If someone posted your home address, phone number, workplace, photos, private messages, loan details, medical information, or accusations against you online, the first question is usually: “Is this cyber libel, doxxing, or a data privacy violation?” In the Philippines, the answer depends on what was exposed, how it was posted, whether it damaged your reputation, whether the information is personal or sensitive, and whether threats, harassment, or sexual content were involved. “Doxxing” is not always charged as one single crime, but online exposure can trigger several legal remedies under Philippine law, including cyber libel, Data Privacy Act complaints, civil damages, Safe Spaces Act remedies, and, in serious cases, cybercrime investigation by the NBI or PNP.

What Doxxing Means in the Philippine Legal Context

Doxxing usually means publicly exposing someone’s personal information online without consent, often to shame, intimidate, harass, endanger, or encourage others to contact or attack that person.

Common examples include posting:

A person’s full name, address, mobile number, email, workplace, school, or family details
Screenshots of private chats
Copies of IDs, passports, visas, employment records, payslips, or bank details
Loan information, debt collection messages, or contact lists
Medical, sexual, or family information
Photos of a home, condominium unit, car plate, or children
False accusations together with identifying details

Philippine law does not use “doxxing” as one universal criminal label in the way ordinary internet users do. Instead, the law looks at the specific act. The same Facebook post, TikTok video, Reddit thread, Telegram message, or X post may involve cyber libel, unlawful disclosure of personal data, online gender-based harassment, photo or video voyeurism, grave threats, unjust vexation, civil damages, or a combination of these.

The National Privacy Commission has also recognized harmful uses of publicly available personal data, including doxxing, in its 2026 guidance on data scraping. The NPC emphasized that information posted online does not automatically mean anyone may collect and use it without limits. See the NPC’s Advisory No. 2026-01 on scraping of publicly available personal data.

Doxxing vs. Cyber Libel: What Is the Difference?

Doxxing and cyber libel often happen together, but they are not the same.

Issue	Doxxing	Cyber libel
Main harm	Exposure of personal information	Damage to reputation through defamatory statements
Key question	Was personal or sensitive information exposed, misused, or maliciously disclosed?	Was there a public and malicious imputation that dishonors, discredits, or causes contempt?
Common example	“Here is her address and phone number. Message her family.”	“He stole company money” posted publicly without proof
Main legal bases	Data Privacy Act, Civil Code, Safe Spaces Act, Anti-Photo and Video Voyeurism Act, criminal laws on threats/harassment	Revised Penal Code Articles 353 and 355, as applied online by RA 10175
Government office often involved	National Privacy Commission, NBI Cybercrime Division, PNP Anti-Cybercrime Group	Prosecutor’s Office, NBI Cybercrime Division, PNP Anti-Cybercrime Group, cybercrime courts

A post can be doxxing without being cyber libel. For example, posting someone’s real address and phone number may be a privacy and safety issue even if there is no defamatory accusation.

A post can also be cyber libel without being doxxing. For example, falsely accusing a clearly identifiable business owner of fraud in a public Facebook post may be cyber libel even if no address or phone number was exposed.

It can be both when the post says something like: “This woman is a scammer. Here is her home address, phone number, employer, and photos of her children.”

Legal Basis for Cyber Libel in the Philippines

Cyber libel is based on the traditional libel provisions of the Revised Penal Code, applied to online publication through the Cybercrime Prevention Act.

Under Article 353 of the Revised Penal Code, libel is a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or cause contempt against a natural or juridical person.

Under Article 355 of the Revised Penal Code, as amended by RA 10951, libel may be committed by writing, printing, radio, painting, theatrical or cinematographic exhibition, or similar means.

Under Section 4(c)(4) of RA 10175, the Cybercrime Prevention Act of 2012, libel becomes cyber libel when committed through a computer system or similar means.

