Quick answer

A cyber libel case is filed through a sworn complaint supported by admissible evidence showing that the respondent authored and published an identifiable, defamatory, and malicious statement through a computer system. The complaint is ordinarily filed with the proper city or provincial prosecution office; the NBI Cybercrime Division or PNP Anti-Cybercrime Group may first investigate and help preserve digital evidence.

The deadline is unusually short: the Supreme Court has confirmed that cyber libel generally prescribes in one year from its discovery by the offended party, the authorities, or their agents—not automatically from the posting date. Discovery and the filing date must be proved. Do not assume that a demand letter, platform report, barangay complaint, or informal police inquiry stops the period. File the proper criminal complaint promptly.

If you are accused, do not ignore a prosecutor’s subpoena. Obtain the complete complaint, calendar the stated deadline, preserve your account and device records, and submit a sworn counter-affidavit addressing every element and attaching all available defenses. A subpoena is not yet a conviction or, by itself, an arrest warrant.

The governing provisions are Articles 353 to 361 of the Revised Penal Code and Sections 4(c)(4) and 6 of the Cybercrime Prevention Act of 2012.

What the prosecution must prove

Cyber libel is traditional libel committed through a computer system or similar information and communications technology. A conviction requires proof beyond reasonable doubt of all these matters:

Defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. The statement was communicated to at least one person other than the person defamed. A message sent only to the subject ordinarily lacks this element, although a group chat, forwarded message, public post, or message seen by another person may satisfy it.
Identification. The offended person was named or was sufficiently identifiable from the words, images, surrounding facts, or audience’s knowledge. It is not enough that a person merely feels alluded to.
Malice. For an ordinarily defamatory statement about a private person, malice may be presumed unless a recognized privilege or justification applies. Different rules govern qualifiedly privileged speech and commentary involving public officers, public figures, or matters of public interest.
Use of a computer system. The publication occurred through social media, a website, messaging service, email, online video, or another computer-based system.
Authorship and identity of the accused. The prosecution must connect the accused—not merely a display name or account—to the publication.

The Supreme Court’s formulation of the traditional elements appears in cases such as Soriano v. People. Each element must be assessed in the full context of the words, images, audience, platform, and surrounding exchange.

Not every offensive online statement is cyber libel

An unpleasant, insulting, sarcastic, or critical post is not automatically criminal. Important distinctions include:

Fact versus opinion. A pure opinion, joke, or rhetorical exaggeration may not assert a provably false fact. But calling something an “opinion” does not protect a statement that reasonably implies a specific criminal or discreditable fact.
Private criticism versus publication. A statement communicated only to the person concerned generally lacks publication. Copying other people, posting in a group, or allowing another person to read it may change the result.
Identifiable person versus a broad group. The prosecution must show that readers could reasonably identify the complainant. General criticism of a large, undefined group may be insufficient.
Original author versus reactor. In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but invalidated aiding-or-abetting liability as applied to people who merely receive and react to the post. A bare Like, Share, or reaction is therefore different from writing a new defamatory caption or comment that independently makes an accusation.
Public-interest speech. When the statement concerns a public officer’s official conduct, or a public figure in a matter of legitimate public interest, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was true. Mere error or negligence is not necessarily enough. The prosecution bears this burden, as explained in Daquer Jr. v. People. This protection does not automatically cover attacks on a public figure’s unrelated private life.

Privilege, truth, and good motive

Article 354 recognizes qualifiedly privileged communications, including:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without added comments or remarks, of a non-confidential judicial, legislative, or other official proceeding, or of an official act performed by a public officer.

Privilege is not a blanket license to post accusations publicly. A complaint sent in good faith to the official or body responsible for investigating it may be privileged; reposting the same allegations to social media may fall outside the duty that justified the private complaint. Qualified privilege can also be defeated by proof of actual malice.

Truth is important but is not always a complete defense by itself. Under Article 361, the availability and effect of proof of truth depend on the type of imputation. Even when truth may be proved, the accused may still need to show good motives and justifiable ends. For statements about a public officer’s official conduct, constitutional free-speech principles and the actual-malice standard must also be considered.

The one-year prescription period

In its April 8, 2026 resolution in Causing v. People, the Supreme Court reaffirmed that cyber libel prescribes in one year under Article 90 of the Revised Penal Code.

The period is counted from the day the alleged crime was discovered by the offended party, the authorities, or their agents. The Court rejected an automatic presumption that an online post was discovered on the day it was uploaded. The actual discovery date is a factual issue requiring evidence.

Article 91 provides that prescription is interrupted by filing the complaint or information. For safety:

document exactly when, where, and how the post was first discovered;
identify the first person who showed or reported it;
preserve messages or emails through which it was discovered; and
file the formal complaint for preliminary investigation well before the anniversary of the earliest provable discovery.

