Quick answer

Cyber libel is committed when the original author publicly and maliciously makes a defamatory imputation through a computer system or similar information and communications technology. A complainant must present evidence of the defamatory statement, publication to someone other than the person defamed, the victim’s identity, malice, the author’s identity, and the use of ICT. An offensive, inaccurate, or critical post is not automatically cyber libel.

Act quickly. The Supreme Court has definitively held that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents—not automatically from the posting date. The date of discovery is a factual question, and the period can be interrupted by the proper filing of a complaint or information. Do not assume that a platform report, demand letter, barangay complaint, or informal police report stops the clock. See Causing v. People, G.R. No. 258524, April 8, 2026.

A complaint is ordinarily filed with the appropriate Office of the City or Provincial Prosecutor. If sufficient evidence is found after preliminary investigation, an information is filed in the designated Regional Trial Court handling cybercrime cases. A respondent who receives a subpoena should engage counsel immediately and submit a sworn, evidence-supported counter-affidavit by the date stated in the subpoena.

What the prosecution must prove

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to publication through a computer system or similar means.

Required point	What it means in practice
Defamatory imputation	The post attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication	At least one person other than the person defamed received, saw, or understood the statement. A message sent only to the target generally lacks this element; a group message or post seen by another person may satisfy it.
Identifiability	The complainant must be identifiable from the words and surrounding circumstances. Naming the person is not indispensable, but readers must reasonably know who was being referred to.
Malice	The applicable form of malice must be established. The standard depends significantly on whether the complainant is a private individual, public officer, or public figure and whether the statement concerns public affairs.
Authorship and identity	The prosecution must connect the respondent—not merely a profile name or photograph—to the account and the specific publication.
Use of ICT	The publication must have been made through a computer system or similar technology, such as a social-media platform, website, email, or online messaging service.

The words must be considered in their full setting, including the language used, accompanying images, preceding exchanges, intended audience, and how an ordinary reader would understand them. Insults, satire, rhetorical exaggeration, and opinion are not automatically criminal, but adding “in my opinion” does not protect a statement that reasonably asserts a damaging fact.

The governing statutory provisions are Articles 353 to 361 of the Revised Penal Code.

Original posts, comments, likes, and shares

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author of the defamatory material. It declared unconstitutional the application of cybercrime “aiding or abetting” liability to people who merely receive and react to an online libel.

Accordingly:

Merely liking, reacting to, or sharing someone else’s post is not, by itself, cyber libel under the invalidated aiding-or-abetting theory.
A comment that merely expresses agreement is different from a comment that creates a new defamatory accusation.
A person who writes a new defamatory caption, comment, repost, or story may be treated as the original author of that new publication.
The same online statement should not be charged simultaneously as ordinary libel and cyber libel for the identical act. Disini held that doing so would violate the protection against double jeopardy.

Authorship remains a factual question. In criminal cases involving social media, ownership, access, or authorship may be shown through admissions, witnesses who observed account use, information known only to the suspected author, distinctive language, account history, device forensics, platform or telecommunications records, and other circumstantial evidence. A name and profile photograph alone may not settle the question. See the Supreme Court’s guideposts in XXX v. People, G.R. No. 274842, October 22, 2025.

Malice, public officials, and protected criticism

For a private complainant, Article 354 generally presumes malice from a defamatory imputation unless good intention and justifiable motive are shown or the communication is privileged.

A more demanding constitutional standard applies to criticism of public officers or public figures concerning public affairs or official conduct. In that setting, the prosecution must prove actual malice: that the author knew the accusation was false or published it with reckless disregard of whether it was false. Negligence, failure to investigate perfectly, factual error, or falsity alone does not necessarily establish actual malice. The evidence must support the conclusion that the author actually entertained serious doubts about the statement’s truth or knew it was false.

In Tan v. People, G.R. No. 265929, January 13, 2026, the Supreme Court acquitted an accused charged over posts criticizing an incumbent mayor because actual malice was not proved beyond reasonable doubt.

