Quick answer

A Philippine cyber libel case usually begins with a sworn complaint before the proper city or provincial prosecutor, either directly or after investigation by the NBI Cybercrime Division or PNP Anti-Cybercrime Group. The complainant must prove a defamatory online publication, identification of the person defamed, publication to at least one third person, and malice. The prosecution must ultimately prove every element beyond reasonable doubt.

If you receive a subpoena, do not ignore it. Obtain the complaint and attachments, preserve your account and source records, and file a detailed counter-affidavit by the deadline stated in the subpoena. Under the current DOJ rules, the respondent must ordinarily receive at least 10 calendar days from receipt of the subpoena to submit a counter-affidavit.

Act quickly whichever side you are on. The Supreme Court has confirmed that cyber libel prescribes in one year from discovery of the defamatory publication by the offended party, the authorities, or their agents. Filing the proper complaint interrupts prescription; merely reporting a post to a platform or informally consulting an agency may not.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the defamatory material is published through a computer system or similar information and communications technology.

The prosecution must establish:

A discreditable imputation. The post attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one person other than the person defamed received or saw it. A message sent only to the subject ordinarily lacks this element, while a group chat, public post, email copied to others, video, blog, or shared digital document may satisfy it.
Identification. The complainant need not always be named. Identification may exist if readers familiar with the circumstances could reasonably determine who was being discussed.
Malice. This may involve the statutory presumption of malice or, where constitutional protections apply, proof of actual malice.
Use of a computer system or ICT. The publication occurred through Facebook, X, TikTok, YouTube, a website, messaging service, email, or another computer-based medium.

The words must be read in their full context and ordinary meaning. Labels such as “opinion,” “satire,” or “forwarded” do not automatically prevent liability if the communication conveys a defamatory factual accusation.

Malice, public officials, and privileged communications

Under Article 354 of the Revised Penal Code, a defamatory imputation is generally presumed malicious unless a recognized privilege applies. Two statutory examples are:

A private communication made in performing a legal, moral, or social duty.
A fair and true report, made in good faith and without added remarks, concerning a non-confidential judicial, legislative, or other official proceeding or an official act.

These are generally qualified privileges, not blanket immunity. Proof that the speaker knowingly lied or acted with reckless disregard for the truth may defeat the privilege.

A higher constitutional standard applies when the complainant is a public official or public figure and the statement concerns a matter within the protected sphere of public discussion. The prosecution must prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false. Mere error, failure to conduct an ideal investigation, or ordinary negligence is not automatically actual malice. The Supreme Court reiterated this protection in Tan v. People, G.R. No. 265929.

Public status is not permission to fabricate accusations. The exact subject, context, sources, verification performed, and the accused’s state of mind remain important.

Is truth a complete defense?

Not by itself in every situation.

Article 361 allows truth to be presented in a criminal libel case. For acquittal, the accused generally must show both that the charge was true and that it was published with good motives and for justifiable ends. Proof of the truth of an imputation that does not constitute a crime is ordinarily inadmissible unless it concerns a government employee and facts related to the discharge of official duties.

Preserve the records supporting the statement: official documents, messages, interview notes, recordings lawfully obtained, source materials, research history, requests for comment, and corrections. Unsupported belief, rumor, or repeated hearsay is not equivalent to proof.

The one-year deadline

The controlling rule is now clear: cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Publication is the starting date only when publication and discovery coincide. The Supreme Court affirmed this in its April 8, 2026 resolution in Causing v. People, G.R. No. 258524.

Important qualifications include:

The date of discovery is a factual issue. Preserve the first message, email, screenshot, or witness account showing when the complainant learned of the publication.
Filing the complaint or information interrupts prescription. To avoid uncertainty, file the formal complaint with the proper prosecution office well before the year expires.
If prescription is not apparent from the information, the accused generally bears the burden of proving it.
A later edit, repost, or renewed publication may raise separate factual questions. Do not assume that an old URL or an unchanged post automatically creates a fresh offense each time someone opens it.
A civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code.

