Quick answer

Cyber libel is committed when a person publishes through a computer system a defamatory and malicious imputation that identifies another person or entity. The prosecution must prove the post’s defamatory meaning, publication to at least one third person, the complainant’s identity, malice, use of information and communications technology, and the accused’s responsibility for the publication.

A complainant may seek investigative help from the NBI or PNP cybercrime unit, but the criminal case is initiated by filing a sworn complaint and supporting evidence with the proper city or provincial prosecution office. If the prosecutor finds sufficient evidence, an Information is filed in a designated cybercrime Regional Trial Court (RTC).

Act immediately. Under the Supreme Court’s final April 8, 2026 ruling in Causing v. People, cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Filing the complaint with the proper prosecution office interrupts prescription. Older materials stating that cyber libel prescribes in 12 or 15 years are no longer controlling.

A respondent should not ignore an NBI invitation, prosecutor’s subpoena, court summons, or warrant. Preserve the account, device, complete conversation, security logs, sources, and drafts; obtain counsel before giving a sworn statement; and answer every element of the charge within the stated deadline.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the libel rules in Articles 353 and 355 of the Revised Penal Code to publication through a computer system or similar means. “Computer system” includes internet-connected computers and mobile phones.

The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. The imputation was communicated to someone other than the person defamed. A message seen only by its subject generally lacks this element; a group chat, public post, email copied to others, or message sent to a third person may satisfy it.
Identification. The complainant was named or was reasonably identifiable from the words, images, tags, surrounding circumstances, or audience knowledge. Naming no one is not necessarily a defense if readers could still identify the subject.
Malice. For an ordinarily defamatory statement involving a private person, Article 354 generally presumes malice unless the communication is privileged. The prosecution must nevertheless prove guilt beyond reasonable doubt at trial.
Use of ICT. The publication was made through a computer system or comparable technology.
Responsibility for the publication. The prosecution must connect the accused—not merely an account bearing a similar name—to the authorship or publication. Account ownership, access, admissions, device evidence, subscriber information, witnesses, and surrounding conduct may be relevant.

The Supreme Court in Disini v. Secretary of Justice sustained cyber libel as applied to the original author but rejected liability for people who merely receive a post and react to it. This does not make every share or repost safe: a person who adds a new defamatory caption, comment, alteration, or independent accusation may become the author of a separate publication, depending on the evidence.

Statements that may not be criminally actionable

A harsh or offensive post is not automatically cyber libel. The following issues can defeat or materially weaken a charge:

No defamatory factual imputation

Courts examine the entire post, its ordinary meaning, context, audience, accompanying images, and surrounding exchange. Rhetorical exaggeration or opinion may receive protection, particularly on public issues, but calling something an “opinion” is not conclusive if it asserts or implies provably false facts.

No publication or identification

There may be no libel if no third person received the statement or if the alleged victim was not reasonably identifiable. Both are evidence-dependent questions.

No proof of authorship

A screenshot showing a display name does not, by itself, conclusively prove who controlled the account or wrote the post. Fake, compromised, shared, or impersonation accounts require careful investigation. The prosecution must still prove the accused’s identity and responsibility beyond reasonable doubt.

Privileged communication

Article 354 recognizes qualified privilege for:

A private communication made in performing a legal, moral, or social duty; and
A fair and true, good-faith report—without added comments or remarks—of a non-confidential judicial, legislative, or other official proceeding or an official act.

Fair commentary on matters of public interest may also be privileged. Privilege is not a license for fabricated facts, irrelevant personal attacks, unnecessary mass circulation, or statements made with actual malice.

A complaint sent in good faith to the government official authorized to investigate misconduct may be privileged. Posting the same accusations publicly to an unrestricted audience presents a different issue.

Public officials, public figures, and public issues

When the challenged statement concerns the official conduct of a public official or a public figure’s participation in a matter of public concern, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. The prosecution—not the defense—bears that burden. The rule does not automatically protect attacks on a public person’s purely private life or statements unrelated to the public issue.

Truth, good motives, and justifiable ends

Truth is not always a complete defense by itself. Under Article 361, acquittal follows when the accused proves both that the imputation was true and that it was published with good motives and for justifiable ends.

Proof of the truth of an accusation involving an act or omission that is not a crime is generally inadmissible, except when the accusation concerns a government employee and facts related to official duties. A respondent relying on truth should preserve the actual records and witnesses supporting the precise words published—not merely show that a rumor existed.

