Quick answer

To file a Philippine cyber libel case, submit a sworn complaint-affidavit and supporting evidence to the proper City or Provincial Prosecutor’s Office before the offense prescribes. You must be able to show a defamatory online imputation, publication to at least one third person, identification of the person defamed, malice, and authorship or responsibility for the post.

To defend, do not ignore the prosecutor’s subpoena. Obtain the complete complaint, preserve the account and source records, and file a sworn counter-affidavit on the date stated in the subpoena. Address every element, including authorship, publication, identification, malice, privilege, prescription, and venue.

Cyber libel generally prescribes in one year from actual discovery by the offended party, the authorities, or their agents—not automatically from the posting date. Filing the complaint with the prosecutor interrupts prescription. Do not assume that a demand letter, platform report, barangay complaint, or informal report to investigators stops the clock. The Supreme Court confirmed the one-year discovery rule and denied reconsideration with finality in April 2026 in Causing v. People.

What must be proved

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or similar technology.

The prosecution must establish all of the following beyond reasonable doubt at trial:

Requirement	What it means in practice
Defamatory imputation	The post attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person to contempt.
Publication	At least one person other than the person defamed received, viewed, or understood the statement. A purely private message sent only to the subject ordinarily lacks this element, although other offenses may apply.
Identification	The complainant was named or was sufficiently identifiable from the words, images, context, or surrounding facts.
Malice	As a general rule, a defamatory imputation is presumed malicious unless privilege or another applicable doctrine removes that presumption.
Use of a computer system	The statement was published through social media, a website, email, messaging technology, or another computer-based means.
Responsible author	The evidence reliably connects the respondent to the account and the particular post or message.

The meaning of the post is assessed as a whole and in its ordinary context. A complainant’s hurt feelings alone do not establish cyber libel, while disguising an accusation as a question, meme, nickname, quotation, or “opinion” does not automatically protect it.

Important exceptions and qualifications

Public officials, public figures, and matters of public concern

When the publication concerns a public officer’s official conduct or a public figure or matter of legitimate public interest, the prosecution may have to prove actual malice: knowledge that the statement was false or reckless disregard of whether it was true or false. Mere error or ordinary negligence is not automatically actual malice. The standard remains fact-specific, particularly when a post mixes factual accusations with commentary.

Privileged communications

Article 354 of the Revised Penal Code recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty.
A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or official proceeding or official act.

Supreme Court decisions also recognize fair comment and fair reporting on matters of public interest. Qualified privilege removes the ordinary presumption of malice; liability may still arise if actual malice is proved. Statements in some official proceedings may be absolutely privileged, but the scope depends on the proceeding and the statement’s relevance.

Truth is not always enough

Under Article 361, truth may support acquittal when the accused also proves that publication was made with good motives and for justifiable ends. Proof of truth is subject to additional statutory restrictions when the imputation concerns a non-criminal private act. A respondent should therefore preserve not only proof that the allegation was accurate, but also records showing responsible verification, legitimate purpose, fair presentation, and efforts to obtain the other side.

Likes, shares, reactions, and new comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author but struck down its application to people who merely receive and react to a post. It also invalidated aiding or abetting liability under Section 5 as applied to online libel.

This protection is not a license to add a fresh accusation. A comment, caption, edited repost, video, or quote-post containing a new defamatory imputation may itself be treated as an original publication.

Posts made before the law took effect

The Cybercrime Prevention Act cannot be applied retroactively to punish online conduct completed before the law took effect. Continued accessibility of an old page should not simply be assumed to create a new offense. A later edit, renewed upload, or materially new publication requires a document-specific analysis.

Deadline, venue, and possible penalties

One-year criminal prescription

Cyber libel prescribes in one year under Articles 90 and 91 of the Revised Penal Code. The period begins when the alleged offense is actually discovered by the offended party, authorities, or their agents. There is no automatic legal presumption that a person discovered a social-media post on the day it went online.

Evidence of discovery can include the date the complainant first received a link or screenshot, reacted or replied to the post, requested its removal, threatened legal action, or otherwise showed awareness of it. Because the discovery date is often disputed, both sides should preserve contemporaneous messages and records.

