Quick answer

To file a Philippine cyber libel case, preserve the online material and its context, identify evidence linking it to the author, and promptly file a sworn complaint with the prosecutor’s office for the proper venue. Cyber libel generally prescribes one year from discovery by the offended party, authorities, or their agents—not automatically from the posting date. A public post does not create a legal presumption that the offended person discovered it immediately. Filing with the proper prosecution office interrupts prescription, so do not rely only on a platform report, demand letter, barangay complaint, or police blotter.

To defend, do not ignore a subpoena or delete evidence. Obtain the complete complaint and attachments, preserve your own records, and submit a detailed counter-affidavit on time. Examine whether the prosecution can establish every element: a defamatory imputation, publication to a third person, identification of the offended person, malice, use of a computer system, and the accused’s authorship or responsibility.

Cyber libel carries serious exposure, but conviction is not automatic merely because a post is insulting, damaging, or factually disputed. Privilege, lack of publication or identification, failure to prove authorship, good-faith public-interest reporting, absence of actual malice where required, prescription, improper venue, and constitutional protections may be decisive.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on written libel when the publication is made through a computer system or similar technology. This can include material posted through social media, websites, blogs, online forums, email, messaging applications, or comparable digital channels.

The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one person other than the person defamed received, read, or perceived the statement.
Identification. The complainant was named or was reasonably identifiable from the words and surrounding circumstances.
Malice. The applicable form of malice must be established, subject to statutory privileges and constitutional standards.
Online publication. The act was committed through a computer system or similar means.
Identity of the responsible author. The evidence must connect the accused—not merely an account bearing the accused’s name or photograph—to the post or communication.

The statement is assessed as a whole, in its language, context, audience, and ordinary meaning. A complainant’s embarrassment or disagreement with criticism does not by itself prove libel. Conversely, labeling an accusation as “opinion,” “alleged,” “for awareness,” or “just asking” does not protect a post that reasonably communicates a false defamatory assertion of fact.

Who may be held responsible?

In Disini v. Secretary of Justice, the Supreme Court sustained cyber libel only as applied to the original author of the defamatory online statement. It invalidated the Cybercrime Prevention Act’s provisions on aiding or abetting cyber libel because their breadth could criminalize ordinary online reactions.

Accordingly:

Merely receiving, liking, reacting to, or sharing another person’s post without adding defamatory content is not, by itself, punishable as aiding or abetting cyber libel.
A person who adds a new defamatory caption, accusation, comment, or altered presentation may be treated as the author of that new material.
Using another person’s name or profile photograph does not conclusively prove that person controlled the account.
Liability of editors, publishers, account administrators, employers, or corporate officers depends on the applicable law and their proven role. Position or job title should not be treated as automatic proof of authorship of an online post.

The prosecution must also prove the perpetrator’s identity beyond reasonable doubt at trial. The Supreme Court’s guideposts permit direct or circumstantial evidence such as admissions, witnesses who saw the account being used, information known only to the author, distinctive language, prior consistent conduct, platform or telecommunications records, device forensics, geolocation, login history, and other reliable links. Technical evidence is useful but is not always indispensable. See XXX v. People, G.R. No. 274842.

Preserve the evidence before taking action

Online material can be edited, deleted, made private, or stripped of context. Preserve it before sending a demand or requesting removal.

Keep:

Screenshots showing the complete post, comments, account name, profile information, date and time, privacy or audience setting, and visible URL;
A screen recording showing how the page or conversation was reached;
The direct URL, account ID or handle, post ID, and exact date and time of capture;
Original photos, videos, audio, messages, emails, downloads, and exported account data;
The device on which the content was received or viewed;
Names and contact details of people who independently saw it;
Messages demonstrating when the complainant or authorities first discovered it;
Evidence connecting the account or device to the suspected author;
Proof of harm, such as canceled work, lost clients, employment communications, medical records, or messages from people who understood the post to refer to the complainant; and
For the defense, source documents, interview notes, research, drafts, editorial records, account-access logs, and communications showing verification, context, privilege, or good faith.

Do not crop away material that may change the meaning. Do not annotate or edit the only saved copy. Preserve originals and work from duplicates. If possible, have a person with direct knowledge execute an affidavit explaining how the electronic evidence was found and captured.

A screenshot can be evidence, but it is not automatically conclusive or admissible. The party offering an electronic document bears the burden of showing authenticity, integrity, and reliability under the Rules on Electronic Evidence.

Do not hack an account, impersonate another person, secretly seize a device, or obtain private communications unlawfully. Ask a lawyer or authorized cybercrime investigator about lawful preservation, disclosure, or forensic procedures.

The one-year filing deadline

The controlling rule is that cyber libel prescribes one year from the day it is discovered by the offended party, the authorities, or their agents. The Supreme Court reaffirmed this rule with finality in 2026. A public Facebook setting, by itself, does not presume immediate discovery; actual knowledge is determined from evidence such as reactions, comments, messages, threats to sue, or other conduct demonstrating awareness. See Causing v. People and the Supreme Court’s 2026 final-resolution summary.

The period is interrupted by filing the complaint or information. For safety, file the sworn complaint with the proper prosecution office well before the anniversary of discovery. Do not assume that any of the following stops the period:

Reporting the post to Facebook, TikTok, X, YouTube, or another platform;
Sending a demand, correction request, or cease-and-desist letter;
Making a barangay blotter or undergoing informal mediation;
Asking the post’s author to apologize; or
Making an inquiry that has not resulted in filing with the proper prosecution office.