The period does not run while the offender is absent from the Philippines and may resume if proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused. Because these rules are fact-sensitive, obtain legal advice immediately if the post or its discovery is approaching one year.

How to file a complaint

1. Preserve the evidence before seeking deletion

Capture more than a cropped screenshot. Preserve:

the exact words, images, video, audio, caption, and visible comments;
the complete URL, post or message identifier, account name, profile URL, and platform;
the displayed posting date and time, including the time zone if available;
the full conversation or thread before and after the statement;
screen recordings showing how the content was accessed;
the original downloaded file and available metadata;
the device on which the content was first seen;
messages showing when and from whom you learned about it;
names and contact details of people who saw the publication; and
records linking the account or post to the proposed respondent.

Keep unedited originals and working copies. Do not enhance, crop, overwrite, or repeatedly re-save the only copy. Screenshots can be evidence, but they must still be authenticated. The Rules on Electronic Evidence place the burden of proving the authenticity, integrity, and reliability of a private electronic document on the party offering it.

If the content may disappear or identifying data must be obtained from a platform, promptly seek assistance from the NBI or PNP. Private parties generally cannot compel a platform to disclose subscriber or traffic data on their own.

2. Evaluate every legal element

Before accusing anyone under oath, ask:

What exact statement is defamatory?
What fact does it assert or imply?
Who is the person identified?
Who other than that person received or saw it?
What proves the respondent authored it?
Is the content privileged, a fair report, opinion, or public-interest commentary?
What proves falsity or actual malice where required?
When was it first discovered?
What facts establish the correct venue?

A complaint should quote the exact words, provide a faithful translation when necessary, and explain their context. Avoid paraphrasing the accusation so broadly that the prosecutor cannot assess what was actually published.

3. Choose the proper place of filing

Venue in criminal cases is jurisdictional. Under the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 may be filed before the designated cybercrime court of the province or city where:

the offense or any element was committed;
any part of the computer system used was situated; or
damage to a natural or juridical person took place.

The first court in which the action is properly filed acquires jurisdiction to the exclusion of other courts. Traditional libel’s special venue provisions and the requirement to allege venue with particularity may also affect the analysis. Mere nationwide accessibility of a post should not be treated as unlimited venue. The Supreme Court discusses these concerns in Henares v. Hontiveros.

File with the prosecution office corresponding to a legally supportable venue, not simply the most convenient location. When venue is uncertain—particularly where the author, servers, complainant, and first access are in different places—have a lawyer assess it before filing.

4. Prepare and submit the complaint

A directly filed complaint ordinarily includes:

the sworn complaint-affidavit;
affidavits of witnesses with personal knowledge;
the respondent’s address and identifying information;
the NPS Investigation Data Form;
properly labeled electronic and documentary exhibits; and
the required number of copies for the prosecution office and every respondent.

The Department of Justice publishes a current preliminary-investigation filing checklist. Confirm the receiving office’s current physical or authorized electronic-filing requirements before the deadline; an email sent to an unofficial address may not constitute valid filing.

A prior barangay conciliation is ordinarily not required for cyber libel because its prescribed maximum imprisonment and fine exceed the jurisdictional limits of the Katarungang Pambarangay system.

5. Consider investigative assistance

Republic Act No. 10175 assigns cybercrime-investigation responsibilities to the NBI and PNP. An investigation may be particularly useful when authorship, account control, deleted content, subscriber information, or forensic examination is disputed.

The NBI provides investigative assistance for victims of computer crimes and maintains an online complaint page. An investigative report can strengthen a complaint, but do not let an informal investigation consume the one-year filing period.

What happens during preliminary investigation

Cyber libel carries a prescribed imprisonment range extending beyond six years, so complaints handled by DOJ-NPS prosecutors generally undergo regular preliminary investigation under Department Circular No. 015, the 2024 DOJ-NPS Rules.

The prosecutor evaluates whether there is prima facie evidence with reasonable certainty of conviction. If the complaint is sufficient to proceed, the respondent receives a subpoena with the complaint and supporting evidence.

The subpoena should give the respondent at least 10 days from receipt to submit a counter-affidavit, but the exact date stated in the subpoena or prosecutor’s order must be followed. If the respondent cannot be served or fails to answer, the prosecutor may resolve the case using the complainant’s evidence. Clarificatory hearings or additional sworn submissions may be required when necessary.

The prosecutor will either dismiss the complaint or recommend filing an information in court. An aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review may also be available under the applicable NPS appeal rules, generally within a similarly short period, but the proper reviewing office, attachments, service requirements, and effect on a case already filed in court must be checked carefully. Filing a review does not automatically suspend court proceedings; the required motion to suspend must be filed, and suspension requires an appropriate order.