The filing of a complaint with the proper prosecutor’s office interrupts prescription. File well before the anniversary date; do not use the last day if venue, office closure, oath, copy, or documentary defects may prevent acceptance.

Proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action is filed before a designated cybercrime court in the city or province:

Where the offense or any element occurred;
Where any part of the computer system used is situated; or
Where damage to the natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Mere nationwide accessibility should not be treated as permission to file anywhere. The complaint and eventual Information must contain facts supporting the chosen venue.

Criminal and civil exposure

Cyber libel may be punished by imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period—approximately four years, two months and one day to eight years—or a fine, or both. The Supreme Court has fixed the fine range at ₱40,000 to ₱1,500,000 under the amended law.

A court may impose a fine instead of imprisonment, but fine-only treatment is discretionary, not guaranteed. Civil damages may also be awarded. These rules are explained in People v. Soliman.

How to file a cyber libel complaint

1. Preserve the publication before requesting removal

Save:

Full-page screenshots showing the complete post, not only the offensive sentence;
The exact URL and account or page address;
Account name, username, numeric profile or post identifier when visible;
Date and time of posting and the date and time you discovered it;
Captions, images, videos, comments, edits, shares, audience settings, and engagement;
A screen recording showing how the post is reached from the account;
Original downloaded files, emails, messages, and notification records;
The device on which the post was received, where practical;
Names and contact details of people who saw and understood the post;
Messages showing admissions, threats, requests for correction, or account ownership;
Records of reputational or financial harm.

Keep untouched originals and working copies. Record who collected each item and when. Screenshots are useful but must ultimately be authenticated under the Rules on Electronic Evidence.

2. Establish authorship, not merely the displayed name

A profile photograph and familiar name may be relevant, but dummy accounts, hacked accounts, and shared devices are possible. The Supreme Court’s social-media identity guideposts allow direct or circumstantial proof such as:

An admission of account access or authorship;
A witness who saw the person use the account or compose the post;
Information or expressions known only to that person or a small group;
Distinctive writing patterns and consistent account activity;
Conduct consistent with the post;
Platform, telecommunications, internet-service, device, location, or forensic records.

Technical records are valuable but not always indispensable. Investigators and courts evaluate the totality of the evidence. See XXX v. People, G.R. No. 274842.

3. Determine whether investigative assistance is needed

A complainant may proceed through the proper prosecutor’s office, but the NBI Cybercrime Division or another authorized cybercrime unit may assist when the author is unknown or platform, subscriber, traffic, or forensic evidence is needed. The DOJ Office of Cybercrime also acts on cybercrime complaints and referrals.

Private parties cannot compel a platform or telecommunications provider to disclose protected subscriber or content data. Law-enforcement and judicial processes may be needed. Seek assistance promptly because platform logs and other volatile data may not remain available indefinitely.

An investigative report is not necessarily the same as filing a complaint for preliminary investigation. If prescription is close, obtain advice about filing directly with the prosecutor and do not assume an investigative referral stops the one-year period.

4. Prepare a complete sworn complaint-affidavit

The affidavit should state, in chronological and non-exaggerated terms:

The complete identities and addresses of the parties, as known;
The exact statements alleged to be defamatory;
Where, when, and through which account or computer system they appeared;
When and how the complainant discovered them;
Who viewed or received them;
Why the complainant was identifiable;
Facts connecting the respondent to the account and post;
Why the statements are false, malicious, or outside any privilege;
Facts supporting territorial venue;
The harm caused; and
A numbered list of attached evidence.

Attach sworn witness affidavits and properly marked supporting records. Use certified or otherwise admissible copies where available. The DOJ’s current filing checklist calls for an Investigation Data Form and multiple copies of the complaint and attachments, including copies for each respondent. Confirm the exact number, format, office hours, and accepted filing method with the receiving prosecution office before filing.

5. File with the proper prosecution office

File the complaint-affidavit with the City or Provincial Prosecutor’s Office having the required territorial connection. Obtain a stamped receiving copy and docket details. A demand for apology or takedown is not a statutory prerequisite to filing.