A newly authored repost may present a separate publication issue, but the mere continued availability of an old post should not be assumed to restart prescription every day. Material first published before the Cybercrime Prevention Act became effective cannot be punished retroactively as cyber libel merely because it remains online. Whether a later edit or affirmative republication constitutes a new act depends on exactly what was changed and who made the change.

Record the discovery date accurately and preserve the evidence supporting it. A false or artificially delayed discovery date can damage the complaint and the witness’s credibility.

Where to file

Cyber libel cases are tried in designated Regional Trial Court cybercrime branches. Under the Rule on Cybercrime Warrants, venue may lie in the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where damage to the natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of other courts. Venue must be supported by specific facts; it should not be selected merely for convenience or because the post could theoretically be accessed there.

The initial sworn complaint is normally filed with the City or Provincial Prosecutor’s Office corresponding to the proper venue. The PNP Anti-Cybercrime Group or NBI cybercrime investigators may help identify an anonymous author or obtain technical evidence, but investigative assistance is not a substitute for timely filing with the prosecution office.

Because cyber libel’s prescribed imprisonment exceeds one year and its fine exceeds the Local Government Code threshold, barangay conciliation is not ordinarily a prerequisite.

How to prepare and file the complaint

1. Assess each allegedly defamatory publication

Identify the exact words, image, video, caption, or message complained of. If there are several posts or defendants, analyze each separately. Do not rely on a general allegation that an entire account or campaign was defamatory.

For each item, ask:

What precisely was imputed?
Why is it defamatory in context?
Who received or saw it?
How was the complainant identified?
What evidence shows authorship?
When and how was it discovered?
Why is the selected venue proper?
Is the communication arguably privileged?
What evidence shows falsity, malice, and resulting harm?

2. Prepare a complaint-affidavit

The affidavit should be based on personal knowledge, arranged chronologically, and sworn before an authorized officer. It should state the complainant’s and respondent’s available identifying information and addresses, the elements of the offense, the discovery date, venue facts, and the relief sought.

Attach clearly marked supporting evidence, including:

Complete captures and readable printouts;
English translations where material passages are in Filipino, Cebuano, Ilocano, or another language;
Affidavits of people who saw the publication or can identify the account;
Documents contradicting the accusation;
Evidence connecting the respondent to the account or post; and
Evidence of reputational, financial, professional, or emotional harm.

Complete the required National Prosecution Service investigation data form. Confirm the current number of paper copies, file-size limits, oath requirements, and any authorized electronic-filing procedure directly with the receiving prosecution office. The DOJ’s official checklist is available through its filing guidance for preliminary-investigation complaints.

3. File in the proper prosecution office

Obtain a stamped receiving copy or official electronic acknowledgment showing the date and time of filing. Keep the docket number and proof that all required submissions were received.

The applicable prosecutorial standard is prima facie evidence with reasonable certainty of conviction. The evidence at hand must be admissible, credible, capable of preservation and presentation at trial, and sufficient—if left uncontradicted—to establish all elements. The Supreme Court upheld this standard and the validity of the current DOJ rules in Meking v. Remulla.

4. Participate in the preliminary investigation

If the prosecutor finds sufficient ground to continue, the respondent receives a subpoena with the complaint and attachments. Under DOJ Department Circular No. 15, series of 2024, the hearing date for submission of the counter-affidavit must be at least ten days from the respondent’s receipt of the subpoena and complaint.

The prosecutor may resolve the matter on the affidavits or conduct a physical or virtual clarificatory hearing. A reply and rejoinder may be required when material new issues need to be addressed.

5. Act promptly on the resolution

An aggrieved party may file a motion for reconsideration of the prosecutor’s resolution within 15 days from receipt. A further petition for review may be available under the applicable DOJ rules, but it has strict requirements.

If an information has already been filed in court, a prosecutor-level motion or petition does not automatically stop the criminal proceedings. Counsel may need to request the appropriate relief from the trial court.

How to respond if you receive a subpoena

A prosecutor’s subpoena is not an arrest warrant, but ignoring it may allow the complaint to be resolved without your evidence.

Take these steps immediately:

Record the date and manner of receipt. The response period is tied to service.
Obtain every attachment. Check whether the screenshots, affidavits, translations, and account information are complete and legible.
Preserve your devices and records. Do not factory-reset a phone, erase messages, alter logs, or coordinate stories with other respondents.
Stop discussing the dispute online. Retaliatory posts may become new evidence or separate charges.
Prepare a counter-affidavit, not a bare denial. Address each element and authenticate supporting documents.
Identify preliminary objections. These may include prescription, lack of venue, absence of publication or identification, failure to allege an offense, privilege, and failure to connect you to the account.
Explain account access. If several people administer an account, identify their roles and preserve access logs, permissions, and device records.
File and furnish copies as directed. Keep proof of filing and service.

Under the current DOJ rules, a motion to dismiss generally cannot replace the counter-affidavit. A verified motion containing the respondent’s defenses may instead be treated as the counter-affidavit. Do not assume that filing a one-page jurisdictional motion preserves every defense.

