Quick answer

Cyber libel is committed when a person maliciously publishes a defamatory statement through a computer system—such as social media, a website, email, or an online group—and the statement identifies a person and is communicated to someone else.

For a complainant, the safest course is to preserve the complete digital evidence and file a sworn complaint with the proper prosecution office immediately. Under the Supreme Court’s latest controlling ruling, a criminal cyber-libel case generally prescribes one year from discovery of the post by the offended party, the authorities, or their agents. Publication and discovery are not automatically treated as occurring on the same date. Filing the proper complaint or information interrupts prescription.

For a respondent, do not ignore a subpoena. Obtain the complete complaint and attachments, preserve your account and devices, calendar every deadline, and submit a detailed counter-affidavit addressing authorship, publication, identification, defamatory meaning, malice, privilege, truth, prescription, venue, and the reliability of the electronic evidence.

The controlling provisions are Article 353 in relation to Article 355 of the Revised Penal Code and Section 4(c)(4) of the Cybercrime Prevention Act of 2012.

What the prosecution must prove

A criminal conviction requires proof beyond reasonable doubt of all the following:

Element	What it means in practice
Defamatory imputation	The statement imputes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person to contempt.
Publication	At least one person other than the person defamed received, read, heard, or viewed it. A message sent only to the complainant ordinarily lacks publication; a group chat or public post may satisfy it.
Identification	The complainant was named or was reasonably identifiable to people who knew the surrounding facts. Naming the person is not indispensable.
Malice	Depending on the person and subject involved, malice may be presumed or must be proved as actual malice. Privilege, good faith, and public-interest speech can change the burden.
Use of a computer system	The defamatory material was published through a computer, phone, social-media platform, website, email, messaging application, or comparable information-and-communications technology.
Authorship or responsibility	The respondent—not merely a profile carrying the respondent’s name or photograph—authored or was legally responsible for the publication.

The words are evaluated as a whole and in context, including photographs, captions, emojis, linked material, the audience, prior exchanges, and the ordinary meaning readers would give them. Labeling a statement “opinion,” “allegedly,” or “for awareness only” does not automatically protect it if the post conveys or implies a defamatory factual assertion. Conversely, rhetorical exaggeration, satire, or an opinion that does not imply false facts may not be actionable.

A corporation or other juridical person can be defamed under Article 353. Very broad statements about a large community ordinarily do not allow every member to sue unless the material reasonably identifies the particular complainant as a target.

The one-year deadline

In its April 8, 2026 resolution in Causing v. People, the Supreme Court confirmed that cyber libel prescribes in one year, not 12 or 15 years. The period is counted from the date the material was discovered by the offended party, the authorities, or their agents. A public post is not legally presumed to have been discovered on its posting date merely because anyone could access it. Discovery is a factual question shown by conduct and surrounding circumstances—for example, reacting to the post, discussing it, sending a demand, or threatening legal action. See the 2026 Supreme Court resolution in Causing v. People.

Under Articles 90 and 91 of the Revised Penal Code:

The one-year period begins upon discovery.
Filing the proper complaint or information interrupts the period.
The period may run again if the proceedings end without a conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.
Prescription does not run while the offender is absent from the Philippines.

Do not wait merely because the post remains online. Do not assume that a demand letter, platform report, barangay complaint, or informal police inquiry stops prescription. File the proper criminal complaint with the prosecution office within the period and keep proof of filing.

A civil action for defamation also generally has a one-year prescriptive period under Article 1147 of the Civil Code. The exact reckoning and effect of other proceedings should be evaluated before choosing between or coordinating criminal and civil remedies.

How to preserve the evidence

Digital content can be deleted, edited, renamed, or stripped of identifying information. Preserve it before confronting the author if confrontation may cause its removal.

Keep:

Full, uncropped screenshots showing the complete post, account name, profile or page, date, time, reactions, comments, and surrounding context.
A screen recording that starts from the account or page and navigates to the post.
The exact URL, account username, numeric account or page ID if visible, and date and time of capture.
The original images, audio, video, documents, email headers, or chat exports—not only screenshots forwarded by someone else.
Earlier and later posts showing context, identity, intent, corrections, or repetition.
Names and contact details of people who saw the material, together with what they saw and when.
Proof of when the complainant first discovered the material, including messages from the person who first sent it.
Evidence connecting the account to its alleged user: admissions, prior messages, unique facts, writing style, photographs, account history, phone numbers, email addresses, or witnesses who saw the account being used.
Evidence of harm, such as lost work or customers, termination notices, medical or counseling records, messages from concerned relatives or clients, and documented corrective expenses.
For a respondent, source documents, interview notes, official records, messages, drafts, research, and communications showing verification, good faith, motive, and context.