6. Participate in preliminary investigation

Cyber libel falls under regular preliminary investigation because its prescribed imprisonment reaches at least six years and one day. Under DOJ Department Circular No. 015, the prosecution office first evaluates the form and completeness of the evidence. The investigating prosecutor may recommend early dismissal or issue a subpoena requiring the respondent’s counter-affidavit.

The prosecutor files an Information only when the evidence establishes prima facie evidence with reasonable certainty of conviction—evidence considered admissible, credible, preservable, and capable of establishing the offense and responsible person if left uncontradicted. The Supreme Court upheld this standard in Meking v. Remulla.

7. Act promptly on the resolution

An aggrieved party generally has 15 days from receipt to move for reconsideration under the DOJ rules. An appeal or petition for review is also subject to a short 15-day period under the applicable DOJ rules on appeal, usually counted from receipt of the resolution or denial of reconsideration. The proper reviewing authority and documentary requirements depend on the court that would hear the case. Obtain case-specific advice immediately upon receipt.

If an Information is filed, the designated Regional Trial Court independently determines judicial probable cause. The court—not the complainant or prosecutor—decides whether to issue a warrant, summons, or other appropriate process.

How to defend against a cyber libel complaint

1. Verify and calendar the subpoena immediately

Confirm the subpoena and docket number directly with the issuing prosecution office. Obtain the complaint-affidavit and every attachment. The subpoena should state the date for filing the counter-affidavit; do not rely on an assumed general deadline.

Failure to appear or file can result in the complaint being resolved from the complainant’s evidence alone. A motion to dismiss ordinarily cannot substitute for a counter-affidavit unless it is verified, contains the defenses, and is treated as the counter-affidavit.

2. Stop public commentary but preserve everything

Do not attack the complainant, coach witnesses, fabricate explanations, alter account records, or delete material after receiving notice of an investigation. Preserve:

The complete thread and surrounding discussion;
Drafts, source documents, research, recordings, and interview notes;
Messages showing verification or attempts to obtain comment;
Account access and security alerts;
Device, location, employment, and travel records relevant to authorship;
Earlier communications showing when the complainant discovered the post;
Evidence of privacy settings and actual recipients;
Copies of corrections, apologies, or clarifications with their dates.

Deleting a post does not erase possible liability. A prompt correction or sincere apology may nevertheless be relevant to good faith, malice, damages, or penalty.

3. Build a sworn, evidence-based counter-affidavit

Address each possible issue separately:

No defamatory imputation: The words, read in full context, did not attribute a discreditable fact.
No publication: No third person received or understood the communication.
No identification: Reasonable readers could not identify the complainant.
No authorship or control: The evidence does not reliably connect the respondent to the account or particular post.
Privilege or public interest: The communication was made under a legal, moral, or social duty or was a fair report or fair comment.
No actual malice: For protected public-interest speech, the respondent neither knew the statement was false nor recklessly disregarded its truth.
Truth, good motive, and justifiable end: Support all three with admissible documents and testimony where Article 361 applies.
Prescription: Identify evidence showing an earlier discovery date and calculate the one-year period.
Improper venue: Explain why the alleged location does not satisfy the cybercrime venue rule.
Non-retroactivity: Establish that the actionable publication occurred before the law took effect, if applicable.
Mere reaction: Show that the act was only receipt or reaction to another’s post and did not create a new defamatory accusation.

A bare denial is usually weak. Attach affidavits from witnesses and the actual records on which each defense relies.

4. File correctly and retain proof

The counter-affidavit must be subscribed and sworn before an authorized officer. Follow the subpoena’s instructions on copies, service, hard-copy submission, and any permitted electronic filing. Personal appearance may sometimes be dispensed with when the affidavit was properly sworn elsewhere, but follow the investigating prosecutor’s order rather than assuming attendance is unnecessary.

5. Prepare for an adverse resolution

If the complaint is dismissed, preserve the resolution and monitor any motion or appeal. If probable cause is found, calendar the 15-day reconsideration and review periods immediately.