Potentially privileged communications include:

A private communication made in the performance of a legal, moral, or social duty, provided its circulation is limited to people with a legitimate interest.
A fair and true report, made in good faith and without improper additions, of non-confidential judicial, legislative, or other official proceedings.
Fair comment on matters of public interest when the opinion is based on established or accurately stated facts.

Qualified privilege can be lost through actual malice, unnecessary circulation, distortion, or use of the occasion for an improper purpose. Statements genuinely relevant to judicial or legislative proceedings may receive absolute privilege, but relevance and the setting of the statement matter.

Is truth a complete defense?

Not always. Article 361 provides that an accused should be acquitted when the allegedly libelous matter is proved true and was published with good motives and for justifiable ends. For an imputation of an act or omission that is not itself a crime, proof of truth is generally restricted unless the statement concerns a government employee’s discharge of official duties.

This statutory rule must be applied together with constitutional protections for speech about public affairs. A respondent relying on truth should preserve the records, witnesses, source material, and verification steps that existed when the statement was published. Documents obtained only after publication may prove truth but may not fully answer an allegation that the author knowingly or recklessly published an unsupported accusation.

The possible penalties

For conduct committed after the effectivity of Republic Act No. 10951, the imprisonment prescribed for cyber libel is one degree higher than for traditional libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months, and one day to eight years.

A court may impose imprisonment, a fine, or both. In People v. Soliman, G.R. No. 256700, April 25, 2023, the Supreme Court held that a fine alone may be imposed when justified by the circumstances. It calculated the present statutory fine range for online libel as ₱40,000 to ₱1,500,000. Fine-only treatment is discretionary, not guaranteed, and imprisonment remains legally available. Civil damages and subsidiary imprisonment for an unpaid fine may also arise.

The law in force when the alleged offense occurred controls, subject to rules favoring an accused when a later penal law is more lenient. Cyber libel is bailable before conviction, but the court determines the applicable bail and conditions.

How to prepare and file a complaint

1. Preserve the complete publication before seeking removal

Capture more than the offending sentence. Preserve:

Full-page screenshots showing the account name, profile, exact words, photographs, date, time, reactions, comments, and privacy or audience indicators.
The complete URL, post or message identifier, account URL, and the date and time of capture.
A screen recording showing how the post was accessed and its surrounding context.
The original digital files without cropping, annotation, compression, or conversion.
Related messages, earlier exchanges, corrections, threats, reposts, and admissions.
Names and contact details of people who personally saw the material and can identify when and how they saw it.
Evidence connecting the account and post to the suspected author.
Records showing when the complainant first discovered the publication.
Evidence of resulting harm, such as lost clients, employment communications, medical records, or messages showing how readers understood the accusation.

Electronic evidence must be authenticated. A screenshot can be documentary evidence, but a screenshot by itself does not necessarily prove authenticity, authorship, publication, or context. Keep the device used to capture it and identify a witness with personal knowledge. The Rules on Electronic Evidence require proof of an electronic document’s integrity and reliability.

Do not hack an account, impersonate another person, guess passwords, or secretly take data from a device you have no right to access. Illegal access may create separate criminal and evidentiary problems.

2. Identify the author and the correct venue

If the account is anonymous or disputed, report promptly to the DOJ Office of Cybercrime, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division. Law-enforcement officers can seek court-authorized preservation, disclosure, search, seizure, or examination of computer data. A private person generally cannot compel a platform or telecommunications company to release protected subscriber or traffic data.

Under Section 2.1 of the Rule on Cybercrime Warrants, a cybercrime action may be brought before the designated cybercrime court where an element occurred, where part of the computer system used is situated, or where damage occurred. The first properly seized court acquires jurisdiction to acquires jurisdiction the exclusion of others. Mere accessibility of a post in a location should not be treated casually as sufficient venue; the complaint must state concrete venue facts. Venue errors can defeat an otherwise substantial case.

3. Prepare a sworn complaint-affidavit

The affidavit should clearly state:

The complainant’s and respondent’s names and addresses, if known.
The exact publication complained of, without paraphrasing away important language.
When and how it was published and discovered.
Who saw or received it.
Why the complainant was identifiable.
Why the statement was defamatory and malicious.
How the respondent is connected to the account and publication.
The facts supporting venue.
Each separate post or publication, arranged chronologically.
The attached witness affidavits and electronic, documentary, or other evidence.