Elements usually considered in a cyber libel case

For a cyber libel complaint, the facts usually need to show:

There was a defamatory imputation. The post accused you of a crime, vice, defect, dishonesty, immoral conduct, professional misconduct, or another circumstance that tends to dishonor or discredit you.
The statement was published. At least one person other than you and the poster saw or could access the statement. Public posts, group chats, comment sections, pages, blogs, and shared videos may satisfy this.
You were identifiable. Your name does not always need to appear. Identification may come from your photo, nickname, business name, address, tags, workplace, family details, or context.
There was malice. Malice may be presumed in many defamatory imputations, but the accused may raise defenses such as good motive, justifiable ends, privileged communication, truth with proper purpose, or fair comment.
It was done through a computer system or online platform. Facebook, Instagram, TikTok, YouTube, X, Reddit, blogs, websites, email, messaging apps, and other digital platforms may fall under this element.

Important Supreme Court rules on cyber libel

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel but limited it in important ways. The Court said the law validly covers online defamation by the author of the libelous statement, but it rejected criminal liability for mere receiving, reacting to, or passively engaging with libelous content in the broad way challenged in that case. Read the decision in Disini v. Secretary of Justice, G.R. No. 203335.

This does not mean reposting is always safe. If a person adds their own defamatory caption, republishes the accusation as their own, edits the material to worsen it, or encourages harassment, they may create a separate legal problem.

In Causing v. People, the Supreme Court clarified that cyber libel prescribes in one year from discovery, not 15 years. This is important because old online posts can still create questions about when the offended party actually discovered the post. See the Supreme Court’s 2026 release, SC Affirms Cyber Libel Prescribes One Year from Discovery.

Legal Basis for Doxxing and Online Exposure

Because doxxing is fact-specific, several laws may apply.

Data Privacy Act of 2012

RA 10173, the Data Privacy Act of 2012, protects personal information and sensitive personal information.

This is especially relevant when the exposed information includes:

Government-issued IDs
Address, contact details, birthdate, civil status
Financial or loan information
Health or medical information
Education, employment, or disciplinary records
Private photos or messages
Information about children
Data collected by an app, employer, lender, school, association, website, or business

The Data Privacy Act is often strongest when the respondent is a company, online lending app, employer, school, organization, website operator, building administration, clinic, or other person or entity that collected or processed data in an organized way. For purely personal disputes between private individuals, the NPC will still look at whether there was personal data processing covered by the law and whether a specific privacy violation can be shown.

The NPC expressly says a person may file a complaint if personal information has been misused, maliciously disclosed, improperly disposed of, or if data privacy rights were violated. See the NPC page on the right to file a complaint.

Civil Code remedies for privacy, dignity, and damages

Even when the act is not clearly criminal, the Civil Code may provide a basis for damages or other relief.

Under Article 26 of the Civil Code, every person must respect the dignity, personality, privacy, and peace of mind of others. It recognizes causes of action for acts such as disturbing private life or family relations, intriguing to alienate a person from friends, and vexing or humiliating another due to personal conditions.

Under Article 32, a private individual or public officer may be liable for damages for violating rights such as freedom of speech, security of person and effects, privacy of communication, and access to courts.

Under Article 33, in cases of defamation, a civil action for damages may be filed separately from the criminal case and requires only preponderance of evidence, which is a lower standard than proof beyond reasonable doubt.

Under Articles 2217 and 2219, moral damages may be recovered for mental anguish, serious anxiety, besmirched reputation, wounded feelings, social humiliation, and similar injury, including in cases of libel, slander, or other defamation.

Safe Spaces Act for gender-based online harassment

RA 11313, the Safe Spaces Act, may apply when online exposure is gender-based, sexual, misogynistic, homophobic, transphobic, or sexist.

Gender-based online sexual harassment includes using information and communications technology to terrorize or intimidate victims, make unwanted sexual or sexist remarks, invade privacy through cyberstalking or incessant messaging, upload or share sexual media without consent, impersonate victims, or post lies to harm their reputation.

This law is especially relevant in cases involving:

Ex-partners posting sexual accusations
Threats to release intimate photos
Misogynistic or sexist shaming
LGBTQIA+ outing or harassment
Incessant sexual messages or stalking
Fake accounts impersonating the victim in a sexualized way

Anti-Photo and Video Voyeurism Act

RA 9995, the Anti-Photo and Video Voyeurism Act of 2009, may apply when the online exposure involves intimate photos or videos.

