Quick answer

To file a cyber libel case, preserve the online material immediately, record when it was discovered, identify the author and witnesses, and file a sworn complaint with the proper City or Provincial Prosecutor’s Office. The National Bureau of Investigation’s Cybercrime Division can assist with attribution, device examination, and requests to preserve provider data.

To defend a case, do not ignore a prosecutor’s subpoena. Obtain the complete complaint and attachments, preserve your account and device records, and submit a sworn counter-affidavit addressing every element of the charge by the date stated in the subpoena. Seek counsel promptly because cyber libel can carry imprisonment, a substantial fine, civil damages, and strict procedural deadlines.

Cyber libel generally prescribes in one year from actual discovery by the offended party, authorities, or their agents—not automatically from the posting date. The Supreme Court confirmed this rule with finality in April 2026. Filing a complaint or information interrupts prescription. The claimed discovery date can be disputed with evidence such as earlier comments, reactions, messages, or threats to sue. See Causing v. People, G.R. No. 258524, April 8, 2026.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act punishes libel under the Revised Penal Code when committed through a computer system or a similar future technology. This can include social-media posts, online articles, blogs, emails, group messages, videos, captions, graphics, and other digitally published material. See Republic Act No. 10175.

The prosecution must establish all of the following:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or viewed the imputation. A private message seen only by its sender and subject ordinarily lacks this element, although other offenses may apply.
Identifiability. The offended person was named or could be identified by at least one third person from the post and surrounding facts. Naming the person is not indispensable, but hurt feelings alone are insufficient.
Malice. Depending on the circumstances, malice may be presumed from a defamatory imputation or must be proved as actual malice.
Use of a computer system or information and communications technology.
Responsibility for the publication. The evidence must connect the respondent to the post or other digital publication; merely showing that an account bears the respondent’s name may not resolve disputed authorship.

Courts consider the entire publication, its ordinary meaning, audience, context, accompanying images, and surrounding circumstances—not isolated words alone. The established elements are discussed in Disini v. Secretary of Justice and Diaz v. People.

Criticism, opinion, and offensive speech are not automatically libel

A harsh opinion, joke, insult, or criticism is not automatically criminal. The question is whether the publication, read as a whole, makes or conveys a defamatory factual imputation about an identifiable person.

Calling something an “opinion” is not conclusive. A statement framed as an opinion may still be actionable if it implies undisclosed or false defamatory facts. Conversely, rhetorical exaggeration or criticism that cannot reasonably be understood as asserting a defamatory fact may fail the first element.

Public discussion receives stronger protection when it concerns a public officer’s official conduct or a genuine public issue. In such cases, the prosecution may have to prove actual malice: knowledge that the assertion was false or reckless disregard of whether it was false. Recklessness requires more than ordinary carelessness; it involves serious doubt or a high awareness of probable falsity. See Tulfo v. People, G.R. Nos. 187113 and 187230.

Criticism of a public officer’s private life does not automatically receive the same protection, particularly when it has no reasonable connection to official duties.

Who may be charged?

The primary target is ordinarily the person responsible for the original defamatory publication.

In Disini, the Supreme Court held that cyber libel is constitutional as applied to the original author but unconstitutional as applied to people who simply receive a post and react through ordinary likes, comments, or shares. It also invalidated “aiding or abetting” liability under Section 5 insofar as it applies to cyber libel.

That protection has limits. A person who writes a new comment containing a separate defamatory accusation may become the original author of that new publication. Authorship and publication responsibility can also be more complicated for online newsrooms, organizational accounts, ghostwritten posts, jointly managed pages, and material deliberately republished with new assertions.

An anonymous or pseudonymous account is not immune. Law enforcement may seek subscriber, traffic, or content data through preservation procedures and court-issued cybercrime warrants.

The filing deadline

Criminal case

Cyber libel prescribes in one year from the day it is discovered by the offended party, the authorities, or their agents.

The Supreme Court has rejected both the former 15-year view and the argument that an online post is presumed discovered on its publication date. Discovery is a factual question. Evidence may include:

The first screenshot, message, or report sent to the complainant;
A comment or reaction by the complainant;
A demand for deletion or retraction;
A message confronting the author;
A prior police, NBI, employer, or platform report; or
A public statement threatening legal action.

The period is interrupted by the filing of the complaint or information. Do not wait until the last day: venue errors, incomplete affidavits, office closures, and disputes over the filing date can become decisive.

Civil action

A civil action for defamation generally must also be brought within one year under Article 1147 of the Civil Code. A civil claim arising from the offense is usually deemed included in the criminal case unless it is waived, reserved, or previously filed, subject to the applicable procedural rules. The interaction between separate civil and criminal cases should be planned with counsel before either is filed. See the Civil Code of the Philippines.