Keep the original device and files in their existing condition. Do not alter timestamps, fabricate reconstructions, secretly access another person’s account, or obtain evidence by hacking.

Screenshots can be useful, but attribution and authenticity may still be contested. In 2025, the Supreme Court identified non-exclusive ways to prove ownership, access, or authorship of a social-media account, including admissions, eyewitness testimony, unique knowledge, consistent language or style, provider records, device forensics, and conduct consistent with earlier posts or messages. See the Court’s guide on proving social-media account identity and the full decision in G.R. No. 274842.

How to file a criminal complaint

1. Confirm that cyber libel is the correct offense

Not every insult, falsehood, bad review, or online dispute is cyber libel. Determine:

The exact defamatory words or images.
Who was identifiable.
Who other than the complainant received them.
Who authored the material.
Whether it was published through a computer system.
Whether the statement was factual, privileged, or related to a public official, public figure, or matter of public interest.
The date of discovery and the remaining prescriptive period.
Whether the conduct may instead—or also—constitute threats, identity theft, unlawful disclosure, voyeurism, harassment, violence against women or children, contempt, or another offense.

Separate offenses have different elements and should not be added merely to increase pressure.

2. Determine the proper venue

Cyber-libel cases fall within Regional Trial Court jurisdiction and are handled by designated cybercrime courts. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where any damage to a natural or juridical person took place.

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of the others. Internet accessibility everywhere does not eliminate the need to allege and prove facts connecting the chosen venue to the offense or damage. File the complaint with the prosecution office corresponding to a legally supportable venue.

The Act also provides jurisdiction in specified cross-border situations, including certain offenses involving Filipino nationals, computer systems situated partly in the Philippines, or damage to a person who was in the Philippines. Obtaining evidence or enforcing process abroad may nevertheless require assistance through the DOJ Office of Cybercrime.

3. Prepare the complaint-affidavit

The affidavit should be based on personal knowledge and should clearly state:

The complete identities and addresses of the parties, if known.
The exact words, images, video, or other material complained of.
Where and when it was posted and when it was discovered.
How the complainant is identified, even if not named.
Who saw or received the material.
Why the statement is defamatory and false, if falsity is alleged.
Facts supporting malice or actual malice where required.
Facts and evidence connecting the respondent to the account and publication.
The factual basis for venue.
The harm caused.
A numbered list of properly marked supporting exhibits.

Attach witness affidavits and the original or best available copies of the electronic evidence. The DOJ’s current checklist includes a sworn Investigation Data Form and complaint-affidavit or sworn statement; check the DOJ filing requirements for preliminary investigation and the receiving office’s current requirements before filing.

4. Seek investigative help when necessary

An anonymous or dummy account does not prevent a complaint, but a name and profile photograph alone may be insufficient to identify the author. Prompt investigation may be necessary to preserve subscriber, traffic, login, or content data.

The NBI Cybercrime Division’s citizen service accepts complaints, conducts interviews, receives sworn statements and supporting documents, and may examine a relevant device. The DOJ Office of Cybercrime also acts on cybercrime complaints and referrals.

Under Republic Act No. 10175, subscriber information and traffic data are subject to a minimum six-month preservation framework, while content data may be preserved for six months from receipt of a law-enforcement preservation order, with a one-time extension. Disclosure generally requires a court-issued warrant connected to a valid, officially docketed complaint. Because actual availability may depend on the provider and where its records are held, report the matter promptly.

5. Participate in preliminary investigation

Cyber libel carries a prescribed imprisonment range exceeding six years at its maximum, so regular preliminary investigation under DOJ Department Circular No. 015 applies. The prosecutor evaluates whether there is prima facie evidence with reasonable certainty of conviction, not merely whether an accusation was made.

The respondent must receive the complaint and attachments with a subpoena. The scheduled submission date should allow at least 10 days from receipt under the regular preliminary-investigation procedure. The subpoena’s exact date controls unless a timely extension or other relief is granted.

After evaluating the complaint, counter-affidavit, witness affidavits, and permitted reply or rejoinder, the prosecutor may dismiss the complaint or recommend filing an Information. The current governing issuance is DOJ Department Circular No. 015, series of 2024, whose authority was recognized by the Supreme Court in A.M. No. 24-02-09-SC.

An aggrieved party generally has 15 days from receipt to file a motion for reconsideration under Department Circular No. 015. A petition for review is separately governed by the NPS appeal rules and ordinarily also has a strict 15-day period. Confirm the correct reviewing office, computation, proof of service, fees, and required records immediately upon receiving the resolution.