How to defend against a complaint

Act immediately on the subpoena

Record the date, time, and manner of receipt. Obtain a complete copy of the complaint and every attachment. If exhibits are missing or illegible, promptly request copies through the prosecution office, but do not assume that the request automatically extends the deadline.

A counter-affidavit should be sworn and supported by all presently available evidence. A bare denial is usually weak. Address the accusation paragraph by paragraph and element by element.

Preserve—not destroy—your records

Keep:

the device and account records relating to the alleged post;
login alerts, security emails, access history, and recovery records;
drafts and source materials;
the complete conversation or thread;
documents relied upon before publishing;
communications with editors, page administrators, or other account users; and
proof of travel, location, hacking, impersonation, or loss of account access, if relevant.

Do not alter timestamps, delete messages, reset the device, or manufacture a replacement explanation. Deleting a live post to limit further harm may be sensible in some situations, but preserve an accurate copy and obtain legal advice first. Deletion does not erase an already completed publication.

Test each element and procedural requirement

Possible defenses or objections, depending on the evidence, include:

the accused did not write, upload, or control the statement;
the account was hacked, impersonated, shared, or controlled by another person;
no third person received the communication;
the complainant was not identifiable;
the words were not defamatory when read in their complete context;
the statement was opinion, rhetorical exaggeration, satire, or fair comment rather than a false factual assertion;
the communication was privileged;
the report was a fair and true, good-faith account of a non-confidential official proceeding;
truth, good motive, and justifiable purpose apply;
the prosecution cannot prove actual malice in a public-official, public-figure, or public-interest case;
the accused merely reacted to another person’s post and did not author a new defamatory statement;
the evidence is unauthenticated, incomplete, altered, or does not reliably connect the accused to the account;
the one-year period had expired before the complaint was filed;
the alleged discovery date is unsupported or contradicted by earlier messages or publications;
venue is improper or insufficiently alleged; or
the same publication is being prosecuted simultaneously as both traditional libel and cyber libel.

In Disini, the Supreme Court invalidated Section 7 of Republic Act No. 10175 insofar as it permitted prosecution under both the Cybercrime Prevention Act and the Revised Penal Code for the same online libelous act.

If an information has already been filed in court

The judge independently determines whether probable cause exists for a warrant. If a warrant is issued, coordinate voluntary surrender and bail through counsel rather than waiting to be arrested unexpectedly. Bail is generally a matter of right before conviction in this type of RTC case, subject to the court’s lawful conditions.

Defenses such as failure to charge an offense, prescription, former jeopardy, or improper venue may support a motion to quash, but such motions must ordinarily be made before plea and are governed by strict rules. Some defenses—especially prescription based on a disputed discovery date—may require evidence at trial rather than resolution solely from the face of the information.

If law-enforcement officers serve a cybercrime or search warrant, do not obstruct them. Ask for a copy, note the exact devices or data taken, request the required inventory or documentation, and contact counsel immediately. Do not volunteer passwords or consent to a broader search without understanding the warrant and obtaining advice.

Possible penalties and civil liability

Under Section 6 of Republic Act No. 10175, the penalty for online libel is one degree higher than for traditional written libel. The statutory alternatives are:

imprisonment of prisión correccional in its maximum period to prisión mayor in its minimum period, approximately four years, two months and one day to eight years;
a fine of ₱40,000 to ₱1,500,000; or
both imprisonment and fine.

The Supreme Court confirmed in People v. Soliman that a fine may be imposed instead of imprisonment when justified; imprisonment is not automatically mandatory. The actual sentence depends on the governing penalty rules and proven circumstances.

Civil damages may also be claimed. The civil action arising from the offense is generally deemed included in the criminal case unless it is waived, validly reserved, or filed beforehand. Article 33 of the Civil Code also recognizes an independent civil action for defamation. Criminal and civil claims have different burdens and procedural consequences, so a complainant should decide the civil strategy before the prosecution begins presenting evidence.

An apology, correction, takedown, settlement, or affidavit of desistance may affect damages, prosecutorial judgment, or sentencing, but none automatically erases criminal liability. Once filed, a criminal case is prosecuted in the name of the People of the Philippines, and dismissal remains subject to the prosecutor or court.

Evidence worth preserving

For either side, build a dated evidence file containing:

original screenshots and screen recordings;
URLs, post IDs, usernames, profile links, and timestamps;
downloaded account or platform data;
full threads and surrounding conversations;
affidavits from people who personally viewed the post;
proof of the first discovery date;
proof connecting—or failing to connect—the account to the accused;
source documents used before publication;
communications showing verification efforts, doubts, corrections, or warnings;
hacking reports, login records, device-repair records, and account-recovery emails;
demand letters, replies, apologies, corrections, and takedown notices;
proof of reputational or financial harm; and
received copies of every complaint, subpoena, order, resolution, and pleading.