A crucial point: even if a person originally consented to the recording, that does not automatically mean they consented to copying, sharing, posting, selling, or broadcasting it. RA 9995 penalizes acts involving sexual acts or private areas when done without the required consent, including publication or broadcast through the internet, cellphones, and similar means.

Threats, coercion, unjust vexation, and stalking-type behavior

If doxxing is combined with threats such as “pupuntahan ka namin,” “alam namin address mo,” “we will send this to your employer,” or “pay or we will expose you,” the facts may support other criminal complaints under the Revised Penal Code, depending on the wording and conduct.

Possible related offenses include:

Grave threats or light threats
Coercions
Unjust vexation
Slander or oral defamation
Intriguing against honor
Blackmail-type conduct, depending on the facts
Violence against women and children under RA 9262, if the offender is a current or former intimate partner and the victim is a woman or child covered by the law

What to Do Immediately After Being Doxxed or Cyber-Libeled

The first few hours matter. Online evidence disappears quickly, accounts change names, posts get deleted, and platforms may remove content before you have a usable record.

Do not immediately comment, argue, or threaten back. Emotional replies can be screenshotted and used to confuse the issue. If you must respond publicly, keep it factual and minimal.
Preserve the evidence before reporting the post. Once you report content to a platform, it may be removed. That helps safety but can make proof harder if you did not save it first.
Take full screenshots and screen recordings. Capture:
- The full post or message
- URL or profile link
- Username, display name, profile photo, and account ID if visible
- Date and time shown on your device
- Comments, shares, reactions, tags, and captions
- The surrounding thread for context
- Your device date, time, and timezone if possible
Save the original links. Copy URLs to the post, comment, profile, group, page, video, or image. If it is in a private group, record the group name and membership context.
Identify witnesses. Ask people who saw the post to save screenshots and execute affidavits if needed. A witness who saw the post independently can help prove publication.
Secure your accounts and personal safety. Change passwords, enable two-factor authentication, review privacy settings, remove public address or workplace details, and warn family members if they may be contacted.
Report urgent threats to law enforcement. If your address was posted with threats or calls for violence, treat it as a safety issue, not just a reputation issue.
Request platform takedown after preserving evidence. Use the platform’s reporting tools for harassment, privacy violation, impersonation, non-consensual intimate content, or false information.
Prepare a chronological incident log. List each post, date, platform, account, link, witnesses, and harm caused. This becomes useful for the NBI, PNP, NPC, prosecutor, or court.

Where to File: NBI, PNP, NPC, Prosecutor, or Court?

The correct office depends on the main legal problem.

Situation	Possible office or remedy	Practical purpose
Anonymous account, fake profile, hacking, coordinated harassment, cyber libel	NBI Cybercrime Division or PNP Anti-Cybercrime Group	Investigation, technical assistance, cybercrime documentation
Public defamatory post by known person	City or Provincial Prosecutor, often with NBI/PNP assistance	Preliminary investigation for cyber libel
Misuse or malicious disclosure of personal data	National Privacy Commission	Data privacy complaint, possible orders, administrative fines, recommendation for prosecution
Online lender shaming borrower or contacting phone contacts	NPC, SEC for financing/lending issues, NBI/PNP if threats or cybercrime	Privacy, consumer protection, and possible criminal remedies
Threats, extortion, stalking, exposure of home address	PNP/NBI and prosecutor	Criminal investigation and safety documentation
Intimate photos/videos posted or threatened	NBI/PNP, prosecutor, platform reporting, possibly court protection remedies	Criminal complaint and urgent takedown
Damages for humiliation, lost work, anxiety, reputation harm	Civil court	Compensation, injunction, damages
Threat to life, liberty, or security involving data gathering	Petition for writ of habeas data	Court remedy to access, correct, suppress, or destroy unlawfully gathered data

The NBI’s Citizen’s Charter identifies the CyberCrime Division as handling investigative assistance for victims of computer crimes. The PNP Anti-Cybercrime Group also handles cybercrime complaints, and the DOJ Office of Cybercrime provides official information on reporting cybercrime incidents.