How to defend the complaint

Respond immediately and through the proper pleading

A counter-affidavit is evidence under oath, not an informal denial. It should answer each material allegation and authenticate the defense documents. Filing only a motion to dismiss, a letter, or an unsupported denial may leave the prosecutor free to resolve the case from the complainant’s evidence.

Ask counsel to examine:

The date and manner of service.
The complete complaint and every attachment.
The posting and alleged discovery dates.
The selected venue.
Whether the exact words charged appear in the evidence and complaint.
Whether another person saw the material.
Whether the complainant was identifiable.
Whether the respondent is reliably linked to the account and post.
Whether the speech was privileged or involved a public official, public figure, or public concern.
Whether the electronic evidence is authentic, complete, lawfully obtained, and consistent.

Preserve, but do not manipulate, your records

Do not delete the account, reset the device, edit the post, create substitute screenshots, or ask witnesses to coordinate their accounts. Deletion does not erase liability and may remove evidence favorable to the defense.

Preserve account-security alerts, login history, device records, proof of hacking or impersonation, shared-account access logs, drafts, source documents, and the full conversation. If the post was corrected or removed, preserve proof of when and why; remediation may affect factual assessments but does not automatically extinguish an already completed offense.

Consider the defenses supported by the evidence

Possible defenses include:

No authorship or control. The account was fake, hacked, shared, or operated by someone else, supported by credible technical and testimonial evidence.
No publication. The statement was communicated only to the complainant and not to a third person.
No identification. Readers could not reasonably identify the complainant.
No defamatory imputation. In context, the words were not factual or did not tend to cause dishonor, discredit, or contempt.
Qualified privilege. The statement was a private communication made in the performance of a legal, moral, or social duty; a fair and true good-faith report of a non-confidential official proceeding without added comments; or fair commentary on a matter of public interest.
Lack of actual malice. For speech concerning the official conduct of public officers, or public figures in matters of legitimate public interest, the prosecution must prove knowledge of falsity or reckless disregard for truth. Mere mistake or negligence is not automatically actual malice, although serious doubts, deliberate avoidance, fabricated sources, or obvious falsity may support it. See ABS-CBN Corporation v. Gozon on the actual-malice standard.
Truth, good motives, and justifiable ends. Truth is not an automatic, all-purpose defense. Article 361 requires both truth and good motives and justifiable ends. Proof of truth for an imputation not constituting a crime is restricted unless it concerns a government employee’s discharge of official duties.
Prescription. The complaint was filed more than one year after a provable discovery date. Unless prescription appears from the complaint or Information itself, the defense generally bears the burden of producing supporting evidence.
Improper venue or lack of jurisdiction.
Non-retroactivity. An online publication made before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel.
Defective or unlawfully obtained evidence. This may include missing authentication, incomplete screenshots, an unreliable attribution, an overbroad warrant, or data obtained outside lawful authority.
Double jeopardy or duplicative charging. The same publication cannot be punished both as ordinary libel and as cyber libel. The Supreme Court addressed this in Disini v. Secretary of Justice.

A bare “Like,” reaction, receipt, or simple sharing of another person’s post is not punishable as aiding or abetting cyber libel under Section 5. Disini upheld cyber libel as to the original author but invalidated its application to people who simply receive and react to the post. A person who adds an independently defamatory caption or creates a new defamatory publication may, however, be evaluated as an author based on that person’s own words and conduct.

If an Information is filed in court

The judge independently determines probable cause and may dismiss the case, issue a warrant of arrest, or proceed as allowed by the Rules. Cyber libel is bailable before conviction, but the amount and conditions are set by the court.

The accused should promptly:

Obtain a certified copy of the Information and court orders.
Confirm the branch is a designated cybercrime court with proper venue.
Coordinate voluntary appearance, surrender, or bail through counsel if a warrant exists.
Evaluate a motion to quash where a recognized ground is apparent, such as failure to charge an offense, lack of jurisdiction, improper venue where jurisdictional, prescription, or double jeopardy.
Preserve objections to electronic evidence and unlawful searches at the proper time.
Avoid discussing witnesses or the merits publicly while the case is pending.

Do not obstruct officers executing a warrant. Ask to see the warrant, note its scope, contact counsel, observe the inventory process, and retain copies of the warrant, receipt, and inventory. Examination or disclosure of computer data must remain within the authority granted by the court.