Key defenses and limitations

No defamatory imputation

The words may be criticism, satire, rhetoric, reporting, or an insult that does not impute a discreditable fact or condition. Context matters. Still, an apparent opinion can be actionable when it implies undisclosed false facts.

No publication to a third person

A message sent only to the complainant ordinarily lacks the publication element. A group chat, copied email, public post, forwarded message, or communication to another person may satisfy it.

The complainant was not identifiable

The complainant need not always be named, but the prosecution must show that recipients could reasonably identify that person from the words and circumstances. A complainant’s private belief that a vague post referred to them is insufficient without supporting evidence.

Authorship was not proved

A name, photograph, or screenshot of a profile is not necessarily proof of control or authorship. Evidence may show impersonation, account compromise, shared administration, lack of access, inconsistent language, device location, or another author. A bare “dummy account” defense is also weak if other circumstances reliably identify the accused.

Privileged communication

Article 354 of the Revised Penal Code recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of non-confidential judicial, legislative, or other official proceedings, statements made in those proceedings, or acts performed by public officers in their functions.

Privilege depends on the occasion, recipients, scope, accuracy, and good faith. Sending a complaint to people who have a legitimate duty to receive it may be protected; broadcasting the same accusation to an unlimited audience may exceed the privilege. An inaccurate report or added defamatory commentary may also lose protection.

Public-interest comment and actual malice

Where speech concerns a public officer’s official conduct, a public figure, or a genuinely public matter, constitutional protections become especially important. Qualified privilege removes the ordinary presumption of malice, and the prosecution may have to prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false.

Actual malice in this sense is not simply anger, harsh language, political hostility, or dislike. Evidence of fabrication, deliberate avoidance of obvious contrary information, reliance on plainly unreliable material, or publication despite awareness of probable falsity may be relevant.

Truth, good motives, and justifiable ends

Truth is not a universal, stand-alone defense under Article 361. When the imputation alleges a crime, proof of truth may be admitted. For a non-criminal act or omission, the statutory rule generally permits proof of truth when the imputation concerns a government employee and relates to official duties. Acquittal on this defense requires proof not only of truth but also of good motives and justifiable ends.

Source documents, complete official records, direct witnesses, and contemporaneous verification are much stronger than rumors, anonymous messages, or an assumption that another publication must have checked the allegation.

Prescription

The defense should establish when the complainant, authorities, or their agents actually discovered the material and when the proper complaint was filed. Comments, reactions, messages, earlier demands, meeting minutes, or witness testimony may contradict the discovery date alleged in the complaint.

The act predates the law

Penal statutes cannot be applied retroactively against the accused. A pre-effectivity online publication does not become cyber libel solely because the page remained accessible. Any alleged later republication must be proved as a distinct affirmative act attributable to the accused.

Mere reaction or passive sharing

The constitutional ruling in Disini protects people who merely receive and react to or pass along another person’s online libel from liability under the invalidated aiding-or-abetting provision. It does not protect a person’s own defamatory caption, comment, alteration, or independently authored accusation.

Double punishment for the same libel

Cyber libel and traditional written libel cannot be used to punish the same defamatory online act twice. Disini invalidated the Cybercrime Prevention Act’s cumulative-liability provision insofar as it would allow prosecution under both provisions for the same libel.

What happens after an information is filed?

The prosecutor may file an information in the designated cybercrime court if the evidentiary threshold is met. The judge then independently evaluates judicial probable cause and may dismiss the case, require additional evidence, or issue a warrant or summons

Quick answer

To file a Philippine cyber libel case, preserve the online evidence immediately and file a sworn complaint with the proper City or Provincial Prosecutor’s Office—normally the office corresponding to a designated cybercrime court with lawful venue. The complaint must establish a defamatory imputation, publication to at least one person other than the complainant, identification of the complainant, malice, use of a computer system, and the accused’s authorship or responsibility.

To defend, do not ignore a subpoena, summons, or warrant. Preserve the post and its full context, obtain counsel, and submit a fact-supported counter-affidavit on time. Possible defenses include failure to prove an element, lack of authorship, privileged communication, absence of actual malice where the law requires it, prescription, improper venue, and the Supreme Court’s protection for people who merely received or reacted to another person’s post.

Act quickly. The Supreme Court has definitively ruled that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. A public post is not automatically deemed discovered on its upload date. The discovery date is factual, and filing with the proper prosecution office interrupts prescription. Do not rely on a demand letter, platform report, barangay complaint, or informal police inquiry to protect the deadline. See Causing v. People and the Supreme Court’s 2026 final-resolution summary.

What cyber libel legally requires

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s libel provisions when the prohibited statement is published through a computer system or similar technology.

The prosecution must prove:

A discreditable imputation. The statement attributes a crime, vice, defect, act, omission, condition, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the statement. A message sent only to the complainant ordinarily lacks this element; a group chat, copied email, public post, or message sent to another person may satisfy it.
Identification. The complainant must be named or reasonably identifiable from the words, images, surrounding facts, or audience knowledge. Naming no one is not conclusive if readers could still identify the person.
Malice. Article 354 generally presumes malice from a defamatory imputation unless the communication is privileged. Different and more speech-protective rules apply to qualifiedly privileged communications, fair comment on matters of public interest, and statements about public officials or public figures.
Use of a computer system. This includes publication through social media, websites, online messaging, email, or comparable technology.
Identity of the author or responsible accused. An account name or profile photograph alone may not settle authorship. The State must connect the accused to the account and the specific publication.

