How to Preserve Evidence and File Complaints (Practical, Legal, Step-by-Step)

1) What counts as “cyberbullying” and “anonymous posting” (legally)

In Philippine practice, “cyberbullying” is usually not one single crime. It’s a pattern of online conduct—harassment, humiliation, threats, doxxing, impersonation, sexual shaming, rumor-spreading, or persistent targeting—punishable under different laws depending on the content and intent.

“Anonymous posting” (using fake names, dummy accounts, throwaway emails, VPNs, or anonymous boards) is not automatically illegal. It becomes actionable when the act violates penal laws (e.g., threats, defamation, voyeurism), or when identity concealment is used to facilitate harassment or abuse.

2) Common legal bases used in cyberbullying cases

A. Cybercrime Prevention Act (RA 10175)

This law covers certain acts done through ICT (internet, devices, networks) and provides tools for investigation.

Typical provisions invoked:

Cyber libel (online defamation) — “libel committed through a computer system or similar means”
Computer-related identity theft / impersonation (depending on facts)
Unlawful/unauthorized access (if accounts were hacked)
Investigation warrants for computer data (more on this below)

Practical point: Even when the underlying offense is in the Revised Penal Code (RPC), online commission can change how you investigate (IP logs, data disclosure) and sometimes how charges are framed.

B. Revised Penal Code (RPC) provisions often paired with online conduct

Depending on facts, complainants and prosecutors often consider:

Libel / slander / oral defamation principles (defamation framework)
Grave threats / light threats (threats of harm)
Coercion (forcing someone to do/stop doing something)
Unjust vexation (broad “annoyance/harassment” concept; used in some harassment fact patterns)
Slander by deed (acts intended to dishonor/embarrass)

The specific article used depends on what was said/done, to whom, and with what intent.

C. Anti-Photo and Video Voyeurism Act (RA 9995)

Covers recording, copying, sharing, selling, broadcasting, or publishing intimate images/videos without consent, including sharing private sexual content to shame or threaten (“revenge porn” situations).

D. Safe Spaces Act (RA 11313) — Gender-Based Online Sexual Harassment

Covers online acts such as:

sexual remarks, sexual slurs, unwanted sexual content,
sexual humiliation/shaming,
persistent unwanted sexual advances via messages,
threats to distribute intimate content,
sexist/misogynistic harassment in online spaces when they fall within gender-based online sexual harassment.

E. Anti-VAWC (RA 9262) — if the offender is a spouse/partner/ex-partner (or similar covered relationship)

Online harassment can qualify as psychological violence, including repeated humiliation, threats, stalking/monitoring, or coercive control. RA 9262 is powerful because it can allow protection orders and can address patterns of abuse—not only single posts.

F. Data Privacy Act (RA 10173) — for doxxing and unlawful processing of personal data

If someone publishes or processes your personal information (address, phone, workplace, IDs, family details) without lawful basis—especially to harass, shame, or endanger you—this may support a complaint to the National Privacy Commission and/or contribute to criminal/civil strategies.

G. If minors are involved

Anti-Bullying Act (RA 10627) applies primarily in the school context (policies and administrative action), which can include off-campus/online behavior affecting students depending on school policy implementation.
Child sexual exploitation materials / grooming / online child abuse may fall under specialized child-protection laws (fact-specific and treated as high priority).

3) The biggest mistake victims make: weak evidence capture

Online posts disappear, accounts get deleted, and platforms restrict access. Your goal is to preserve evidence so it is:

Authentic (what exactly was shown),
Traceable (where it came from),
Complete (context and timeline),
Admissible (captured in a way courts recognize).

Philippine courts apply the Rules on Electronic Evidence (A.M. No. 01-7-01-SC) and the E-Commerce Act (RA 8792) framework for electronic documents and authentication. You don’t need perfect forensics at the start, but you must capture enough for investigators and prosecutors to act.

4) Evidence preservation: a step-by-step checklist that works in practice

Step 1 — Capture the content (don’t rely on a single screenshot)

For each incident (post/comment/message/story/video):

Screenshot the content and the surrounding context:
- the profile/page/account name and handle,
- the date/time stamp (as displayed),
- the full text, including captions,
- any visible reactions, shares, comments (especially if they amplify harm),
- the URL bar (for web) or permalink/share link (for apps).
Screen-record scrolling from the profile → post → comments → any relevant threads.
If it’s a chat: capture the full conversation including earlier messages showing context (provocation, threats, demands, pattern).