Where to file

Cyber libel cases are tried by a designated Regional Trial Court acting as a cybercrime court. Under Section 2.1 of the Rule on Cybercrime Warrants, venue may lie in the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where any of the damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. A complaint should therefore be lodged with the prosecution office corresponding to a legally supportable venue. The complaint and, later, the information must allege the relevant venue facts; nationwide internet accessibility by itself should not be treated casually as permission to file anywhere.

Barangay conciliation is generally not a prerequisite because cyber libel’s prescribed penalty exceeds the jurisdictional limits of the lupon.

Evidence to preserve before filing

Digital material can be edited, hidden, deleted, or stripped of context. Preserve it before demanding removal.

Keep, where available:

Screenshots showing the full post, account name, handle, date, time, captions, comments, and surrounding thread;
The exact URL and any account, post, channel, or message identifier;
A screen recording navigating from the account or page to the material;
Original images, videos, audio, emails, messages, and downloaded files;
The device on which the material was first viewed;
Platform download or account-history records;
Messages showing authorship, admissions, editing, distribution, threats, or motive;
The names and contact details of third persons who saw the material and identified its subject;
Records establishing the exact discovery date;
Documents supporting truth or falsity;
Evidence of concrete harm, such as cancelled contracts, employment action, lost customers, medical records, or messages from people who believed the post; and
A written timeline identifying who did what, when, where, and using which account or device.

Do not crop away context, alter metadata, edit files, impersonate anyone, or access an account without authority. Keep an untouched copy and a separate working copy. A screenshot is useful but is not automatically conclusive: electronic evidence must still be authenticated and connected to its source and author.

Provider records may disappear under retention policies. Under Sections 13 and 14 of Republic Act No. 10175, law-enforcement authorities may require preservation of specified data, while disclosure generally requires proper legal process. A private complainant cannot simply compel a platform to surrender another user’s private data.

How to file a complaint

1. Test the case against every element

Before filing, identify:

The exact allegedly defamatory words, images, or statements;
Their complete context;
The person allegedly defamed and how third parties identified that person;
At least one third person who received the publication;
The evidence identifying the author;
The computer system or online platform used;
Facts showing malice, where required;
The date and proof of discovery; and
Facts supporting the chosen venue.

A conclusory allegation that a post was “libelous” is not a substitute for evidence of each element.

2. Decide whether investigative help is needed

A complainant may seek assistance from the NBI Cybercrime Division, particularly where:

The account is anonymous or impersonating someone;
Provider data may be needed;
A device requires forensic examination;
The material has been deleted;
Several accounts or jurisdictions are involved; or
Other conduct—such as hacking, threats, extortion, identity theft, stalking, or unlawful disclosure of intimate material—may constitute a separate offense.

NBI assistance is an investigative route; the criminal charge is ultimately evaluated through the prosecution process.

3. Prepare the complaint-affidavit

The sworn complaint should provide a clear chronological account based on personal knowledge. Attach:

The complained-of publication in full;
URLs, identifiers, files, and screenshots;
Witness affidavits;
Evidence identifying the respondent as author;
Evidence of discovery and venue;
Relevant correspondence and source documents; and
A translation where material in another language may not be readily understood.

State facts accurately. Exaggerating circulation, inventing witnesses, concealing earlier discovery, or submitting altered screenshots can damage the case and create separate liability.

4. File with the proper prosecution office

File the sworn complaint and supporting evidence with the proper City or Provincial Prosecutor’s Office. Confirm that office’s current requirements for copies, forms, electronic submission, and proof of service before filing. Obtain a stamped receiving copy or official electronic acknowledgment showing the date and time of filing.

5. Participate in the preliminary investigation

Because cyber libel’s prescribed imprisonment can reach eight years, it undergoes regular preliminary investigation under the 2024 DOJ-NPS Rules.

The prosecutor evaluates whether there is prima facie evidence with reasonable certainty of conviction. This requires evidence capable, if unrebutted, of establishing the elements and producing a conviction—not merely suspicion or online controversy. The rules were upheld in Meking v. Department of Justice, G.R. No. 280455.

The respondent receives the complaint and a subpoena directing the submission of a counter-affidavit. The date set must allow at least 10 days from receipt of the subpoena and complaint. The prosecutor may conduct a physical or virtual clarificatory hearing when material facts require clarification.

The governing issuance is DOJ Department Circular No. 015, series of 2024.