Never wait until the last day. Venue errors, incomplete affidavits, holidays, or rejected electronic submissions can put the claim at risk.

How to file a cyber libel complaint

1. Preserve the publication before requesting removal

Save more than a cropped screenshot. Preserve:

The complete post, video, article, message, or thread.
The URL, account name, profile link, user ID if visible, and platform.
Date and time displayed, including the applicable time zone.
Surrounding text, images, comments, replies, and earlier posts needed for context.
Screen recordings showing how the material was accessed.
The original electronic files and unedited copies.
Messages showing when and from whom you first learned about the post.
Names and affidavits of people who personally saw it.
Evidence connecting the account to the proposed respondent.
Documents showing falsity, reputational injury, lost work, medical treatment, or other claimed damage.

Keep the original device and files. Do not add annotations to the only copy. Record who collected each item and when. The Rules on Electronic Evidence require the party offering a private electronic document to establish its authenticity, integrity, and reliability.

2. Identify the correct respondent

An account name or profile photograph alone may be insufficient. Gather lawful evidence of authorship, such as admissions, linked contact details, consistent identifying information, witnesses, or records obtained through proper legal process.

Do not hack an account, impersonate another person, or obtain passwords without authority. If the poster is anonymous, seek prompt assistance from the NBI or PNP. Law-enforcement officers can request preservation of relevant computer data and, when legal requirements are met, apply for warrants to obtain subscriber or traffic information.

3. Establish the correct venue

Cyber libel cases are heard by designated Regional Trial Court cybercrime branches. Under Section 2.1 of the Rule on Cybercrime Warrants, venue may lie in the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Nationwide internet accessibility by itself is not a safe substitute for alleging and proving specific venue facts.

4. Prepare the complaint-affidavit

The affidavit should clearly state:

The complainant’s and respondent’s identifying information.
The exact publication and its complete context.
How the statement is defamatory.
How the complainant was identified.
Who saw or received it.
Facts supporting malice or actual malice, when required.
How the respondent is connected to the account or publication.
When the complainant discovered it.
The specific facts establishing venue.
The harm suffered.
A numbered list of attachments and witness affidavits.

The affidavit and supporting affidavits must be properly sworn. False statements may expose an affiant to criminal liability.

5. File with the proper office

A complainant may:

File directly with the proper city or provincial prosecution office;
Seek investigative assistance from the NBI Cybercrime Division; or
Approach the PNP Anti-Cybercrime Group or an appropriate regional cybercrime unit.

The NBI also maintains an online complaint page. Confirm whether an online submission merely requests investigation or constitutes the formal prosecutorial filing needed to interrupt prescription.

Follow the prosecution office’s current requirements for copies, the NPS Investigation Data Form, fees, electronic files, and proof of service. Electronic or virtual procedures may be allowed, but do not assume that an ordinary email is a valid filing unless the office has authorized it.

What happens during preliminary investigation?

Cyber libel carries a potential maximum imprisonment exceeding six years, so it is handled under the regular preliminary-investigation procedure in DOJ Department Circular No. 015, the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings. The Supreme Court upheld the DOJ’s authority to apply its current prosecutorial standard in En Banc v. Department of Justice, G.R. No. 280455.

The prosecutor evaluates whether the evidence establishes a prima facie case with reasonable certainty of conviction. Ordinarily:

The prosecutor reviews the complaint and either recommends dismissal or issues a subpoena.
The subpoena supplies the complaint and attachments and sets the hearing.
The respondent must receive at least 10 calendar days to prepare and submit a counter-affidavit.
The prosecutor may conduct a physical or virtual clarificatory hearing.
A reply and rejoinder may be required when necessary; each must generally be filed within the period directed under the rules.
The prosecutor either dismisses the complaint or recommends filing an information in court.

The aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review may also be available under DOJ rules, normally subject to a similarly short period. Filing a review does not necessarily suspend proceedings in court; a motion to suspend may be required.

