Quick answer

Cyber libel is committed when a person publishes through a computer system an identifiable and defamatory allegation about another person, with the legally required malice. It is prosecuted under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, in relation to the Revised Penal Code provisions on libel.

If you are the complainant, preserve the online evidence immediately, identify the author and date of discovery, and file a properly supported complaint-affidavit with the prosecutor having territorial authority over the case. The NBI Cybercrime Division or the PNP Anti-Cybercrime Group may first investigate, particularly when the account owner is unknown or platform records are needed.

If you are accused, do not ignore a prosecutor’s subpoena. Under Rule 112, you generally have 10 days from receipt to submit your counter-affidavit and supporting evidence. A motion to dismiss cannot substitute for the counter-affidavit during preliminary investigation.

Time is critical. In Causing v. People, the Supreme Court held that cyber libel generally prescribes one year from discovery by the offended party, the authorities, or their agents. Determining when discovery occurred—and whether prescription was validly interrupted—can be fact-sensitive.

What counts as cyber libel?

Section 4(c)(4) of Republic Act No. 10175 covers the unlawful acts of libel defined in Article 355 of the Revised Penal Code when committed through a computer system or similar technology.

The prosecution ordinarily must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Publication. At least one person other than the person defamed received or saw the statement. A purely private message sent only to the person discussed may lack publication, although adding another recipient can change the result.
Identification. The offended person was named or was otherwise reasonably identifiable. A nickname, photograph, job title, surrounding facts, or other contextual clues may be enough even if no full name appears.
Malice. The applicable kind of malice must be shown. Article 354 generally presumes malice in defamatory imputations unless the communication is privileged, but constitutional and jurisprudential protections impose a higher actual-malice standard in appropriate cases involving public officials, public figures, and matters of public concern.
Use of a computer system. The publication was made through social media, a website, blog, messaging platform, email, online forum, or comparable digital means.
Authorship or legally attributable publication. The evidence must connect the accused to the defamatory post or message. A username, screenshot, or allegation that an account “belongs” to someone may not, by itself, conclusively prove who created the content.

Insulting, harsh, embarrassing, or offensive speech is not automatically cyber libel. The words must be evaluated as a whole and in their actual context. Satire, rhetorical exaggeration, opinion, and fair criticism may be treated differently from a concrete assertion of defamatory fact.

Who may be held liable?

The principal target is the original author or publisher of the defamatory online statement.

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel but limited the application of aiding-or-abetting liability in this setting. The Court explained that persons who merely “like,” react to, comment on, or share an existing defamatory post are not automatically criminally liable as aiders or abettors.

That protection should not be read too broadly. A person who adds a new defamatory assertion, creates a fresh caption, materially republishes the accusation as their own, or independently authors substantially similar content may face liability based on that new publication. The exact wording and conduct matter.

Administrators, editors, business owners, and employees are not automatically liable merely because they are associated with a page or organization. The prosecution must establish the participation and criminal responsibility of each person charged.

Important defenses and exceptions

The statement was not defamatory

Read the complete post, thread, video, or conversation—not an isolated sentence. Context may show that the words were neutral, figurative, interrogative, satirical, or incapable of the defamatory meaning alleged.

The complainant was not identifiable

It is a defense when readers could not reasonably determine who was being discussed. The court may consider photographs, tags, previous posts, workplace details, relationships, and comments from readers, so omission of the person’s name is not necessarily enough.

There was no publication to a third person

A communication received only by the person allegedly defamed ordinarily lacks the publication element. Preserve the recipient list and technical details because group chats, copied recipients, forwarding, or public visibility may establish publication.

The accused did not author or control the post

Account ownership and authorship are separate questions. Hacking, impersonation, shared devices, page-management arrangements, scheduled posts, and unauthorized access may be relevant. A denial is stronger when supported by login records, device records, security alerts, witness testimony, or a timely report of account compromise.

Privileged communication

Article 354 recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty to a person with a corresponding interest or duty; and
A fair and true report, made in good faith and without comments or remarks, of a non-confidential judicial, legislative, or official proceeding or an act performed by a public officer in the exercise of official functions.

Privilege is not a blanket license to publish accusations to the whole internet. The recipient, audience, purpose, scope, wording, and presence of actual malice remain important. Excessive publication or unnecessary personal attacks can defeat a claim of privilege.

Public official, public figure, or public concern

When the statement concerns a public official or public figure in a legally relevant context, the prosecution may have to prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Recklessness requires more than ordinary negligence; it concerns serious doubts about truth or a high awareness of probable falsity.