If the post is in Filipino, Cebuano, Ilocano, or another language, attach an accurate translation while preserving the original. Explain local expressions and context through a competent witness rather than relying on an unsupported translation.

The DOJ’s filing checklist ordinarily requires an NPS Investigation Data Form, the complaint-affidavit or sworn statement, witness affidavits, supporting documents, and copies for the respondents. Confirm the current number of copies, accepted electronic-filing method, identification requirements, and fees with the specific prosecution office. The DOJ publishes its general service information on its preliminary-investigation filing page.

4. File before the one-year period expires

Do not wait until the final days. The one-year period runs from discovery, but the discovery date can be disputed. Keep objective proof such as the first message forwarding the post, email notification, witness statement, or incident report.

A demand for correction, apology, or takedown is not a statutory prerequisite. It may help stop continuing harm or lead to an early resolution, but do not assume it interrupts prescription. The same caution applies to platform reports and requests for law-enforcement assistance.

5. Participate in preliminary investigation

The governing standard in DOJ-NPS proceedings is prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, capable of preservation and presentation at trial, and sufficient—if left uncontradicted—to establish every element and the responsible person’s identity.

The applicable procedures are in DOJ Department Circular No. 15, series of 2024, whose validity was upheld in Meking v. Secretary of Justice, G.R. No. 280455, November 11, 2025.

The respondent receives the complaint and attachments with a subpoena. The date set for the counter-affidavit must provide at least ten days from receipt of the subpoena and complaint-affidavit. The investigating prosecutor may require clarification or additional affidavits. An aggrieved party may file a motion for reconsideration of the prosecutor’s resolution within 15 days from receipt.

How to defend after receiving a complaint or subpoena

Act immediately

Record the exact date and method by which the subpoena and attachments were received. Obtain the complete complaint, annexes, and scheduled filing date. Do not ignore the proceeding: the prosecutor may resolve the complaint using the complainant’s evidence if the respondent fails to answer.

If more time is genuinely necessary, promptly seek an extension on meritorious grounds before the deadline. An extension is not automatic.

Preserve—not destroy—your records

Keep the relevant phone, computer, account records, messages, drafts, source material, login notices, and backups. Do not edit screenshots, fabricate conversations, coach witnesses, delete accounts, or ask another person to alter evidence.

If a post is still causing harm, obtain post is legal advice on preserving it properly before deletion. Removing a post does not erase a publication already completed, although prompt correction, deletion, or apology may be relevant to motive, damages, or sentencing.

Answer every element with evidence

A counter-affidavit should address, as applicable:

Authorship: Did the respondent own or control the account and write the particular post? Was the account shared, compromised, impersonated, or fabricated? Support the answer with account-security notices, device records, employment logs, witnesses, or forensic evidence.
Exact content and context: Supply the complete thread, not an isolated sentence. Explain idioms, quotations, satire, or the event being discussed.
Publication: Identify whether anyone other than the complainant received the statement.
Identifiability: Explain why reasonable readers would not have understood the statement as referring to the complainant, if that is true.
Defamatory meaning: Distinguish verifiable accusations from criticism, opinion, rhetorical hyperbole, or non-defamatory language.
Malice and privilege: State the duty, public interest, established facts, sources, verification efforts, corrections, and good-faith reasons for communicating.
Actual malice: If the complainant is a public officer or public figure and the statement concerns public conduct, identify the absence of knowledge of falsity or serious doubts about the truth.
Truth, good motives, and justifiable ends: Attach the documents and witnesses supporting each assertion.
Prescription: Present evidence of when the complainant, authorities, or their agents discovered the publication and when proceedings were instituted.
Venue: Examine whether the complaint states and proves a legally sufficient connection to the chosen place.
Duplicate liability: Check whether the same publication is improperly being charged as both ordinary and cyber libel.

A motion to dismiss filed instead of a counter-affidavit is generally not allowed unless verified and containing the respondent’s defenses, in which event it may be treated as the counter-affidavit. A bare legal argument without sworn facts and supporting evidence is risky.