The post is assessed as a whole, in its language, context, audience, and ordinary meaning. Labels such as “opinion,” “satire,” “forwarded,” or “blind item” do not automatically prevent liability if the communication conveys or implies a defamatory factual accusation.

Who may be liable—and who is not automatically liable

The Supreme Court upheld cyber libel only as applied to the original author of the defamatory online statement. It invalidated liability for aiding or abetting cyber libel because the provision could indiscriminately punish people who merely liked, shared, or reacted to a post. See Disini v. Secretary of Justice.

Accordingly:

The original author may be prosecuted if all elements are proved.
Merely receiving, liking, or reacting to another person’s post is not enough.
Merely sharing an existing post without adding defamatory content is covered by the protection recognized in Disini.
A person who adds a new defamatory caption, accusation, comment, or edited presentation may be treated as the author of that new material. Liability then depends on the exact words and evidence.
An administrator, employer, corporate officer, or platform is not automatically criminally liable merely because of a title or relationship. Actual legal responsibility depends on the governing law, role, participation, and proof.
The same publication cannot constitutionally be punished twice as ordinary libel and cyber libel. Disini invalidated that application of Section 7 of the cybercrime law.

Material first published before the cybercrime law took effect cannot be punished retroactively as cyber libel merely because it remains accessible online. A later repost, edit, or affirmative republication presents a fact-specific question; continuing availability should not automatically be treated as a new offense. See Peñalosa v. Ocampo.

The one-year deadline

Cyber libel prescribes in one year from the date the allegedly defamatory material was discovered by the offended party, the authorities, or their agents.

Important qualifications include:

Upload and discovery may occur on different dates.
A post set to “public” does not create an automatic legal presumption that the complainant discovered it immediately.
Discovery may be shown by a reaction, comment, reply, threat to sue, report, message discussing the post, or other conduct demonstrating actual knowledge.
The prosecutor or court must examine the evidence and surrounding circumstances; a complainant’s unsupported choice of discovery date is not necessarily controlling.
Filing the complaint with the proper prosecution office interrupts prescription.
If proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may begin running again under Article 91 of the Revised Penal Code.
The period does not run while the offender is absent from the Philippines, subject to the facts and applicable jurisprudence.

Because the deadline is short and disputes about discovery can decide the case, record the date, time, source, and manner of discovery in contemporaneous documents. File early rather than waiting for the final days.

Evidence to preserve before anything is deleted

A screenshot is useful, but it may not be enough by itself. Electronic evidence must still be authenticated and connected to the accused. Under the Rules on Electronic Evidence, the party offering a private electronic document bears the burden of showing its integrity and reliability.

Preserve:

Full-page screenshots showing the post, account name, account identifier, date and time, reactions, comments, privacy setting, and visible URL
A screen recording beginning with the account or webpage and showing navigation to the disputed material
The complete thread or conversation, not only selected lines
The original URL, profile URL, post ID, username, and any later username changes
Downloaded copies, exported account data, original images, video, audio, email headers, and attachments
The device on which the material was received or viewed
Notifications, forwarding messages, and communications showing when the post was discovered
Names and contact details of people who saw the publication
Messages or conduct linking the account to its suspected operator
Evidence of reputational or financial harm, such as lost work, cancelled transactions, client messages, or witness statements
For the defense, source documents, interview notes, research records, drafts, editorial correspondence, access logs, and evidence of verification or good faith

Keep originals unchanged and make separate working copies. Record who collected each item, when, from what device, and how it was stored. Preserve the evidence before requesting deletion or takedown.

Do not guess passwords, enter another person’s account without authority, impersonate anyone, secretly seize a device, or manufacture a conversation. Unlawful collection can create separate legal problems.

The Supreme Court has identified non-exclusive ways to prove social-media ownership, access, or authorship: admissions; eyewitness testimony about account use; information known only to the alleged author; distinctive language or behavior; platform, telecommunications, geolocation, or device records; and conduct consistent with the post. Technical records are helpful but not indispensable. See the Court’s guide in XXX v. People.

How to file a criminal complaint

1. Identify the correct venue

Cyber libel cases are heard by designated cybercrime Regional Trial Courts. Under the Rule on Cybercrime Warrants, venue may lie where:

the offense or any of its elements occurred;
any part of the computer system used was situated; or
damage to the natural or juridical person occurred.

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of other qualifying courts. Merely alleging that a webpage was accessible somewhere may not, by itself, be a safe basis for venue. State and document the concrete facts connecting the chosen city or province to the offense, computer system, or damage. The Supreme Court discussed this rule in Henares v. People.

File the complaint with the City or Provincial Prosecutor’s Office corresponding to the proper venue. The NBI Cybercrime Division or PNP Anti-Cybercrime Group may assist with investigation and technical evidence, but do not assume that an informal report to an investigator alone protects the one-year deadline.

2. Prepare a sworn, element-by-element complaint

The complaint-affidavit should state, from personal knowledge where possible:

the complainant’s and respondent’s identifying details and addresses;
the exact words, images, audio, or video complained of;
an accurate English translation of material in Filipino or another language;
where and how the material was published;
who received or saw it;
how readers identified the complainant;
why the material is defamatory;
when, where, and how the complainant discovered it;
facts connecting the respondent to the account and publication;
facts showing malice or, where privilege may apply, actual malice;
the concrete harm caused; and
the venue facts.

