overlapping civil remedies.

Common mistakes

Waiting because the post remains online, without accounting for the one-year period from discovery;
Treating a demand letter, platform complaint, or police blotter as a guaranteed interruption of prescription;
Filing in a convenient location without facts establishing cybercrime venue;
Submitting cropped screenshots without URLs, timestamps, context, witnesses, or authentication evidence;
Naming every person who reacted to or received a post as a respondent;
Assuming truth alone always defeats criminal libel;
Assuming “opinion,” “allegedly,” a question mark, or a disclaimer automatically prevents liability;
Repeating an accusation in a demand letter or public response more widely than necessary;
Deleting, editing, or replacing the disputed content before preserving it;
Ignoring a subpoena because preliminary investigation is “not yet a court case”;
Filing only a technical motion instead of a sworn, evidence-supported counter-affidavit;
Arguing the case publicly while it is pending, creating additional publications or admissions;
Assuming an apology, deletion, settlement, or affidavit of desistance automatically ends the criminal case. The State prosecutes the offense, and the prosecutor or court is not automatically bound by a private withdrawal.

When legal help is urgent

Consult a Philippine criminal lawyer immediately if:

The one-year period may expire soon;
You received a prosecutor’s subpoena, NBI subpoena, warrant, summons, or Information;
The post or account is being deleted or changed;
The account is anonymous and platform or subscriber records may be needed;
Police or investigators request access to a phone, computer, or account;
Several posts, complainants, jurisdictions, or respondents are involved;
The statement concerns a journalist, public official, public figure, confidential source, employer investigation, or official proceeding;
The case involves a company, editor, publication manager, or institutional account;
The accusation also involves threats, doxxing, stalking, intimate images, child-protection issues, or another offense requiring separate and faster protective action; or
A prosecutor has already issued a resolution and the 15-day reconsideration period is running.

A person may cooperate lawfully without consenting to a warrantless search or surrendering privileged communications. Ask for a copy of the process served and obtain advice before giving a substantive statement or allowing examination of devices.

Frequently asked questions

Is a private message cyber libel?

Only if it was published to someone other than the person allegedly defamed. A one-to-one message sent solely to its subject ordinarily lacks publication. A group message or a message copied to third persons may be different.

Can I be charged for sharing someone else’s post?

A bare reaction or share cannot automatically be punished merely as aiding or abetting cyber libel. Liability becomes more plausible if you add your own defamatory assertion, adopt the allegation as true, or make a separate publication. The exact content and manner of sharing matter.

Does deleting the post prevent a case?

No. Deletion does not erase an offense already completed by publication and may destroy relevant evidence. Preserve an accurate copy before any correction or takedown and obtain advice about mitigating further harm.

Is an anonymous account beyond investigation?

No. Investigators may seek subscriber, traffic, or device evidence through the lawful cybercrime-warrant process. Identification is not guaranteed, and platform retention periods differ, so prompt preservation is important.

Can the complainant file both criminal and civil cases?

Potentially. Civil liability arising from the offense is generally deemed included in the criminal action unless waived, reserved, or previously filed, while an independent civil action for defamation may also be available under Article 33 of the Civil Code. Coordination is necessary to avoid procedural conflicts and double recovery.

Can the case be settled?

The civil aspect may be compromised, and an apology, correction, or desistance may affect the evidence or the parties’ positions. But cyber libel is prosecuted in the name of the People of the Philippines. A private settlement or affidavit of desistance does not automatically compel the prosecutor or court to dismiss it.

Can Philippine law apply if the post was made abroad?

It can in circumstances listed in Section 21 of the Cybercrime Prevention Act, including certain cases involving a Filipino accused, an element occurring in the Philippines, a computer system situated here, or damage here. Jurisdiction, venue, evidence, and enforcement must each be established.

Official sources

This article provides general Philippine legal information, not legal advice or an attorney-client relationship. Cyber libel outcomes depend on the exact words, evidence, parties, dates, publication method, and procedural history. Sources and current rules were checked through July 23, 2026.