Tip: Take screenshots in a way that includes your device’s clock/date if possible (or immediately follow with a screenshot of your phone’s time settings) to help timeline credibility.

Step 2 — Save the “link evidence”

Copy and store in a text file or notes:

Post URL/permalink
Profile URL
Message thread identifiers (where applicable)
Group/page name and link
Date/time you accessed it

Step 3 — Preserve originals and metadata where you can

Download the photo/video if the platform allows.
Save email notifications (e.g., “Someone mentioned you…”) and platform alerts.
For emails: preserve full headers (useful for trace).
For messaging apps: export chat where possible (some apps allow export with timestamps).

Step 4 — Make an incident log (this helps prosecutors)

Create a simple table:

Date/time
Platform
What happened (1–2 sentences)
Link
Evidence files (screenshot names)
Witnesses (if any)
Harm suffered (panic, missed work, medical consult, school issues)

Step 5 — Back up safely (and avoid tampering allegations)

Keep a folder with read-only copies (cloud + external drive).
Don’t edit screenshots. If you must redact for sharing, keep the original untouched.
Don’t argue back extensively in ways that can be clipped out of context; focus on preservation and reporting.

Step 6 — Consider third-party preservation (optional but strong)

If the situation is serious:

Have key screenshots and logs notarized as attachments to an affidavit.
Ask a trusted person to view the content and execute a witness affidavit (“I personally saw X on Y date/time at this link.”)

5) How to identify an anonymous poster (what is realistic)

Victims usually cannot “unmask” anonymous posters by themselves. Identification is typically done through:

Platform account data (registration email/phone, internal identifiers)
IP logs and access logs
Subscriber records (telecom/ISP)
Device identifiers (limited and platform-dependent)

In the Philippines, law enforcement/prosecutors can seek court-issued cybercrime warrants under the Rule on Cybercrime Warrants (A.M. No. 17-11-03-SC), such as warrants to disclose, collect, search/seize, or in some cases intercept computer data (each has specific legal thresholds and limits).

Reality check:

Some platforms store limited logs or only for limited periods.
If the poster used layered anonymity (VPN + throwaway email + public Wi-Fi), identification can be harder, but not always impossible.
Fast reporting increases the chance logs still exist.

6) Where to file complaints (Philippine pathways)

You generally have four parallel tracks (you can do more than one):

Track A — Criminal complaint (primary route for cyberbullying)

File with:

PNP Anti-Cybercrime Group
NBI Cybercrime Division
The city/provincial prosecutor’s office (often after initial law-enforcement evaluation)

What they typically ask for:

Your affidavit-complaint (narrative + attachments)
Evidence folder (screenshots, screen recordings, URLs, logs)
IDs and proof you are the person targeted (e.g., your real account, name used)
If threats: details showing fear and seriousness; if doxxing: proof the data is yours

Track B — Administrative / regulatory (for personal data misuse)

File with the National Privacy Commission if:

you were doxxed,
private data was published/processed without lawful basis,
the harassment involves systematic collection/use of your personal information.

This can support takedown efforts and create official findings useful in other proceedings, depending on facts.

Track C — School or workplace remedies

If student-on-student and the school has jurisdiction via policy: invoke the Anti-Bullying Act implementing rules and school handbook.
For workplace harassment: HR and code-of-conduct procedures can be effective for fast relief, even while criminal cases run.

Track D — Civil action for damages / injunction-type relief

You may pursue damages under Civil Code principles (e.g., abuse of rights; acts contrary to morals/public policy; causing injury), and in some cases seek court orders. Civil strategy is fact- and budget-dependent but can be powerful where reputational harm is severe and provable.

7) How to file a criminal cyberbullying-related complaint (step-by-step)

Step 1 — Choose the best “anchor offense”

Your affidavit should clearly identify the most fitting offense(s), for example:

Cyber libel (false imputation harming reputation)
Threats (explicit harm)
RA 9995 (intimate content)
RA 11313 (gender-based online sexual harassment)
RA 9262 (if intimate partner and pattern of abuse)
Unjust vexation / coercion (persistent harassment or pressure)

You don’t need to perfectly label everything; investigators/prosecutors can refine charges. But you should describe facts in a way that clearly matches elements.