A person does not become a public figure merely because a dispute became popular online. Whether the actual-malice standard applies depends on the person’s role, the subject discussed, and governing jurisprudence.

Truth, good motives, and justifiable ends

Truth is not always a complete defense standing alone. Article 361 contains specific rules on when truth may be proved, and acquittal generally also requires good motives and justifiable ends. When the imputation concerns a private person or private conduct, the admissibility and effect of truth require careful legal analysis.

Keep the records that supported the statement at the time of publication. Evidence found only after posting may not establish the publisher’s original good faith or state of mind.

Opinion or fair comment

An opinion that does not imply undisclosed defamatory facts may receive constitutional protection. Merely adding “in my opinion,” however, does not transform a factual accusation into protected opinion. “I think he stole the money,” for example, can still convey a factual charge of theft.

Prescription

Under the Supreme Court’s ruling in Causing v. People, cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents, under Article 91 of the Revised Penal Code.

Do not assume that a post’s continued online availability restarts the period every day. At the same time, a later material republication, fresh post, or new defamatory content may present a separate issue. The dates of original posting, discovery, editing, reposting, filing, and any investigative or prosecutorial action must be established from records.

Where is a cyber libel complaint filed?

A criminal complaint normally begins with a complaint-affidavit before the appropriate city, provincial, or state prosecutor’s office for preliminary investigation. Because cyber libel cases fall within the jurisdiction of the Regional Trial Court, the prosecutor determines whether probable cause exists and, if so, files an information in the proper RTC, ordinarily a designated cybercrime court where available.

Venue is not simply a matter of choosing the most convenient city. It must be supported by facts showing the territorial connection required by law, such as where an essential element occurred, where the relevant computer system was situated, or where legally cognizable damage was caused. Residence alone should not be assumed sufficient without examining the allegations and controlling venue rules.

The NBI and PNP are the principal law-enforcement agencies designated by Section 10 of Republic Act No. 10175. Their cybercrime units can receive reports and investigate, but reporting to an investigator is not necessarily the same as filing the complaint-affidavit that starts preliminary investigation.

When the author is anonymous, investigators may seek the appropriate cybercrime warrant or court order for subscriber, traffic, or content data. A private complainant generally cannot compel a platform or telecommunications provider to disclose protected account information simply by sending a demand.

How to prepare and file a complaint

1. Record the discovery date immediately

Write down:

When and how you first saw the material;
Who showed or sent it to you;
Whether law enforcement or another representative had already discovered it;
The original posting date and any visible edit date; and
Dates of reposts or materially different publications.

Prescription can turn on these details.

2. Preserve the content before requesting removal

Capture the complete publication, including:

The exact words, image, audio, or video;
The account name, profile information, and account URL;
The direct URL of the post;
Date and time displayed;
Audience or privacy setting, if visible;
Comments, shares, tags, reactions, and surrounding conversation;
Names of people who actually saw or received it; and
Any later edits, retractions, apologies, or threats.

Take full-page screenshots or a screen recording showing navigation to the content. Save the original files without cropping, annotating, or overwriting them. Keep the device used to capture the evidence and make secure backup copies.

A screenshot is useful but may be challenged. Original electronic files, metadata, direct links, witness testimony, platform records, and properly obtained forensic evidence can help authenticate it under the Rules on Electronic Evidence.

3. Preserve proof of authorship

Collect lawful evidence connecting the respondent to the publication, such as:

Admissions in messages or recorded public statements;
Consistent account identifiers;
Verified or previously acknowledged account ownership;
Earlier communications showing control of the account;
Page-role information lawfully available to you;
Witnesses who observed the publication; and
Reports concerning impersonation or unauthorized access.

Do not hack an account, obtain passwords through deception, or unlawfully access a device. Illegally obtained evidence can create separate criminal and privacy problems.

4. Document identification and harm

Explain why readers understood that the statement referred to you. Preserve messages from people who recognized you, employment or business records, cancelled engagements, medical records, and other proof of actual consequences.

Actual financial loss is not an element of every cyber libel charge, but reliable evidence of harm may be relevant to damages and credibility.

5. Prepare a detailed complaint-affidavit

The affidavit should state facts within the affiant’s personal knowledge and cover:

The identities and addresses of the parties, as far as known;
The exact defamatory statement;
When and where it was posted and discovered;
Why it refers to the complainant;
Who else saw or received it;
Why the respondent is believed to be the author;
Facts showing malice, where relevant;
Venue and territorial connection;
The timeliness of the complaint; and
A clear identification of each attachment.