Prescription, improper venue, or a defective charge

Prescription, lack of territorial connection, failure to allege an offense, double jeopardy, or a material variance between the Information and the evidence can be decisive. These defenses require the actual complaint, Information, dates, and supporting records.

A post made before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. Whether a later edit, repost, or other act constitutes a new publication is fact-sensitive and should not be assumed from the continuing online availability of old material.

The one-year deadline

The controlling rule is the Supreme Court’s April 8, 2026 En Banc Resolution in Causing v. People:

Cyber libel prescribes in one year.
The period begins when the allegedly libelous material is discovered by the offended party, the authorities, or their agents.
Publication date controls only when it coincides with discovery.
Filing a proper criminal complaint with the prosecution office interrupts the period.
If proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may run again under Article 91 of the Revised Penal Code.
Prescription does not run while the offender is absent from the Philippines.

The discovery date is a factual matter. Preserve the message, email, notification, witness statement, or other record showing when the post was first found. An accused invoking prescription generally has the burden of presenting evidence if prescription is not apparent from the face of the Information.

Do not wait until the anniversary date. Time spent sending demands, negotiating, reporting the account to a platform, or requesting an investigation does not necessarily preserve the criminal deadline. File through the proper legal channel in time.

Evidence to preserve immediately

For a complainant

Preserve more than a cropped screenshot:

The complete URL and, if available, the account’s permanent profile or user ID;
Username, display name, profile page, and identifying account information;
Exact text, captions, images, audio, video, tags, and hyperlinks;
Date, time, time zone, audience setting, and visible publication metadata;
The entire thread or conversation, including preceding and succeeding posts;
Comments, shares, reactions, view indicators, and evidence that third persons saw the material;
A screen recording showing navigation from the account profile to the post;
Native downloaded files and their original metadata;
Messages from readers showing that they understood the post to refer to the complainant;
Records showing the date of discovery;
Witness affidavits from people who saw the publication;
Business records, contracts, customer communications, medical records, or other competent proof of actual damage;
Evidence connecting the respondent to the account, such as admissions, linked pages, prior communications, or witnesses with personal knowledge.

Keep an untouched master copy and make backups. Do not crop, annotate, enhance, rename, recompress, or edit the only copy.

Where platform data may disappear, promptly consult the NBI, PNP cybercrime unit, or counsel about lawful preservation. Under Section 13 of RA 10175, traffic data and subscriber information are subject to a minimum six-month preservation period from the transaction, while content data may be preserved for six months upon a law-enforcement preservation order, extendible once for another six months. Disclosure of protected platform data generally requires the appropriate court warrant.

For a respondent

Preserve even material that appears unfavorable:

The device, account, original post, complete thread, and account-access history;
Login alerts, password-reset notices, recovery emails, and proof of unauthorized access;
Sources, public records, interviews, recordings, research notes, and fact-checking materials;
Drafts and timestamps showing what was written, edited, or approved;
Editorial or workplace responsibilities relevant to authorship;
Messages establishing context, consent, limited audience, or a legal, moral, or social duty;
Documents supporting truth, good motive, fair comment, or reasonable verification;
Retractions, corrections, apologies, or settlement communications;
Proof of residence, device location, and other facts relevant to venue;
Evidence of publication and discovery dates.

Do not delete the account, wipe the device, fabricate logs, ask witnesses to change their accounts, or pressure the complainant. Deletion can destroy exculpatory evidence without necessarily removing copies already held by others.

Electronic evidence must be authenticated. The Rules on Electronic Evidence place the burden on the party offering a private electronic document to establish its authenticity, integrity, and reliability.

Where and how to file

1. Identify a legally supportable venue

Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where any of the damage to the natural or juridical person occurred.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Mere worldwide accessibility should not be treated as permission to choose any convenient location. The complaint should state facts and attach evidence supporting the selected venue.

At the preliminary-investigation stage, file with the city or provincial prosecution office corresponding to the intended lawful court venue.

2. Prepare the complaint-affidavit

The complaint-affidavit should state, from personal knowledge where possible:

The exact defamatory words or material;
Their context and defamatory meaning;
How and when they were published through ICT;
How the complainant was identified;
Who received or viewed the material;
Why the respondent is believed to be the author;
The discovery date;
Facts establishing venue;
Why the statement was malicious or, if privilege may be claimed, facts showing actual malice;
The relief requested.