Attach properly identified affidavits from witnesses and the electronic, documentary, and real evidence supporting each element. Include the required National Prosecution Service investigation data form and comply with the prosecution office’s current filing, copy, and electronic-submission requirements. The DOJ maintains an official preliminary-investigation filing guide.

3. Understand the prosecutor’s standard

Cyber libel’s prescribed imprisonment reaches more than six years, so it generally undergoes regular preliminary investigation under DOJ Department Circular No. 15, series of 2024.

The prosecutor looks for prima facie evidence with reasonable certainty of conviction. This means the available evidence, if left uncontradicted, must be admissible, credible, capable of preservation and presentation at trial, and sufficient to prove every element and

Quick answer

To file a Philippine cyber libel case, preserve the online evidence immediately and file a sworn complaint with the proper City or Provincial Prosecutor’s Office—generally the office corresponding to a designated cybercrime court where an element occurred, a relevant computer system was situated, or the damage took place. The complaint must identify the defamatory statement, its publication to another person, the person defamed, malice, and evidence connecting the respondent to the account or post.

To defend a case, do not ignore the subpoena or delete evidence. Submit a detailed counter-affidavit on the date fixed by the prosecutor, challenge every missing element, and raise applicable defenses such as lack of authorship, no publication or identification, privilege, absence of actual malice, prescription, improper venue, or the rule protecting people who merely received or reacted to another person’s post.

The most urgent deadline is prescription. The Supreme Court has definitively ruled that cyber libel generally prescribes in one year from discovery by the offended party, authorities, or their agents. A public post is not automatically presumed discovered on its posting date. Because the discovery date is fact-sensitive, file promptly and do not rely on informal reports, negotiations, or takedown requests to protect the deadline. The Supreme Court reaffirmed this rule with finality in 2026.

What conduct amounts to cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on written libel when the publication is made through a computer system or similar technology. Examples can include Facebook posts, tweets, online articles, blogs, public comments, videos with defamatory captions, group messages, and emails sent to third persons.

The prosecution must prove all of the following:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one person other than the offended party received, read, viewed, or heard the statement.
Identification. The offended party was named or was sufficiently identifiable from the words and surrounding circumstances.
Malice. The applicable form of legal or actual malice was present.
Use of a computer system. The defamatory matter was published online or through information and communications technology.
Identity of the offender. The accused—not merely an account carrying the accused’s name or photograph—authored or was legally responsible for the publication.

Words are assessed in their full context and ordinary meaning. A statement need not use the person’s complete name if readers who know the circumstances could identify that person. Conversely, an offensive remark is not automatically libelous if it does not communicate a defamatory factual imputation about an identifiable person.

Labels such as “opinion,” “satire,” “forwarded,” or “allegedly” are not conclusive. An opinion may still imply undisclosed, false, defamatory facts. Quoting someone else may itself be a publication if the person deliberately republishes the accusation.

Who may be held responsible?

The Supreme Court sustained cyber libel principally as applied to the original author of the defamatory online statement. It invalidated liability for “aiding or abetting” cyber libel where it could punish people who simply received and reacted to a post. Mere likes, reactions, and passive receipt are therefore not the same as authorship. Disini v. Secretary of Justice is the controlling constitutional decision.

This protection has limits. A person who shares a post while adding a new defamatory caption may be treated as the author of that new statement. A person who independently reposts, uploads, or sends defamatory material may also create a separate publication issue. Responsibility for editors, account administrators, publishers, employers, or corporate officers depends on the governing law and proof of their actual legal role; job title alone should not be treated as a complete answer in an online case.

The prosecution must also connect the accused to the account and particular post. Under the Supreme Court’s 2025 guideposts, authorship or control may be proved by direct or circumstantial evidence, including:

an admission of ownership, access, or authorship;
testimony that the person was seen using the account or composing the post;
information in the post known only to that person or a small group;
distinctive language, writing style, or conduct;
platform, telecommunications, internet-service-provider, geolocation, device, or forensic records;
conduct consistent with earlier or contemporaneous messages; and
other evidence linking the person, account, device, and publication.

Technical records are helpful but are not indispensable in every case. A profile name or photograph, standing alone, may be weak because dummy and impersonation accounts are easy to create. See the Supreme Court’s guide to proving social-media account ownership and authorship.

The one-year filing deadline

Cyber libel prescribes in one year from the day the alleged crime is discovered by the offended party, the authorities, or their agents. Filing the complaint or information interrupts the prescriptive period under Articles 90 and 91 of the Revised Penal Code.

Discovery is a factual question. It may be shown by evidence that the offended party:

reacted or replied to the post;
asked someone to remove or correct it;
threatened or discussed legal action;
sent it to a lawyer, investigator, employer, or relative;
reported the account or post; or
otherwise acted in a way demonstrating knowledge.

The Supreme Court has rejected a blanket presumption that a public Facebook post was discovered on the day it was uploaded. Nevertheless, delay is dangerous: records disappear, witnesses forget, and the discovery date may be disputed.

File the complaint with the proper prosecution office as early as possible. Do not assume that any of the following will stop prescription:

reporting the post to the platform;
sending a demand letter;
negotiating an apology or settlement;
making an informal inquiry at a police station;
asking the NBI or PNP for advice without filing the appropriate complaint; or
waiting for the content to be removed.