Under Rule 112, the complaint must be accompanied by the complainant’s and witnesses’ affidavits and supporting documents, with the required copies. Affidavits must be properly sworn before an authorized prosecutor, government officer, or, when permitted, a notary public who certifies that the affiant was personally examined and voluntarily understood the affidavit.

6. Consider an investigation when technical records are needed

Approach the NBI Cybercrime Division or PNP Anti-Cybercrime Group promptly if:

The author is anonymous or using a false identity;
The post may soon disappear;
Account or IP-related records are needed;
The account appears hacked or impersonated;
There are related threats, extortion, stalking, identity theft, or unauthorized access; or
Evidence is located abroad.

Republic Act No. 10175 provides mechanisms for preserving and disclosing computer data, but compulsory disclosure ordinarily requires lawful process. Service-provider data may be retained only for limited periods, making early action important.

7. Track the preliminary investigation

The prosecutor initially determines whether the complaint is sufficient to proceed. If probable cause is found after the respondent has had an opportunity to answer, an information may be filed in the proper RTC. Probable cause at this stage is not yet proof beyond reasonable doubt.

Keep copies of every filing and proof of the date each document was filed or received.

How to defend against a cyber libel complaint

1. Note the exact date the subpoena was received

Rule 112 generally gives a respondent 10 days from receipt of the subpoena and supporting papers to submit a counter-affidavit, witness affidavits, and other evidence. If the respondent does not answer, the prosecutor may resolve the complaint using only the complainant’s evidence.

A respondent may not file a motion to dismiss instead of the counter-affidavit.

2. Obtain and examine the complete record

Confirm that you received the complaint and all attachments. A respondent has the right to examine evidence submitted by the complainant and copy it at the respondent’s expense. If important materials are missing or voluminous, promptly make an appropriate written request through counsel.

3. Preserve your own evidence

Do not delete the account, post, messages, drafts, devices, or security records. Preserve:

The complete thread and surrounding discussion;
Drafts and sources used before publication;
Research notes and requests for comment;
Documents supporting the statement;
Privacy and audience settings;
Login history and security alerts;
Evidence of hacking or impersonation;
Communications showing purpose, good faith, or lack of malice; and
The dates relevant to prescription and venue.

Deleting evidence after notice of a dispute can damage credibility and may create additional legal issues. If immediate takedown is advisable, preserve an authenticated copy first.

4. Address every element, not just truth

A strong counter-affidavit should separately examine:

Whether the words are defamatory;
Whether a third person received them;
Whether the complainant is identifiable;
Whether the respondent authored or published them;
Whether malice is present or legally presumed;
Whether the communication is privileged;
Whether actual malice must be proved;
Whether the statement is protected opinion or fair comment;
Whether venue is proper;
Whether the complaint has prescribed; and
Whether the law was already effective when the alleged act occurred.

Avoid relying on a bare denial. Attach records and affidavits that can be authenticated.

5. Do not repeat the accusation while defending yourself online

Publicly reposting the challenged statement, attacking the complainant, or pressuring witnesses may produce additional evidence or a new alleged publication. Legal arguments belong in the counter-affidavit and proper proceedings.

6. Act quickly if an information has already been filed

After filing in court, the judge independently evaluates probable cause and may dismiss the case, require additional evidence, issue summons where appropriate, or issue a warrant of arrest. If you learn that a case or warrant may exist, consult defense counsel immediately about verification, bail, arraignment, and available remedies. Do not evade service or rely on unofficial social-media reports.

Penalties and civil liability

Article 355, as amended by Republic Act No. 10951, provides for ordinary written libel:

Prisión correccional in its minimum and medium periods;
A fine from ₱40,000 to ₱1,200,000; or
Both, in addition to possible civil liability.

Section 6 of Republic Act No. 10175 provides for a penalty one degree higher when a Revised Penal Code offense is committed through information and communications technology. The precise sentence depends on the charge, applicable penalty rules, modifying circumstances, and the court’s judgment.

The offended party may also seek damages. Under Rule 111, civil liability arising from the offense is generally deemed included in the criminal action unless it is waived, reserved for separate filing, or was filed earlier. The Civil Code also recognizes an independent civil action for defamation, subject to the rules against double recovery.

A complainant should not assume that a criminal acquittal always resolves every possible civil theory. Conversely, damages are not automatic; causation, legal basis, and supporting evidence still matter.