Step 2 — Prepare an affidavit-complaint that reads like a timeline

A strong affidavit-complaint usually contains:

Your identity and how you can be reached
Who did it (known person, suspected person, or “unknown owner of account ___”)
What happened (chronological narrative)
Why it’s unlawful (brief legal basis)
Evidence list (Annex “A”, “B”, etc.)
Harm suffered (fear, anxiety, lost income, medical consult, reputational damage)
Relief requested (investigation, identification, prosecution)

Attach:

Annex A: screenshots + URLs
Annex B: screen recordings
Annex C: incident log
Annex D: proof of identity / ownership of targeted account
Annex E: witness statements (if any)

Step 3 — File with cybercrime units or the prosecutor

Many complainants start with PNP/NBI cybercrime units for:

evaluation,
guidance on proper evidence packaging,
technical steps for preservation and possible warrant applications.

Then the complaint proceeds for inquest/preliminary investigation depending on circumstances.

Step 4 — Be ready for “counter-allegations”

Common defenses and counters:

“It’s just opinion” (vs. assertion of fact)
“Not about you” (identity and reference)
“Not me” (account ownership—hence need for logs and warrants)
“You consented/you sent it” (in intimate-content cases; consent to create ≠ consent to share)

Your evidence and narrative should anticipate these.

8) Cyber libel basics (because it’s the most common filing)

Cyber libel typically centers on:

Defamatory imputation (a claim that tends to dishonor/discredit)
Publication (posted where others can see)
Identification (you are identifiable, even if not named)
Malice (often presumed in libel, subject to defenses like privileged communication)

High-risk areas:

Accusing someone of a crime without proof
Alleging sexual misconduct
Claiming corruption, dishonesty, or professional incompetence
Posting edited media that implies false facts

Important practical note on timing: There has been debate and changing interpretations on prescription periods for cyber libel versus traditional libel. The safest approach is to act quickly and file as early as possible, ideally well within one year, to avoid prescription disputes.

9) Threats, harassment, stalking-style conduct: what makes them “actionable”

Investigators look for:

Clear language of harm (“I will kill you,” “I’ll ruin your life,” “Wait until you go home”)
Specificity (time/place/method)
Repetition/pattern (daily messages, coordinated brigading)
Power imbalance (boss/teacher/partner)
Evidence of fear and disruption (panic attacks, absences, safety measures)

If you fear imminent harm, preserve evidence and consider immediate reporting to local authorities while also initiating cybercrime reporting.

10) Doxxing and privacy violations (what to document)

If private information was posted:

Capture the post showing the data
Prove the data is yours (ID, bills, screenshots of your own profile showing same number, etc.)
Document consequences (threats received, strangers contacting you, safety risk)
Identify whether the data came from a breach, insider, or scraping

Doxxing can strengthen both criminal and privacy/regulatory tracks.

11) Platform reporting: useful, but don’t treat it as your only remedy

Report the content inside the platform/app to:

trigger takedown,
preserve internal records,
establish a documented complaint trail (screenshots of report confirmations help).

But platform takedown ≠ legal accountability, and deleted posts can erase your best evidence if you did not preserve first.

12) Practical safety measures while building a case

Lock down accounts (2FA, password changes, recovery email/phone updates)
Reduce public visibility of personal data
Ask close contacts not to engage with the bully (engagement boosts spread)
Monitor for impersonation accounts and report them
If doxxed: consider changing exposed numbers/emails and alerting workplace/security

13) Quick “What should I do today?” action plan (victim checklist)

Screenshot + screen-record everything with URLs
Build an incident log
Back up originals (cloud + external)
Report content in-platform (capture the report confirmation)
Prepare affidavit-complaint with annexes
File with PNP Anti-Cybercrime Group or NBI Cybercrime Division
If doxxed, consider a parallel complaint with the National Privacy Commission
If intimate partner/ex-partner: evaluate RA 9262 remedies, including protection orders

14) Limits and expectations (what outcomes look like)

Possible outcomes include:

Identification of the account owner (when logs are available and warrants are obtained)
Filing of criminal charges (cyber libel, threats, voyeurism, harassment statutes)
Protective remedies (especially in intimate partner contexts)
Takedowns and platform enforcement
Civil damages (where harm is provable)

Constraints:

Cross-border platforms can slow disclosure
Anonymous tools can complicate identification
Delayed reporting risks losing logs
Weak evidence capture is the #1 reason complaints stall

15) Disclaimer

This is general legal information for the Philippine setting and is not a substitute for advice on a specific case.