The continuing availability of an old post does not safely mean that prescription restarts every day. A later edit, repost, or affirmative republication requires a fact-specific legal analysis. Online material first published before the cybercrime law took effect cannot be punished retroactively merely because it remains accessible; a claimed later republication must be examined separately.

How to preserve online evidence

Preserve evidence before seeking takedown or blocking the account. Screenshots are useful, but unauthenticated screenshots may be insufficient.

Keep the following where available:

full-page screenshots showing the post, account name, profile, date, time, privacy setting, reactions, comments, and surrounding conversation;
the exact URL, account ID, username, post ID, and date and time of access;
a screen recording showing how the post was reached from the account or page;
downloaded copies of images, videos, audio, emails, messages, and attachments in their original formats;
the device on which the material was received or viewed;
notification emails or platform alerts;
the names and contact details of people who independently saw the publication;
the earliest proof of discovery;
prior messages or posts that help establish identity, motive, context, or authorship;
platform reports, takedown responses, and preservation correspondence; and
proof of harm, such as employment records, lost transactions, client messages, medical records, or testimony from people whose opinion changed.

Do not crop away important context, alter timestamps, annotate the only copy, or repeatedly resave original files. Make working copies and retain the originals. Record who collected each item, when it was collected, from which device, and how it was stored.

Electronic evidence must be authenticated through evidence showing its integrity and reliability. The Rules on Electronic Evidence place that burden on the party offering the material. A witness with personal knowledge, supporting records, platform data, device examination, or other corroborating circumstances may be necessary.

Do not hack an account, impersonate another person, secretly seize a device, or obtain private records through unlawful means. Law-enforcement access to protected computer data may require the appropriate cybercrime warrant.

How to file the complaint

1. Confirm that cyber libel is the correct remedy

Separate an attack on reputation from threats, stalking, identity theft, doxxing, non-consensual intimate images, fraud, sexual harassment, child sexual abuse or exploitation material, or violence against women and children. The same incident may involve another law with a different procedure, deadline, or protective remedy.

2. Establish the proper venue

Under the Rule on Cybercrime Warrants, criminal actions for offenses under Sections 4 and 5 of Republic Act No. 10175 are filed before the designated cybercrime court of the province or city:

where the offense or any element was committed;
where any part of the computer system used was situated; or
where any of the damage to the natural or juridical person took place.

The court where the action is first properly filed acquires jurisdiction to the exclusion of other qualifying courts. The complaint should allege concrete venue facts, not merely that the post could be accessed anywhere. Venue can be decisive, so identify where the post was created or uploaded, where the relevant device was used, and where actual reputational damage occurred.

3. Prepare a sworn complaint-affidavit

The complaint-affidavit should present a clear chronology and state:

the complainant’s and respondent’s identifying details and addresses;
the exact words, image, video, or other content complained of;
an accurate translation if the material is in Filipino, a regional language, slang, or coded language;
when, where, and how the content was discovered;
who else saw or received it;
why the complainant was identifiable;
why the statement was defamatory;
the evidence connecting the respondent to the account and publication;
facts supporting malice and answering any obvious claim of privilege;
the venue facts;
the resulting harm; and
a list of authenticated or authenticatable supporting exhibits.

Attach the NPS investigation data form, witness affidavits, electronic evidence, relevant public or business records, and other supporting documents required by the receiving prosecution office. Check that annex labels, page numbers, URLs, translations, and dates are consistent before subscribing the affidavit under oath.

4. File with the corresponding prosecution office

Cyber libel carries a potential penalty exceeding six years, so it ordinarily undergoes a regular preliminary investigation under DOJ Department Circular No. 15, series of 2024. The current prosecutorial standard is prima facie evidence with reasonable certainty of conviction: the evidence at hand must be admissible, credible, capable of preservation and presentation at trial, and sufficient—if left uncontradicted—to prove every element and the offender’s identity. The Supreme Court upheld that standard in Meking v. Remulla.

The prosecution office may require physical filing of the initial complaint even where later submissions may be electronically filed. Confirm its current receiving hours, number of copies, oath requirements, and accepted filing method directly with that office.

A prior demand letter or barangay conciliation is not generally a prerequisite to a cyber libel complaint. Because of the offense’s prescribed penalty and RTC jurisdiction, it is outside the ordinary penalty limits for mandatory Katarungang Pambarangay conciliation. A demand for correction or apology may still be useful in an appropriate case, but it must not consume the one-year period.

5. Participate in preliminary investigation

If the prosecutor finds ground to proceed, the respondent receives a subpoena with the complaint and supporting material. The hearing date for submission of the counter-affidavit must generally give the respondent at least 10 days from receipt.

After receiving the counter-affidavit, the prosecutor may:

consider the case submitted for resolution;
conduct a physical or virtual clarificatory hearing; or
when necessary after clarification, require a reply-affidavit and rejoinder-affidavit.

The complainant should address new material facts concisely and with evidence. A reply is not an opportunity to repair a fundamentally incomplete complaint through speculation.

6. Act promptly on the resolution

If the complaint is dismissed—or if the respondent is charged—an aggrieved party may file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. A further petition for review is governed by the applicable DOJ appeal rules and has technical requirements.