For privacy complaints, the NPC requires a specific format. Its official instructions say a formal complaint should be downloaded, filled out, notarized, and submitted in person, by courier, or by email. See the NPC guide on filing formal complaints and its mechanics for complaints.

Documents and Evidence Usually Needed

Document or evidence	Why it matters
Government ID of complainant	Establishes identity
Complaint-affidavit	Main sworn statement narrating the facts
Screenshots and screen recordings	Shows the post, account, comments, and publication
URLs and account links	Helps investigators locate the content
Witness affidavits	Proves that third persons saw the post
Proof of identity of respondent	Real name, address, employer, phone, email, known accounts
Proof of harm	Messages from people who saw it, employer notices, lost clients, medical records, anxiety treatment, security costs
Platform reports and takedown responses	Shows mitigation efforts and platform action
Notarized authorization or SPA	Needed if a representative files or follows up
Consularized affidavit or apostilled document	Often needed if the complainant is abroad or documents were executed overseas

For Filipinos or foreigners abroad, affidavits intended for use in the Philippines are commonly signed before a Philippine Embassy or Consulate, or processed under applicable apostille rules depending on the document and country. Philippine embassies commonly provide notarial services for affidavits and similar documents for use in the Philippines; for example, see the Philippine Embassy’s explanation of consular notarization. The DFA also maintains an official Apostille FAQ.

How to File a Cyber Libel or Doxxing-Related Complaint

Step 1: Classify the strongest legal issue

Ask first: what is the core wrong?

False accusation damaging reputation? Cyber libel.
Exposure of address, ID, medical, loan, or private data? Data privacy and civil privacy remedies.
Sexual image or intimate video? RA 9995 and possibly Safe Spaces Act.
Gendered, sexist, homophobic, or sexualized harassment? Safe Spaces Act.
Threats or extortion? Criminal threats/coercion, cybercrime investigation.
Business, employer, school, or lender misuse of data? NPC complaint, plus other agency remedies.

A common mistake is filing everything as “cyber libel” when the stronger case may actually be data privacy, threats, or non-consensual sharing of intimate material.

Step 2: Prepare a clear complaint-affidavit

Your affidavit should be factual and chronological. Include:

Who you are
Who the respondent is, if known
What was posted or exposed
Exact dates and platforms
How you discovered the post
Who else saw it
Why the statement is false, malicious, private, threatening, or unauthorized
What harm resulted
What evidence is attached
What relief you seek, such as investigation, takedown, prosecution, damages, or data protection orders

Avoid long emotional commentary. A strong affidavit is specific, organized, and supported by attachments.

Step 3: Have the affidavit notarized

Most prosecutor, NPC, and court filings require sworn statements. If you are abroad, check the nearest Philippine Embassy or Consulate for consular notarization, or ask whether an apostilled notarized document from the foreign country is acceptable for the specific office where it will be filed.

Step 4: File with the appropriate office

For cybercrime investigation, victims often start with the NBI Cybercrime Division or PNP Anti-Cybercrime Group, especially if the account is anonymous or technical assistance is needed.

For cyber libel against a known respondent, the complaint may proceed to the Office of the City or Provincial Prosecutor for preliminary investigation. In practice, law enforcement assistance is still useful for technical documentation.

For data privacy violations, file with the NPC using its required complaint format.

Step 5: Expect evaluation, clarificatory hearings, or preliminary investigation

Typical bottlenecks include:

Incomplete screenshots
Missing URLs
Failure to prove the respondent owns the account
Anonymous or foreign-based platforms
Deleted posts
Lack of notarized affidavits
Poorly organized attachments
Difficulty proving actual discovery date for prescription
Respondent claiming truth, fair comment, privileged communication, or lack of malice

Step 6: Follow through after filing

After filing, monitor:

Whether the office asks for additional evidence
Whether the respondent files a counter-affidavit
Whether platform or telco preservation is needed
Whether posts continue or escalate
Whether a supplemental affidavit should be filed for new incidents

Timelines and Practical Expectations

Stage	Practical timeline
Evidence gathering	Same day to 1 week, depending on number of posts
NBI/PNP initial intake	Often same day for initial interview, but investigation may take weeks or months
NPC complaint preparation	A few days to several weeks, depending on evidence and notarization
Prosecutor preliminary investigation	Commonly several months, depending on docket, counter-affidavits, and hearings
Court case after filing of Information	Often years if contested
Platform takedown	Can be within hours for intimate images or threats, but may take longer or be denied
Civil damages case	Often longer than administrative or initial criminal complaint processes

These timelines vary heavily by city, evidence quality, platform cooperation, and whether the respondent is known.