Attach the Investigation Data Form, witness affidavits, authenticated or authentically preservable electronic evidence, proof of the respondent’s last known address, and the required copies. Check the receiving prosecution office’s current documentary checklist and filing arrangements before submission.

A complainant may first seek investigative assistance from the NBI Cybercrime Division or an authorized PNP cybercrime unit, especially where authorship is unknown or platform records are needed. An agency report or platform complaint is not a substitute for timely filing with the prosecution office.

3. Preliminary investigation

The governing framework is DOJ Department Circular No. 15, the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, whose validity was upheld in Meking v. Remulla.

The prosecution office first evaluates the complaint’s form and evidentiary completeness. The investigating prosecutor may dismiss it outright, require case build-up, issue subpoenas, hold clarificatory hearings, or request additional material. An Information should be filed only when the evidence establishes a prima facie case with reasonable certainty of conviction—meaning the evidence is considered admissible, credible, preservable, and capable of proving the elements and the responsible person.

A subpoena should give the respondent at least 10 days from receipt to submit a counter-affidavit. Follow the date in the subpoena or prosecutor’s order; extensions are discretionary.

4. Prosecutor’s resolution and review

An aggrieved party may generally move for reconsideration within 15 days from receipt of the resolution. Because cyber libel is cognizable by the RTC, the applicable administrative appeal is generally to the Secretary of Justice under the 2024 DOJ-NPS Rules. Review remedies have strict requirements and do not justify ignoring an Information, arraignment, or court order already issued.

How to respond if you are accused

Before giving a statement

Obtain the complete complaint and annexes. Consult counsel before executing a counter-affidavit, answering detailed investigator questions, surrendering a device, or consenting to an account search. You have the right against compelled self-incrimination, but silence should be exercised through a deliberate legal strategy—not by ignoring compulsory process.

An NBI or police invitation is not itself a conviction or automatic authority to search a phone. Subscriber disclosure, interception, and examination of computer data are governed by RA 10175 and the Rule on Cybercrime Warrants. Evidence obtained without a required valid warrant or beyond its authority may be challenged.

In the counter-affidavit

Address each element separately:

Quote the actual material rather than the complainant’s paraphrase;
Explain the complete context and intended audience;
Contest defamatory meaning, publication, identification, malice, authorship, ICT use, venue, or timeliness where the evidence permits;
Identify any privilege and the duty or public interest involved;
If relying on truth, attach competent supporting records and explain the good motive and justifiable end;
For public officials or figures, identify why the matter concerned official conduct or public interest and why actual malice is absent;
Explain account compromise or shared access with objective records;
State the relevant publication and discovery dates;
Object to unauthenticated, incomplete, altered, unlawfully obtained, or misleading electronic evidence.

Avoid unsupported blanket denials. A sworn admission made during preliminary investigation can later be used in court.

If an Information is filed

The RTC judge independently examines probable cause and may dismiss the case, issue a warrant, or require further evidence. Bail is generally a matter of right before conviction because cyber libel is not punishable by death, reclusion perpetua, or life imprisonment. There is no universal cyber-libel bail amount; the court fixes it under the Rules on Criminal Procedure.

Counsel should promptly evaluate:

A motion to quash under Rule 117;
Prescription and the proof of discovery;
Territorial jurisdiction and venue;
Whether the facts alleged constitute cyber libel;
Duplicative prosecution or double jeopardy;
Defects or material variance in the Information;
Suppression or exclusion of unlawfully obtained digital evidence;
Bail, arraignment, pre-trial stipulations, and trial strategy.

Many objections must be raised before entering a plea or may be waived. Prescription, however, totally extinguishes criminal liability and is not necessarily waived by arraignment, as Causing explains.

Penalties and civil exposure

Cyber libel carries a penalty one degree higher than traditional written libel. Depending on the applicable law at the time of the offense and the circumstances, the court may impose:

Imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years;
A fine from ₱40,000 to ₱1,500,000; or
Both imprisonment and fine.

In People v. Soliman, the Supreme Court confirmed that a court may, in its sound discretion, impose a fine alone instead of imprisonment. A fine-only sentence is not automatic. The court considers the circumstances, seriousness of the offense, and interests of justice.

Damages may also be awarded. Under Rule 111, the civil action arising from the offense is ordinarily deemed included in the criminal case unless it is waived, reserved, or filed beforehand. Article 33 of the Civil Code also recognizes an independent civil action for defamation, proved by preponderance of evidence, but there can be no double recovery for the same act.