Once an Information has been filed in court, a prosecutor-level motion or appeal does not automatically halt the criminal case. Counsel should determine whether a motion to suspend arraignment or another court remedy is necessary.

How to defend the complaint

1. Treat the subpoena as a real deadline

Record the date, time, and manner of receipt. Obtain the complete complaint and annexes. The subpoena will specify the hearing and filing date; do not assume that requesting more time automatically suspends it.

Under the current DOJ rules, a motion to dismiss filed instead of a counter-affidavit is generally not allowed unless it is verified and contains the respondent’s defenses, in which case it may be treated as the counter-affidavit. Submit a complete factual and legal response rather than relying on a bare denial.

Personal appearance may be dispensed with when the counter-affidavit was properly sworn before an authorized prosecutor, government officer, or, when allowed, a notary public. Follow the specific instructions in the subpoena.

2. Preserve the defense evidence

Retain:

the original device and account records;
login notices and account-access history;
evidence that other people had administrative or device access;
drafts, research notes, interview records, and source documents;
the full thread or conversation showing context;
proof of correction, clarification, or takedown;
records supporting truth, good faith, or reasonable verification;
evidence of where the accused and device were at the relevant time;
proof of the complainant’s earlier discovery; and
prior posts or messages showing impersonation or a compromised account.

Do not fabricate an alibi, ask witnesses to align their stories, or delete unfavorable messages. If content must be removed to limit continuing harm, preserve a complete evidentiary copy first and obtain advice on how to document the removal.

3. Test every element and procedural requirement

Potential defenses include the following.

No defamatory imputation

Read the words in full context. The content may be criticism, rhetorical exaggeration, parody, or an insult that does not impute a discreditable fact. But calling something an opinion will not help if it reasonably implies false defamatory facts.

No publication

A communication shown only to the offended party normally lacks publication to a third person. A direct message may still satisfy publication if other recipients were included or another person was intended or caused to see it.

No sufficient identification

The complainant must prove that the statement referred to them. A vague statement about a large or undefined group may not identify an individual, while contextual clues can make an unnamed person identifiable.

No authorship or account control

A name and profile photograph do not conclusively establish who wrote a post. Identify shared devices, former administrators, compromised credentials, impersonation reports, login locations, and inconsistencies in language or behavior. A bare claim that the account was hacked is also weak without supporting circumstances.

Privileged communication

Article 354 recognizes qualified privileges, including:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or official proceeding, official statement, or official act.

The communication must stay within the occasion and audience of the privilege. Broadcasting a private grievance to people with no corresponding interest may exceed the privilege. An inaccurate report or one embellished with defamatory comments may lose protection.

Fair comment on a matter of public interest can also be privileged. Once privilege applies, the prosecution must prove actual malice rather than rely only on presumed malice.

Public-official or public-figure speech and actual malice

For criticism involving the official conduct of a public officer, or protected discussion involving a public figure or matter of public interest, the prosecution may have to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false.

Actual malice is not simply anger, harsh language, or personal dislike. Reckless disregard requires more than an innocent mistake or ordinary negligence; it concerns a serious awareness of probable falsity. At the same time, deliberately avoiding obvious verification, inventing sources, or publishing grave accusations without a factual basis can support a finding of actual malice. The Supreme Court discusses this distinction in Tulfo v. People.

Truth, good motives, and justifiable ends

“Dapat okay dahil totoo” is incomplete. Article 361 sets specific rules on when proof of truth is admissible. Proof is admissible when the imputation concerns a crime; for other acts or omissions, it is generally admissible when the accusation concerns a government employee and relates to official duties. Acquittal on this defense requires proof not only of truth but also of good motives and justifiable ends.

Gather the underlying records and witnesses. A copied post, rumor, unnamed source, or unverified screenshot is not proof that an accusation was true.

Prescription

Determine the earliest provable discovery date and whether more than one year elapsed before the complaint was properly filed. Evidence can include the complainant’s comments, messages, takedown demands, public responses, reports, or instructions to an agent. The accused bears the practical burden of presenting evidence when prescription is not apparent from the face of the Information.

Mere reaction or receipt

A person who only received, liked, or reacted to another person’s defamatory post falls within the constitutional protection recognized in Disini. Examine whether the prosecution is actually alleging authorship of a new caption, comment, or republication rather than a mere reaction.

Retroactivity, venue, jurisdiction, or double jeopardy

Cyber libel cannot be applied retroactively to an online publication completed before the law took effect. The prosecution must also establish a proper Philippine jurisdictional connection and venue.

The same defamatory act cannot be punished twice as both traditional libel and cyber libel. Disini invalidated Section 7 of Republic Act No. 10175 insofar as it permitted double prosecution for the same libelous act.

4. Review the Information before arraignment

If the prosecutor files an Information, the designated cybercrime RTC independently determines judicial probable cause. A prosecutor’s subpoena is not an arrest warrant; a judge must issue the warrant.

Before entering a plea, counsel should examine whether to move to quash for reasons such as:

the alleged facts do not constitute an offense;
the court lacks jurisdiction or venue is defectively alleged;
criminal liability has been extinguished by prescription;
the Information improperly charges multiple offenses; or
prior proceedings create double-jeopardy concerns.

A motion to quash is technical and some objections may be waived if not timely raised. The Rules of Criminal Procedure should be applied to the actual Information, not merely to the earlier complaint-affidavit.