Common Scenarios

“Someone posted my address and told people to message me.”

This may be a privacy, harassment, threat, and safety issue. Preserve the post, report it to the platform, secure your home and accounts, and consider NBI/PNP assistance. If personal data was maliciously disclosed, an NPC complaint may also be appropriate.

“An online lending app messaged my contacts and called me a scammer.”

This may involve data privacy violations, unfair collection practices, harassment, and possibly cyber libel depending on the exact words used. The NPC has repeatedly acted on online lending practices involving excessive data collection, contact-list harvesting, debt shaming, and public shaming. See the NPC discussion on online lenders being barred from harvesting borrowers’ phone and social media contact lists.

“My ex threatened to upload intimate photos.”

This is urgent. Preserve the threats, avoid paying or negotiating in a way that encourages more extortion, report to the platform if content is uploaded, and consider NBI/PNP assistance. RA 9995 may apply even if the original recording was consensual, because sharing or broadcasting requires separate consent.

“Someone called me a scammer on Facebook.”

This may be cyber libel if the statement is defamatory, public, identifiable, malicious, and made through a computer system. But context matters. A private consumer complaint, fair comment, or truthful warning made in good faith may be treated differently from a malicious false accusation.

“The post is from a fake account. Can I still file?”

Yes, but proof becomes harder. This is where NBI or PNP cybercrime assistance is useful. Do not assume that screenshots alone will identify the person behind the account. Investigators may need preservation requests, account data, device information, or other evidence subject to legal process and platform cooperation.

“I am a foreigner doxxed by someone in the Philippines.”

Foreigners may file complaints in the Philippines if the acts, respondent, publication, harm, or evidence have sufficient Philippine connection. If documents are executed abroad, notarization, consularization, or apostille issues may arise. If the foreigner is outside the Philippines, a representative may need a Special Power of Attorney, and the complainant may still be required to participate in affidavits, hearings, or testimony.

Important Defenses and Limits

Not every offensive post is cyber libel or illegal doxxing.

Common defenses or limitations include:

The statement was true and made with good motives and justifiable ends.
The statement was fair comment on a matter of public interest.
The complainant is a public officer or public figure, requiring proof of actual malice in relevant libel situations.
The post did not identify the complainant.
The statement was opinion, hyperbole, or insult rather than a factual defamatory imputation.
The post was a privileged communication, such as a good-faith report to proper authorities.
The information was not private in context, or there was lawful basis for processing.
The respondent did not own or control the account.
The complaint was filed beyond the prescriptive period.
The evidence was incomplete, altered, or not properly authenticated.

For public officials and public figures, Philippine jurisprudence gives wider breathing space to criticism on matters of public interest. Cases such as Borjal v. Court of Appeals, Guingguing v. Court of Appeals, and later libel rulings recognize the importance of fair comment and the higher actual malice standard in proper cases. This does not protect knowingly false accusations or reckless disregard for truth, but it does matter when the post concerns official conduct or public issues.

Is Barangay Conciliation Required?

For cyber libel, barangay conciliation is generally not the practical route because the penalty exceeds the usual Katarungang Pambarangay threshold for offenses punishable by imprisonment of not more than one year or fine of not more than ₱5,000.

However, barangay proceedings may still appear in related lower-level disputes, such as neighborhood harassment, purely civil disputes between residents of the same city or municipality, or minor offenses that fall within barangay jurisdiction. If the matter involves serious threats, cybercrime, intimate images, unknown online accounts, or respondents in different cities or countries, victims usually proceed directly to the appropriate law enforcement agency, prosecutor, NPC, or court remedy.