Always follow the date and instructions in the actual subpoena or resolution. Do not calculate a deadline solely from the date printed on the document if it was received later, and keep proof of receipt.

How to defend against a complaint

Respond immediately and preserve everything

On receiving a demand letter, subpoena, resolution, summons, or warrant:

Record the exact date and manner of receipt.
Obtain the entire complaint, attachments, and docket information.
Preserve the account, device, drafts, metadata, login alerts, source material, and complete conversation.
Stop discussing the case publicly.
Do not threaten, pressure, or bargain directly with witnesses.
Consult counsel before giving investigators a statement or surrendering a device.

Do not destroy evidence. At the same time, leaving allegedly harmful material online can increase damage. A lawyer can help arrange preservation first and then assess removal, correction, or clarification without creating misleading evidence.

Address every element in the counter-affidavit

A useful counter-affidavit is specific and evidence-based. Depending on the facts, it may show:

The respondent did not create or publish the material.
The account was compromised, spoofed, or operated by someone else.
No third person received the communication.
The complainant was not named or reasonably identifiable.
The words were not defamatory when read in full context.
The statement was a protected fair report or duty-based private communication.
The material was true and published with good motives and justifiable ends.
The complainant was a public official or public figure and actual malice cannot be proved.
The accused relied on credible records and did not knowingly or recklessly publish a falsehood.
The electronic evidence is incomplete, altered, unauthenticated, or does not reliably establish authorship.
The case was filed after prescription.
The selected venue is unsupported.
The publication occurred before the Cybercrime Prevention Act could lawfully apply.

A bare denial is usually weak. Attach source documents, witness affidavits, account-security records, complete threads, and other admissible evidence.

Likes, shares, comments, and reposts

In Disini v. Secretary of Justice, the Supreme Court limited cyber-libel liability to the original author and struck down the application of Section 5’s aiding-or-abetting provision to cyber libel. A mere automated reaction, like, or unelaborated share should not automatically be treated as aiding and abetting cyber libel.

The protection is not unlimited. A person who writes a new defamatory caption, adopts an accusation as their own, edits it, or makes an independent republication may face a direct-authorship theory depending on the precise act and evidence. Preserve exactly what was added and what the platform displayed.

If an information is filed in court

The filing of a prosecutor’s information does not itself establish guilt. The RTC judge must independently evaluate probable cause and determine whether to issue a warrant, summons, or another order.

Cyber libel is bailable. If a warrant has been issued, consult counsel promptly about voluntary surrender, recall or quashal where justified, and posting bail. Do not evade authorities or attempt to conceal your location.

Possible court remedies may include a motion to quash for a facially defective information, improper venue, prescription apparent from the information, lack of jurisdiction, or another ground recognized by the Rules of Criminal Procedure. Defenses requiring disputed evidence may need to be presented at trial rather than resolved through a motion to quash.

Possible penalties and civil liability

Traditional libel under Article 355, as amended by Republic Act No. 10951, is punishable by imprisonment, a fine, or both. Because the Cybercrime Prevention Act raises the penalty by one degree when libel is committed through ICT, possible imprisonment for cyber libel ranges from four years, two months and one day to eight years, subject to the rules governing the final sentence.

The Supreme Court has held that a court may impose a fine instead of imprisonment. The current statutory fine range for online libel is ₱40,000 to ₱1,500,000, although the amount imposed depends on the circumstances. A fine-only sentence is permitted but not guaranteed. See De Lima v. People, G.R. No. 256700.

Civil damages may also be awarded. Civil liability arising from the offense is generally deemed included when the criminal action is instituted unless it is waived, reserved, or previously filed separately. Article 33 of the Civil Code also recognizes an independent civil action for defamation, subject to procedural rules, prescription, and the prohibition against double recovery.

An apology, retraction, settlement, or affidavit of desistance may affect damages, credibility, prosecutorial discretion, or penalty, but it does not automatically extinguish criminal liability once the State is prosecuting the case.