Once an Information is filed in court, obtain criminal-defense counsel before taking action on any warrant or surrender. Cyber libel is ordinarily bailable as a matter of right before conviction, but the court fixes the amount and conditions. Do not evade service or obstruct a lawful search. Counsel can arrange an orderly response, examine the warrant’s scope, seek bail, and raise the appropriate court remedies.

Criminal complaint, civil damages, and takedown are different remedies

A criminal complaint is prosecuted in the name of the People of the Philippines. The offended party may participate through private counsel when the related civil liability is included.

A separate civil action for defamation may be available under Article 33 of the Civil Code and requires proof by preponderance of evidence, but double recovery for the same injury is prohibited. Civil defamation actions generally carry a one-year limitations period under Article 1147. Whether to reserve, include, or separately file the civil claim should be decided before pleadings are submitted.

A criminal complaint does not automatically remove online content. Platform reporting, a carefully written correction or takedown request, and judicial remedies have different standards and consequences. Preserve the evidence before pursuing removal.

Common mistakes

Waiting for a platform response while the one-year period runs;
Counting automatically from the posting date without preserving proof of discovery;
Filing wherever the post can be opened instead of establishing proper venue;
Submitting cropped screenshots without URLs, dates, context, or authentication;
Naming the visible profile owner without proof of access or authorship;
Treating every insult, criticism, joke, or unfavorable review as criminal libel;
Assuming that calling something an “opinion” defeats a factual accusation;
Believing that truth alone is always a complete defense;
Ignoring a prosecutor’s subpoena or filing only an unsigned position paper;
Deleting accounts, messages, drafts, or device records after a dispute begins;
Repeating the accusation publicly while announcing the case;
Assuming a like or simple share is automatically cyber libel—or assuming that a new defamatory caption is protected as a mere share;
Expecting an NBI report, demand letter, barangay proceeding, or platform complaint necessarily to interrupt prescription;
Paying, threatening, or demanding money in exchange for suppressing publication without legal advice, which may create separate legal problems.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The first-discovery anniversary is approaching;
You received a prosecutor’s subpoena, court summons, warrant, or search order;
The account is anonymous, hacked, shared, deleted, or based abroad;
Platform or telecommunications records are needed;
The publication concerns a public official, journalist, company, election, or official proceeding;
Several posts, edits, reposts, or possible complainants are involved;
A civil damages claim accompanies the criminal complaint;
The post also contains threats, intimate material, personal data, fabricated records, or allegations involving a child; or
Settlement, correction, apology, or takedown terms are being proposed.

Frequently asked questions

Is one screenshot enough?

Not necessarily. It may show the words but fail to prove the complete context, publication, date, account control, or authenticity. Preserve the URL, account details, native records, witnesses, and surrounding thread.

Is a demand letter required before filing?

No. It can request correction, apology, preservation, or removal, but it is not a required element of cyber libel and should not be relied on to stop prescription.

Can an anonymous or dummy account be prosecuted?

Potentially. Ownership or authorship may be proved through admissions, witnesses, distinctive information or language, account history, related conduct, and technical records. The displayed name alone may be insufficient.

Does deleting or apologizing end the case?

No. A completed publication is not automatically erased by deletion or apology. Prompt corrective action may still be relevant to good faith, damages, prosecutorial evaluation, or sentencing.

Can a person go to jail for cyber libel?

Yes. Imprisonment remains legally available, although a court may impose a fine alone after considering the circumstances.

Can a person be charged for merely liking or sharing a post?

A simple receipt or reaction is protected under Disini. A person who adds a new defamatory assertion may be treated as the original author of that new publication.

Is every false online statement cyber libel?

No. The statement must be defamatory, published to another person, refer to an identifiable complainant, be malicious under the applicable standard, and be attributable to the respondent. Other laws may apply to false statements that do not satisfy these elements.

Does filing the complaint mean the respondent will be arrested immediately?

No. Preliminary investigation normally comes first. If the prosecutor files an Information, the judge independently determines probable cause and whether a warrant or summons should issue.

Official references

This article provides general legal information, not advice for a particular case. Outcomes depend on the exact words, audience, account evidence, dates, venue facts, documents, and procedural history. Primary legal and procedural sources were checked through July 26, 2026.