Frequently Asked Questions

Is doxxing a crime in the Philippines?

There is no single general offense named “doxxing” that covers every situation. But doxxing may violate the Data Privacy Act, Civil Code privacy rights, Safe Spaces Act, Anti-Photo and Video Voyeurism Act, or criminal laws on threats, coercion, defamation, and harassment, depending on the facts.

Can I file cyber libel if someone posted my name and called me a scammer?

Possibly. You need to show that the post made a defamatory imputation, was published online, identified you, was malicious, and harmed your reputation. If the post also exposed your address, phone number, or private records, you may also have privacy-related remedies.

How long do I have to file cyber libel in the Philippines?

Based on the Supreme Court’s ruling in Causing v. People, cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. Because discovery date can become contested, preserve proof of when and how you first learned of the post.

Can I sue someone for posting screenshots of our private chat?

It depends on the content, context, and purpose. If the screenshots contain personal or sensitive information, malicious disclosure, defamatory statements, threats, sexual content, or confidential data, legal remedies may be available. If the screenshots are used as good-faith evidence in a proper complaint or legal proceeding, the analysis may be different.

Can I file a case against a fake account?

Yes, but you will need investigation to connect the fake account to a real person. Preserve links, screenshots, profile history, usernames, phone numbers, payment trails, email clues, and any messages connecting the fake account to the suspected person. NBI or PNP cybercrime units are commonly approached for this.

Can I ask Facebook, TikTok, Google, or X to remove doxxing content?

Yes. Most platforms have reporting tools for harassment, privacy violations, impersonation, threats, and non-consensual intimate content. Save evidence first before reporting. Platform removal helps stop harm, but it does not automatically create a Philippine legal case unless you preserve proof and file with the proper office.

What if the information posted about me is true?

Truth does not automatically make every disclosure lawful. True information may still be private, sensitive, unlawfully obtained, maliciously disclosed, or used to harass. For libel, truth may be a defense only under specific rules and often must be connected with good motives and justifiable ends.

Can foreigners file doxxing or cyber libel complaints in the Philippines?

Yes, if there is a sufficient Philippine connection, such as a Philippine-based respondent, publication in the Philippines, harm suffered in the Philippines, or evidence located here. Foreign complainants abroad may need properly notarized, consularized, or apostilled documents and may need a Philippine representative through a Special Power of Attorney.

Can I claim damages for anxiety, humiliation, or lost clients?

Yes, if you can prove the legal basis and the connection between the wrongful act and your damage. Civil Code remedies may include moral damages for anxiety, besmirched reputation, wounded feelings, and social humiliation; actual damages for provable financial loss; and, in proper cases, exemplary damages and attorney’s fees.

Is it better to file with the NBI, PNP, NPC, or prosecutor?

It depends on the main issue. For anonymous accounts and cyber investigation, start with NBI or PNP. For malicious disclosure or misuse of personal data, consider the NPC. For cyber libel against a known person, a prosecutor’s complaint is usually central. Serious cases often involve more than one route.

Key Takeaways

Doxxing is not always one standalone crime, but online exposure can trigger several Philippine legal remedies.
Cyber libel focuses on defamatory online statements that damage reputation; doxxing focuses on exposure or misuse of personal information.
RA 10175 applies libel to online platforms, while Articles 353 and 355 of the Revised Penal Code define the core offense.
Cyber libel prescribes in one year from discovery under the Supreme Court’s ruling in Causing v. People.
The Data Privacy Act may apply when personal or sensitive information is misused, maliciously disclosed, or improperly processed.
RA 9995 is critical for intimate photos or videos, even if the original recording was consensual.
The Safe Spaces Act may apply to gender-based online harassment, cyberstalking, sexualized posts, impersonation, and non-consensual sexual content.
Preserve evidence before reporting or requesting takedown because deleted posts can become difficult to prove.
Good documentation often determines whether a complaint moves forward: screenshots, URLs, witness affidavits, notarized complaint-affidavit, and proof of harm matter.
Choose the remedy based on the strongest facts, not just the label used online.