Possible penalties and civil liability

Article 355, as amended by Republic Act No. 10951, provides imprisonment, a fine, or both for traditional libel. Because the Cybercrime Prevention Act increases the penalty by one degree, the imprisonment range for cyber libel may extend from four years, two months and one day to eight years, subject to the rules on penalties and the circumstances proved.

For cyber libel committed after the adjustment of fines under Republic Act No. 10951, the Supreme Court has held that the permissible fine ranges from ₱40,000 to ₱1,500,000. A court may impose a fine instead of imprisonment, but imprisonment remains legally available and the choice depends on the circumstances. See People v. Soliman.

Civil liability may include proven actual, moral, and, where legally justified, exemplary damages. Damages are not automatic and should be supported by evidence. Under Article 33 of the Civil Code, an independent civil action for defamation may be brought and decided by preponderance of evidence, but the complainant cannot recover twice for the same act. The timing, reservation, filing fees, and relationship between the criminal and civil actions require careful planning under Rule 111 of the Rules of Criminal Procedure.

Common mistakes

Waiting because an older source says cyber libel prescribes in 12 or 15 years.
Assuming a public post was legally discovered on its posting date.
Sending only a demand letter and allowing the one-year period to expire.
Filing in a convenient city without facts establishing venue.
Submitting cropped screenshots without URLs, dates, context, or attribution evidence.
Treating a profile name or photograph as conclusive proof of authorship.
Assuming truth alone guarantees acquittal.
Suing every person who reacted to or received a post.
Deleting accounts, posts, messages, or devices after a dispute begins.
Missing the counter-affidavit, reconsideration, or appeal deadline.
Contacting or threatening the other party or witnesses.
Publicly reposting the disputed words in an effort to “explain,” thereby creating further evidence or a possible new publication.
Paying a fixer or relying on unofficial promises instead of obtaining a stamped or electronically acknowledged filing.

When legal help is urgent

Consult a Philippine criminal-law or cybercrime lawyer immediately when:

The one-year period will expire soon or the discovery date is disputed.
The account is anonymous and provider data may disappear.
You received a prosecutor’s subpoena, court summons, warrant, or notice of arraignment.
Police or NBI officers want to examine or seize a device.
The case involves a journalist, public official, public figure, election issue, or matter of public concern.
The post includes threats, private sexual material, personal data, impersonation, or content involving a child.
The author, platform, device, or relevant records are outside the Philippines.
Several people managed the same account.
A civil action, employment case, administrative complaint, or protection-order proceeding is also pending.

Frequently asked questions

Is a demand letter required before filing?

No. A prior demand, request for apology, or takedown notice is not an element of cyber libel. It may be useful in some disputes, but it does not by itself stop the one-year criminal or civil prescriptive period.

Can I file against an anonymous account?

Yes, if the available facts support an offense, but identifying the operator requires evidence. Bring the complete digital records to the NBI Cybercrime Division or another authorized cybercrime investigator promptly so lawful preservation and disclosure processes can be considered.

Are screenshots enough?

Sometimes they help establish the content, but they do not automatically prove authenticity, completeness, authorship, or publication. Preserve URLs, original files, witnesses, account history, metadata, and the device used to view or receive the material.

Can a private message be cyber libel?

It depends on publication. A message sent only to the person defamed ordinarily lacks communication to a third person. A message sent to another recipient, forwarded to others, or posted in a group may satisfy publication.

Is a false statement always cyber libel?

No. The remaining elements must also be proved, including defamatory meaning, publication, identification, malice where applicable, use of a computer system, and responsibility of the accused.

Can a true statement still lead to liability?

Potentially. Under the statutory rule, truth must generally be accompanied by good motives and justifiable ends, and proof of truth is restricted for certain non-criminal imputations. Public-official and public-interest cases also involve constitutional rules on actual malice.

Does deleting or apologizing erase the case?

No. Publication may already have completed the offense. Prompt correction, deletion, and a sincere apology can still matter to motive, harm, settlement discussions, prosecutorial assessment, or sentencing, depending on the evidence.

Can the complainant withdraw the criminal case?

The complainant may execute a desistance or settlement document, but criminal prosecution is brought in the name of the People of the Philippines. A private agreement does not automatically compel the prosecutor or court to dismiss the criminal charge.

Can I be imprisoned?

Yes. Although the courts recognize a preference for considering a fine in appropriate libel cases, imprisonment remains an available penalty. The result depends on the law applicable when the offense occurred and the circumstances established in court.

This article provides general Philippine legal information, not advice for a specific case or an attorney-client relationship. Cyber-libel outcomes depend heavily on the exact words, audience, authorship evidence, discovery date, venue, procedural history, and documents. Official sources and procedures were checked through July 30, 2026.