What happens in court?

After judicial probable cause is addressed, the usual stages are:

arrest or voluntary surrender and bail, when a warrant has issued;
arraignment and plea;
pre-trial, including stipulations and marking of evidence;
prosecution evidence;
a possible demurrer to evidence;
defense evidence;
judgment; and
post-judgment remedies or appeal.

Cyber libel is ordinarily bailable as a matter of right before conviction. The court sets the amount and conditions based on the rules and circumstances. Coordinate voluntary surrender and bail through counsel rather than waiting to be unexpectedly arrested.

At trial, the prosecution must prove guilt and the accused’s identity beyond reasonable doubt. The preliminary-investigation resolution does not establish guilt.

Possible penalties and civil liability

The imprisonment range one degree higher than traditional written libel is generally prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years. Application of the Indeterminate Sentence Law and mitigating or aggravating circumstances affects the actual sentence.

A court may impose a fine instead of imprisonment. Under the Supreme Court’s ruling in People v. Soliman, the statutory fine for online libel ranges from ₱40,000 to ₱1,500,000. The law also permits both imprisonment and a fine. Supreme Court guidance favoring a fine in appropriate libel cases is not an absolute prohibition against imprisonment.

Civil damages may be pursued with the criminal case, reserved for a separate action where allowed, or brought independently under Article 33 of the Civil Code. The appropriate theory, filing fees, prescription, and effect of the criminal judgment depend on how the civil claim is instituted. Actual loss should be documented; moral or reputational harm is not proved merely by asking for an arbitrary amount.

An apology, correction, retraction, settlement, or affidavit of desistance does not automatically erase an offense already committed or require dismissal. Criminal prosecution is brought in the name of the People of the Philippines. These measures may still affect the evidence, damages, prosecutorial assessment, or appropriate penalty.

Common mistakes

Waiting for negotiations while the one-year period runs.
Filing in a convenient city without facts establishing venue.
Submitting cropped screenshots with no URL, date, context, witness, or authentication.
Assuming a profile name proves authorship.
Treating truth as an automatic and complete defense.
Believing that “opinion,” “shared post,” or “PM sent” automatically prevents liability.
Posting further accusations, threats, or case details after receiving a complaint.
Deleting accounts, devices, messages, drafts, or access logs.
Ignoring the subpoena because no court case has yet been filed.
Filing a bare motion to dismiss instead of a complete counter-affidavit.
Missing the 15-day period to seek reconsideration of a prosecutor’s resolution.
Assuming a complaint’s withdrawal automatically ends the criminal case.
Publicly releasing private evidence that creates a new privacy, harassment, contempt, or defamation problem.

When legal help is urgent

Consult a Philippine lawyer immediately when:

the one-year prescriptive period is close or the discovery date is disputed;
a subpoena, prosecutor’s resolution, Information, arrest warrant, or court order has been received;
the account is anonymous, compromised, or controlled by several people;
platform or telecommunications records may soon disappear;
the post involves a journalist, public official, public figure, confidential source, or official proceeding;
several posts, platforms, respondents, or possible venues are involved;
a demand includes money in exchange for silence or non-filing;
threats, stalking, doxxing, intimate images, child sexual content, or immediate physical danger accompany the defamation; or
removal, injunction, damages, or a cybercrime warrant may be needed.

Qualified persons may seek assistance from the Public Attorney’s Office, subject to its indigency, merit, and conflict rules. The Integrated Bar of the Philippines also maintains legal-aid contacts and a chapter directory.

Frequently asked questions

Is one screenshot enough?

Not necessarily. It may show content, but the party offering it must still establish authenticity, context, publication, and authorship. Preserve the original device, full thread, URL, timestamp, witnesses, and corroborating records.

Can I file after the post was deleted?

Yes, if the offense was completed and reliable evidence was preserved. Deletion can make authentication and attribution harder, which is why early preservation matters.

Is cyber libel committed if the message was sent only to me?

Publication requires communication to someone other than the person defamed. If only the offended party received it, that element may be absent. Group chats, copied recipients, or deliberate disclosure to another person can change the result.

Can I be charged merely for liking or sharing a post?

A mere like, reaction, or passive receipt is not the same as being the original author under Disini. Adding a defamatory caption, comment, or independent republication creates a different factual issue.

Is a demand letter required before filing?

No. It may help seek a correction, identify a defense, or explore settlement, but it is not a substitute for timely filing and does not safely stop prescription.

Can an anonymous account be prosecuted?

Potentially. Authorship may be established through admissions, witnesses, distinctive content, conduct, account records, device evidence, or other circumstantial proof. Protected platform data generally requires lawful investigative or judicial process.

Does an affidavit of desistance end the case?

Not automatically. The State prosecutes the criminal action, and the prosecutor or court determines whether sufficient evidence remains. A desistance may be considered but does not by itself command dismissal.

Can the complainant sue for damages without seeking imprisonment?

A separate civil action for defamation may be possible, but its legal basis, one-year civil prescriptive period, filing fees, proof, and relationship with any criminal case require careful planning.

Official legal sources

This article provides general legal information, not advice for a particular complaint, post, person, or court. Cyber libel outcomes depend heavily on the exact words, context, evidence, discovery date, authorship, status of the complainant, and procedural record. Sources and current rules were checked on 3 August 2026.