6. Await the resolution and possible court filing

If the prosecutor finds the required evidence, an information is prepared for filing in the designated cybercrime court. The judge then independently determines judicial probable cause and the appropriate process. A prosecutor’s finding does not itself establish guilt, and filing a complaint does not mean automatic conviction.

If the complaint is dismissed or the respondent is indicted, an aggrieved party may generally file a motion for reconsideration within 15 days from receipt of the resolution. Further review depends on the issuing prosecution office, applicable National Prosecution Service appeal rules, and whether an information has already been filed in court.

How to defend against a complaint

Act immediately upon receiving a subpoena

Record the date and manner of receipt. Obtain the complaint, all attachments, and the exact submission deadline. If the attachments are incomplete or the period is improperly shortened, raise the problem promptly in writing; do not simply miss the deadline.

A motion to dismiss ordinarily cannot replace a counter-affidavit unless it is verified and contains the respondent’s defenses, in which case it is treated as the counter-affidavit.

Preserve, do not delete

Preserve the account, devices, source material, drafts, messages, access logs, security alerts, and recovery records. Deletion may destroy favorable evidence and can appear inconsistent with good faith. Never fabricate a hacking claim or ask witnesses to change their accounts.

If the account was compromised, preserve:

Login and security-alert emails;
Password-reset records;
Active-session and device histories;
Reports made to the platform;
Police or NBI reports;
Evidence of the actual location of the accused; and
Communications sent when the compromise was discovered.

Address each element separately

Possible defenses, depending on the evidence, include:

The material was not defamatory when read in full and in context;
No third person received it;
The complainant was not identifiable;
The respondent did not author, post, or control the publication;
The evidence does not authenticate the post or connect it to the respondent;
The statement was a protected criticism, fair comment, or privileged communication;
Actual malice was not proved where the complainant was a public officer or public figure and the material concerned a public matter;
The imputation was true and published with good motives and for justifiable ends, subject to Article 361;
The complaint was filed after prescription;
The asserted discovery date is contradicted by earlier conduct;
Venue is unsupported; or
The information materially differs from the accusation and evidence presented during preliminary investigation.

A bare denial is usually weaker than records, witnesses, source documents, or technical evidence.

Use truth carefully

Truth is not an automatic defense in every situation. Article 361 provides for acquittal when the matter is true and was published with good motives and for justifiable ends. Proof of truth concerning a noncriminal act or omission is restricted unless the imputation concerns a government employee and facts related to official duties.

Prepare the original records and reliable witnesses that supported the publication at the time it was made. Later-developed speculation does not establish that the author acted responsibly or without malice.

Examine privilege and actual malice

Article 354 recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments, of qualifying official proceedings or acts performed by public officers in their functions, provided the material is not confidential.

Privilege is fact-specific. Unnecessary circulation, inflammatory additions, lack of good faith, or publication beyond the duty’s reasonable scope may defeat it. When the communication is privileged, the prosecution must establish actual malice.

Submit a complete sworn counter-affidavit

The counter-affidavit should:

Admit only facts that are genuinely undisputed;
Answer the exact words and publication alleged;
Explain relevant context without creating new defamatory statements;
Challenge missing or inadmissible evidence;
Attach defense records and witness affidavits;
Identify prescription and venue issues expressly; and
Request the appropriate disposition.

Do not use the counter-affidavit to retaliate, threaten the complainant, or repeat accusations unnecessarily.

If an information, warrant, or search order has been issued

Contact counsel immediately. A subpoena from a prosecutor is not the same as a warrant of arrest, and a complaint filed with law enforcement is not proof that a court case already exists.

If arrested:

Remain calm and do not resist;
Ask to see the warrant and confirm your identity;
Invoke the right to remain silent and to consult counsel;
Do not sign a confession or waiver without independent legal advice; and
Arrange bail through lawful court procedures.

Cyber libel is generally bailable as a matter of right before conviction because it is not punishable by death, reclusion perpetua, or life imprisonment. The court determines the amount and conditions.

If officers serve a cybercrime search or examination warrant, do not obstruct its lawful execution. Note the warrant’s court, case number, places, devices, accounts, and data described; obtain an inventory or receipt; and contact counsel. Challenges to scope, validity, handling, or forensic examination should be raised through lawful procedures, not by deleting or concealing data.

Penalties and civil exposure

Section 6 of Republic Act No. 10175 raises the penalty by one degree when libel is committed through information and communications technology.

The imprisonment range for cyber libel is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years.

The Supreme Court has also held that a fine may be imposed instead of imprisonment. Under People v. Soliman, the cyber-libel fine ranges from ₱40,000 to ₱1,500,000 after applying Article 75 to Article 355’s amended fine. Depending on the judgment, the court may impose imprisonment, a fine, or both, together with civil liability. See People v. Soliman, G.R. No. 256700.