Maintain an index and retain the original devices when feasible. Notarizing a printout does not, by itself, prove that the online content was authentic or that a particular person authored it.

Common mistakes

By complainants

Waiting for a platform to act while the one-year period runs.
Treating the upload date as the discovery date without preserving proof of actual discovery.
Filing in a convenient but legally unsupported venue.
Submitting only a cropped screenshot without the URL, context, witness, or account attribution.
Naming the account owner without evidence that the owner authored the post.
Charging every person who liked or shared the content.
Assuming that offensiveness, falsity, or reputational harm alone proves every element.
Assuming truth is irrelevant or that criticism of a public officer follows the same malice rules as an attack on a private person.
Publishing the allegations repeatedly while preparing the complaint.

By respondents

Ignoring the subpoena or relying on an informal promise that the deadline will be extended.
Filing an unsworn denial without supporting documents.
Deleting devices, messages, or login records.
Assuming “it was true” is automatically a complete defense.
Treating every public officer’s private life as a matter of public interest.
Contacting the complainant angrily, threateningly, or through repeated public posts.
Reposting the disputed accusation during the case.
Assuming a prosecutor’s dismissal is already final and missing the opposing party’s review proceedings.
Assuming an administrative review automatically stops arraignment or trial.

When legal help is urgent

Consult a Philippine lawyer immediately if:

the one-year anniversary of discovery is approaching;
you received a prosecutor’s subpoena, resolution, information, summons, or warrant;
content or account data is disappearing;
the author’s identity requires platform or subscriber records;
police seek access to a phone, computer, or account;
several posts, respondents, jurisdictions, or related offenses are involved;
the statement concerns a public officer, journalist, election, official proceeding, or confidential document;
a minor, intimate image, threat, stalking, doxxing, or gender-based harassment is involved; or
a civil damages claim, employment case, administrative complaint, or data-privacy complaint may accompany the criminal case.

Other laws may provide faster or more suitable protection where the conduct involves threats, non-consensual intimate images, violence against women or children, online sexual harassment, impersonation, unlawful access, or misuse of personal data. Do not force every online injury into a cyber libel theory.

Qualified indigent persons may request assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines also maintains legal-aid contact channels.

Frequently asked questions

Can I file directly with the NBI?

You may ask the NBI Cybercrime Division to investigate and gather evidence. The criminal complaint for preliminary investigation must still reach the prosecution office with authority over the case. Confirm that any referral is formally filed before prescription expires.

Is a screenshot enough?

Not necessarily. It may show content, but the prosecution must still establish authenticity, authorship, publication, identification, context, malice, venue, and timely filing. Preserve the original electronic source and witnesses whenever possible.

Does deleting the post prevent a case?

No. Publication may already have been completed. Deletion can limit continued harm and may be relevant to mitigation or settlement, but it does not automatically extinguish liability.

Can someone be charged for sharing a defamatory post?

A person who merely receives and reacts to another’s post is not liable for aiding or abetting cyber libel under Disini. A new caption, accusation, edited image, or independently defamatory comment may itself be treated as a new authored statement. The actual content and conduct control.

Is a private group chat covered?

It can be. Publication requires communication to a third person, not publication to the whole internet. A group chat may satisfy that requirement if another participant received the defamatory statement.

Is criticism of a government official cyber libel?

Not automatically. Criticism of official conduct and matters of public interest receives stronger constitutional protection. The prosecution must prove actual malice beyond reasonable doubt. False attacks on unrelated private matters do not automatically receive that protection.

Does a demand to take down the post interrupt prescription?

Do not assume so. The safest course is the timely filing of the proper criminal complaint. A demand letter may become evidence of notice, correction, damages, or malice, but it is not a substitute for instituting the case.

Can the same post support both criminal and civil claims?

Yes, subject to procedural rules. Civil liability may be included in the criminal case or pursued through an available independent action. Filing choices, reservation requirements, prescription, and the risk of inconsistent strategies should be reviewed with counsel.

What if the complaint was filed more than one year after the post?

The posting date alone does not resolve prescription. The controlling period generally begins upon actual discovery by the offended party, authorities, or their agents. The complainant must prove discovery; the defense may present evidence of an earlier discovery. The Supreme Court has cautioned that this can require a full evidentiary hearing.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Venue, prescription, privilege, authorship, and malice often depend on documents and disputed facts. Laws, rules, procedures, and official guidance were checked through July 31, 2026.