A civil action for defamation generally prescribes in one year under Article 1147 of the Civil Code. Other privacy or abuse-of-rights claims may depend on different facts and legal bases.

Retractions, takedowns, and settlement

A demand letter is not required before filing a criminal complaint. It may request correction, retraction, apology, preservation, or takedown, but it does not replace timely criminal filing.

Before reporting or requesting removal, preserve the evidence. A successful platform takedown may reduce continuing harm but does not automatically erase liability or prove authorship.

An apology, correction, settlement, or affidavit of desistance does not automatically dismiss a public criminal prosecution once instituted. The prosecutor or court must still act according to law. Any settlement should separately address takedown, preservation, retraction wording, civil claims, costs, confidentiality, and the limits of what either party can legally promise.

Do not threaten arrest, exposure, or unrelated accusations to obtain money. Do not publish settlement negotiations without legal advice.

Common mistakes

Relying on outdated claims that the prescriptive period is 12 or 15 years;
Waiting for a platform response or demand-letter deadline before filing;
Saving only a cropped screenshot without the URL, profile, date, or context;
Assuming a display name proves who authored the post;
Treating truth alone as an automatic defense;
Assuming every criticism of a public official is protected;
Publishing accusations broadly when a good-faith complaint could have been sent privately to the proper authority;
Filing in a convenient city without evidence supporting cybercrime venue;
Ignoring a subpoena because preliminary investigation is “not yet a court case”;
Giving an uncounselled sworn narrative that supplies missing prosecution evidence;
Deleting accounts, messages, devices, or security logs;
Assuming a retraction or affidavit of desistance automatically ends the case;
Repeating the accusation while publicly “defending” oneself.

When legal help is urgent

Seek a Philippine criminal-law lawyer immediately if:

The one-year deadline is approaching;
The author is unknown and platform preservation or warrants may be needed;
You received a prosecutor’s subpoena, NBI or police request, summons, Information, or warrant;
Investigators want a device, password, consent search, or sworn admission;
The post concerns a public official, journalist, employer, regulated profession, confidential record, or pending case;
Multiple posts, accounts, jurisdictions, or possible offenses are involved;
You were arrested or threatened with immediate arrest;
A settlement demand includes money, silence, employment consequences, or withdrawal of other cases.

Qualified indigent persons may apply to the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid may also provide assistance or referral, subject to its requirements.

Frequently asked questions

Are screenshots enough to win a case?

Not necessarily. They may help establish what appeared online, but authenticity, completeness, authorship, publication, and context must still be proved. Preserve the URL, profile, metadata, full thread, native files, and witness testimony.

Can a private message be cyber libel?

Only if the defamatory statement was published to a third person. A message sent solely to the person defamed ordinarily lacks publication. A group chat or message copied or forwarded to others may be different.

Is a true post automatically safe?

No. Article 361 generally requires both truth and publication with good motives and for justifiable ends. Privilege, public interest, relevance, wording, and unnecessary circulation also matter.

Can someone be charged for liking or reacting to a post?

A person who merely receives and reacts to another’s post is not liable as its original author under Disini. A new defamatory caption, comment, altered image, or independently worded repost may present a different case.

Can the police arrest someone immediately after a complaint?

Filing a complaint does not by itself authorize arrest. Ordinarily, a judge must first find probable cause and issue a warrant. Warrantless arrest is allowed only in the limited circumstances provided by Rule 113. Bail is generally a matter of right before an RTC conviction for cyber libel.

Does deleting the post prevent prosecution?

No. Copies, witness testimony, platform data, cached material, and device evidence may remain. Deletion can also remove evidence needed by either side.

Can one act be punished as both ordinary libel and cyber libel?

The State may not impose duplicative punishment for the same libelous act in violation of double jeopardy. Separate publications or materially different acts require their own factual analysis.

How long do I have to appeal a conviction?

An RTC appeal is generally taken within 15 days from promulgation of the judgment or notice of the final order. A timely motion for new trial or reconsideration interrupts that period. Obtain appellate counsel immediately because filing the wrong remedy or missing the deadline can make the judgment final.

Official legal sources

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the exact words, medium, audience, authorship evidence, discovery date, venue, documents, and procedural history. Current law and official procedures were checked through August 3, 2026.