The judicial preference for a fine in appropriate libel cases is not an automatic entitlement and does not decriminalize cyber libel. The circumstances, prior conduct, gravity, and reasons stated by the court remain relevant.

Retraction, apology, and removal

Deleting a post, apologizing, or publishing a correction does not automatically erase criminal or civil liability. It may nevertheless:

Stop further reputational harm;
Support good faith or mitigation;
Reduce the need for urgent relief;
Help produce a voluntary settlement where lawful; or
Affect the assessment of damages or penalty.

Obtain legal advice before sending a demand, admission, retraction, or settlement proposal. Avoid demands that threaten unrelated criminal exposure or seek payment in terms that could be construed as coercive.

A cyber libel complaint does not automatically remove online content. Section 19 of Republic Act No. 10175, which had authorized executive blocking, was declared unconstitutional in Disini. A complainant may separately use a platform’s reporting system or seek legally available court relief, but prior restraint and due-process concerns apply.

Common mistakes

Waiting because the post remains online, despite the one-year period from discovery;
Recording an inaccurate discovery date;
Saving only a cropped screenshot without the URL, account, timestamp, or context;
Naming everyone who liked or shared a post despite Disini;
Treating every insult or negative review as a defamatory factual accusation;
Assuming truth alone always defeats the charge;
Filing in a convenient city without facts establishing venue;
Relying on an account name alone to prove authorship;
Contacting or threatening witnesses;
Deleting accounts, devices, messages, or drafts;
Ignoring a subpoena because it is not a warrant;
Filing a motion to dismiss instead of the required sworn counter-affidavit;
Repeating the accusation publicly while the case is pending; and
Assuming platform removal is equivalent to filing or withdrawing a legal case.

When legal help is urgent

Seek a Philippine lawyer immediately if:

The one-year filing deadline is close;
A prosecutor’s subpoena has arrived;
A motion-for-reconsideration deadline is running;
The alleged author is anonymous and provider data may disappear;
A warrant of arrest, search warrant, or cybercrime warrant has been issued;
Law enforcement requests an interview or device examination;
The post involves a public officer, journalist, whistleblower, workplace report, or privileged communication;
A separate civil action has been filed or contemplated;
The incident also involves threats, stalking, extortion, hacking, identity theft, or intimate material; or
The complainant and respondent are in different provinces or countries.

Qualified indigent persons may seek assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid may also provide legal-aid routing and contact information.

Frequently asked questions

Can I file if the post has already been deleted?

Yes, if admissible evidence can still establish the publication, content, author, audience, and other elements. Preserve existing copies and seek investigative assistance promptly because provider records may be time-limited.

Is a demand letter required before filing?

No. A prior demand, barangay proceeding, or request for retraction is generally not an element of cyber libel. A demand may be strategically useful, but it can also create evidence concerning discovery, admissions, or motive.

Can I be charged for merely liking or sharing a post?

Under Disini, a person who simply receives and reacts to the original post through an ordinary like, comment, or share is not liable as an aider or abettor of cyber libel. A new comment that makes a separate defamatory accusation may itself be treated as an original publication.

Must the complainant be named in the post?

No. It is enough if at least one third person could identify the complainant from the publication and surrounding evidence. A vague resemblance, subjective suspicion, or unsupported witness conclusion may be insufficient.

Is an accusation sent only to the complainant cyber libel?

Ordinarily, libel requires publication to a third person. If no one else received the communication, that element may be absent. Threats, coercion, harassment, or another offense may still apply.

Does being correct automatically defeat the case?

No. Article 361 generally requires both truth and publication with good motives and for justifiable ends. Different rules apply to certain imputations involving public employees and official duties.

Does filing a complaint mean the respondent will be arrested immediately?

No. The prosecutor first conducts a preliminary investigation. If an information is filed, the judge independently evaluates judicial probable cause before issuing the appropriate process.

Can the parties settle?

They may discuss apology, correction, removal, damages, or other lawful terms, but settlement does not by itself guarantee dismissal of a criminal case because the State prosecutes the offense. Any affidavit of desistance is considered with the other evidence and is not automatically controlling.

Official legal sources

General-information disclaimer

This article provides general Philippine legal information, not legal advice or an attorney-client relationship. Cyber libel outcomes depend on the complete publication, evidence, parties, discovery date, venue, and procedural history. Consult a Philippine lawyer about the actual records and deadlines. Laws and official sources were checked through August 1, 2026.