If an information is filed in court

The prosecutor’s resolution does not itself establish guilt. The trial judge must independently determine probable cause and may dismiss the case, issue a warrant, or require further evidence. If a warrant is issued, coordinate voluntary surrender and bail through counsel; do not evade service.

Before entering a plea, counsel should examine whether a motion to quash is available, including for failure to charge an offense, lack of jurisdiction or proper venue, prescription, or double jeopardy. Some objections may be waived if not raised at the correct time.

At trial, the prosecution must prove guilt and the accused’s identity beyond reasonable doubt. The defense may challenge authentication, hearsay, incomplete context, unreliable translations, account attribution, malice, venue, and every substantive element.

Common mistakes

Waiting because the post remains online. Continued availability does not safely extend the one-year filing period.
Preserving only a cropped screenshot with no URL, date, context, or witness.
Naming the apparent profile owner without evidence connecting that person to the specific post.
Reposting the accusation widely “to collect evidence,” thereby increasing harm and creating new legal risk.
Treating every insult or negative review as a criminal accusation.
Assuming truth alone always ends a Philippine criminal-libel case.
Assuming criticism of a public officer is automatically protected, or assuming falsity alone proves actual malice.
Filing in a convenient but legally unsupported location.
Ignoring a prosecutor’s subpoena or filing an unsworn denial.
Contacting, threatening, or publicly attacking the opposing party while the case is pending.
Believing an affidavit of desistance automatically ends the prosecution. A criminal case is prosecuted in the name of the People; desistance may affect the evidence or civil claim but does not compel dismissal.

When legal help is urgent

Consult a Philippine criminal-law or cybercrime lawyer immediately when:

The one-year anniversary of discovery is approaching.
The author is anonymous or platform data may soon disappear.
You receive a prosecutor’s subpoena, court summons, warrant, or notice of arraignment.
Several posts, authors, jurisdictions, or corporate accounts are involved.
The complainant is a journalist, public officer, public figure, business, or juridical entity.
The publication also contains threats, doxxing, intimate images, stalking, extortion, or violence. Those facts may involve separate laws and require immediate police assistance or protective measures.
A device, account, or business server may be searched or subjected to forensic examination.
Settlement, retraction, or an affidavit of desistance is being proposed.

Frequently asked questions

Does deleting the post prevent a case?

No. Cyber libel may already be complete once the defamatory material is published to another person. Deletion can stop further circulation and may be relevant to motive or penalty, but it does not erase the original act.

Is one screenshot enough?

Not necessarily. It may show content, but the complainant must still establish authenticity, publication, identifiability, authorship, malice, venue, and use of ICT. Preserve the original digital context and corroborating witnesses or records.

Does the one-year period begin when the post was uploaded?

It begins when the offended party, authorities, or their agents discovered the alleged cyber libel. Posting and discovery may occur on the same date, but the law does not presume that they always coincide.

Can a mere share, like, or reaction be prosecuted?

A mere reaction to another person’s defamatory post is not cyber libel under the aiding-or-abetting provision invalidated in Disini. A new caption or comment containing an independent defamatory accusation may constitute a new original publication.

Can a private or direct message be cyber libel?

Only if it was published to a third person. A message received solely by the person defamed ordinarily lacks publication. A group chat, forwarded message, or communication sent to another person may satisfy the element.

Is a demand letter required before filing?

No. A demand, correction request, or takedown request may be useful, but it is not a required element and should not be allowed to consume the prescriptive period.

Can an apology or settlement automatically dismiss the criminal case?

No. It may help resolve civil claims or affect prosecutorial and sentencing considerations, but the public prosecutor controls the criminal action once instituted, subject to the court’s authority.

Must a party hire a lawyer?

A complainant may personally execute and file a complaint-affidavit, but legal assistance is strongly advisable because prescription, venue, privileges, electronic authentication, and account attribution are technical. A respondent facing possible imprisonment should obtain counsel immediately; financially eligible respondents may inquire with the Public Attorney’s Office.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel liability depends on the exact words, audience, authorship evidence, dates, status of the complainant, purpose, documents, and procedural history. Law and official procedures were checked through August 3, 2026.