Evidence both sides should preserve

Keep, where applicable:

Original phones, computers, storage media, and SIM records.
Full-resolution screenshots and screen recordings.
URLs, user IDs, account handles, timestamps, and metadata.
Platform data exports and account-login history.
Drafts, edit histories, deletion notices, and moderation reports.
Complete conversations rather than selected messages.
Source records and verification efforts.
Requests for comment and responses.
Witness names and sworn statements.
Proof of discovery and formal filing dates.
Proof of residence, computer location, or damage relevant to venue.
Medical, employment, business, or financial records supporting claimed damages.
Retraction, apology, settlement, and payment documents.

Store working copies separately and retain untouched originals. Document every transfer of a device or file.

Common mistakes

Waiting for the platform to finish its review while the one-year period runs.
Filing in a convenient but legally unsupported venue.
Submitting cropped screenshots without a URL, date, context, or witness.
Assuming an anonymous account cannot be identified through lawful process.
Treating every insult or harsh opinion as automatically libelous.
Assuming truth alone always guarantees acquittal.
Assuming public officials have no protection against deliberate lies.
Ignoring a prosecutor’s subpoena because no court case has yet been filed.
Posting a public defense that repeats or expands the alleged defamation.
Deleting accounts, messages, drafts, or devices after learning of a complaint.
Contacting the complainant or witnesses in a way that could appear threatening or coercive.
Believing a retraction or affidavit of desistance automatically ends the criminal case.
Missing the 15-day period for reconsideration or review.

When legal help is urgent

Seek a Philippine lawyer immediately if:

The one-year prescriptive period may expire soon.
The account is anonymous or the content is being deleted.
You received a subpoena, resolution, summons, or warrant.
Investigators want to examine or seize a phone, computer, or account.
The publication concerns a journalist, public official, election, whistleblower, or confidential source.
The case involves several reposts, respondents, countries, or possible venues.
The accusation is accompanied by threats, stalking, doxxing, extortion, or account intrusion.
A settlement, apology, or takedown is being negotiated.
Criminal and independent civil claims may overlap.

Frequently asked questions

Can I file because someone insulted me online?

Not every insult is cyber libel. The statement must satisfy all legal elements, including a defamatory imputation, publication to a third person, identification, and malice. Context, ordinary meaning, and whether the words assert facts all matter.

Can a private message be cyber libel?

It can be if a third person received it. A message sent only to the person discussed generally lacks publication. A group chat or copied email may satisfy the requirement.

Is a screenshot enough?

A screenshot can be evidence, but its weight depends on authentication, completeness, and reliability. Preserve the original device, URL, account information, full context, and testimony of people who personally accessed the post.

Does deleting the post end the case?

No. Deletion does not erase a completed publication, although prompt correction or removal may affect damages or other circumstances. Preserve an accurate copy before making changes and obtain legal advice.

Can I be charged merely for pressing “Like” or “Share”?

A mere reaction or unelaborated share is not automatically punishable as aiding or abetting cyber libel under Disini. Adding a defamatory statement or making an independent republication may lead to a different analysis.

Can the complainant withdraw the case?

The complainant may submit an affidavit of desistance or settle the civil aspect, but the prosecutor or court is not automatically required to dismiss the criminal case. Once filed, the criminal action is prosecuted in the name of the People of the Philippines.

Will a complaint automatically cause an arrest?

No. A complaint normally undergoes preliminary investigation. If an information is later filed, the judge independently determines probable cause and whether to issue a warrant or summons.

Where can an anonymous poster be reported?

The NBI Cybercrime Division and PNP Anti-Cybercrime Group are the principal law-enforcement units designated under the Cybercrime Prevention Act. Prompt reporting is important because subscriber, traffic, and content data may be subject to limited preservation periods and warrant requirements.

This article provides general Philippine legal information, not legal advice or a prediction about any particular case. Outcomes depend on the exact words, publication history, parties, evidence, venue, and procedural record. Official sources and current law were checked on August 3, 2026.