Evidence checklist

Preserve, when applicable:

Original screenshots and screen recordings;
Direct URLs and archived copies;
Original photos, videos, audio, and downloaded files;
Metadata and file hashes generated by a qualified examiner;
The original phone or computer used to view or create the material;
Complete chat or email threads, not selected excerpts;
Recipient lists and audience settings;
Witness names and sworn accounts;
Platform notifications and security alerts;
Login and account-recovery records;
Sources, research notes, and requests for comment;
Retractions, apologies, corrections, or settlement communications;
Proof of discovery and filing dates;
Employment, business, medical, or financial records showing harm; and
Copies and official receipts for all complaints and submissions.

Keep an untouched master copy. Work from duplicates and maintain a simple record of who handled each device or file.

Common mistakes

Waiting until the one-year prescriptive period is nearly over;
Assuming every insult or negative review is cyber libel;
Treating a screenshot as conclusive proof of authorship;
Cropping out the URL, account name, date, or surrounding context;
Asking for deletion before preserving the evidence;
Filing in a convenient place without establishing proper venue;
Naming every person who reacted to or shared a post without evidence of independent defamatory authorship;
Assuming truth alone always ends the case;
Assuming “opinion” is a complete defense to an implied factual accusation;
Replying to a subpoena with only a motion to dismiss;
Missing the 10-day counter-affidavit period;
Publishing threats, counter-accusations, or private information during the dispute;
Accessing another person’s account or device without authority;
Editing, deleting, or fabricating electronic evidence; and
Relying on a demand letter as though it automatically files or preserves a criminal case.

When legal help is urgent

Seek a Philippine lawyer promptly when:

The discovery or publication date is approaching one year;
A prosecutor’s subpoena has been received;
An information or warrant of arrest may already exist;
The account owner is unknown and platform records may disappear;
The publication involves a journalist, public official, public figure, election issue, or matter of public concern;
The disputed statement came from a complaint, official proceeding, workplace report, or professional-duty communication;
The post has been edited, deleted, or materially republished;
The evidence or parties are located outside the Philippines;
There are related threats, extortion, stalking, impersonation, data-privacy violations, or unauthorized account access; or
A takedown, correction, settlement, or public response could affect pending proceedings.

Frequently asked questions

Is a Facebook post, TikTok video, private chat, or email covered?

Potentially. The medium must involve a computer system, but all other elements—including defamatory meaning, identification, publication, authorship, and malice—must still be proved. A message sent only to the person discussed may lack publication to a third person.

Can I be charged for sharing or liking another person’s post?

Not automatically. Disini rejected automatic aiding-or-abetting liability for ordinary likes, comments, and shares of another person’s defamatory post. Liability may still arise if you add a new defamatory assertion or independently publish the accusation as your own.

Is an anonymous post immune from prosecution?

No. Investigators may seek lawful orders for subscriber or traffic information. Identification depends on available records, platform retention, proper warrants, and whether the technical evidence reliably connects a person to the publication.

Does deleting the post prevent a case?

No. Deletion does not erase a completed publication or copies already preserved. It may limit continuing harm, but deleting evidence after notice of a complaint can also create credibility and evidentiary problems.

Must the complainant first send a demand letter?

Generally, a demand letter is not an element of cyber libel. It may support a request for correction, retraction, preservation, or settlement, but it does not replace the timely filing of the proper complaint.

Does the dispute have to undergo barangay conciliation?

Cyber libel is not ordinarily treated as an offense that must first undergo Katarungang Pambarangay conciliation because of the penalty involved. Related civil claims or unusual circumstances should still be assessed separately.

Can a company be defamed?

A juridical person may be an offended party when the imputation can injure its reputation. The complaint must still establish the applicable elements and identify the responsible natural persons; corporate affiliation alone does not automatically create criminal liability.

Can cyber libel and ordinary libel both be charged for the same post?

The Supreme Court held in Disini that the same online publication cannot be punished twice as both ordinary libel and cyber libel. The constitutional protection against double jeopardy and the specific facts of the charging instruments must be examined.

Can the court order imprisonment, or is cyber libel fine-only?

The law authorizes imprisonment, a fine, or the applicable combination under the governing penalty provisions. A fine-only sentence may be considered under jurisprudential and judicial guidance, but it is not an automatic entitlement.

What official materials should I read?

The principal authorities include:

Disclaimer

This article provides general Philippine legal information, not legal advice or an attorney-client relationship. Cyber libel cases depend heavily on the exact words, audience, authorship evidence, dates, venue facts, status of the offended person, and procedural record. Consult a Philippine lawyer about your specific documents and deadlines.

Sources checked as of 19 September 2026.