Quick answer

Cyber libel is committed when a person unlawfully publishes defamatory material through a computer system—such as a social-media post, online article, blog, email, or similar digital communication—and the elements of libel under the Revised Penal Code are present.

To file a criminal complaint, preserve the original online evidence immediately, identify the author and publication, prepare a sworn complaint supported by authenticated records and witnesses, and file it with the proper prosecutor’s office. Assistance from the NBI or PNP cybercrime unit may be necessary when the author is unknown or platform and subscriber records must be obtained lawfully.

To defend a complaint, do not ignore a subpoena. Obtain the complete complaint and evidence, preserve the account and source materials, and submit a fact-specific counter-affidavit addressing authorship, identification, publication, defamatory meaning, malice, privilege, truth, jurisdiction, venue, and prescription.

The most urgent deadline is prescription: the Supreme Court has ruled that cyber libel generally prescribes in one year from discovery by the offended party, the authorities, or their agents. Filing and computation can become fact-sensitive, so neither side should wait until the final days.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 covers the acts of libel defined in Article 355 of the Revised Penal Code when committed through a computer system or a similar future means.

A prosecution generally must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, dishonorable conduct, or another circumstance tending to cause dishonor, discredit, or contempt.
Publication. The material was communicated to at least one person other than the person allegedly defamed.
Identification. The complainant was named or was reasonably identifiable from the words, images, circumstances, or surrounding context.
Malice. Malice may be presumed in an ordinarily defamatory publication, subject to statutory privileges and constitutional rules. In some cases—particularly those involving public officials, public figures, or matters of public concern—the prosecution may have to establish actual malice.
Use of a computer system. The libelous material was published through information and communications technology.
Responsibility of the accused. There must be competent evidence connecting the accused to the authorship or legally relevant publication of the material.

A harsh, insulting, embarrassing, or unpopular online statement is not automatically cyber libel. The exact words, their ordinary meaning, the whole context, the identity of the speaker and subject, the audience, and the supporting evidence all matter.

Who may be prosecuted?

In Disini v. Secretary of Justice, the Supreme Court upheld the cyber-libel provision as applied to the original author of the online post. It declared the provision unconstitutional as applied to people who merely receive and react to the post, and it invalidated the general aiding-or-abetting provision insofar as it applied to cyber libel.

Accordingly, merely pressing “Like,” using a reaction, or sharing an existing post is not automatically the same as authoring the defamatory statement. But a person who adds a new defamatory caption, materially rewrites an accusation, republishes it as their own assertion, or creates a separate defamatory post may face a different analysis. Liability depends on what that person actually authored and published.

Page ownership, administrator status, employment, or access to an account does not by itself prove authorship. The prosecution must connect the accused to the charged publication through admissible evidence.

Important distinctions and exceptions

Opinion versus a factual accusation

An opinion is not protected simply because it begins with “I think,” “allegedly,” or a question mark. Courts consider whether a reasonable reader would understand the statement as asserting or implying a verifiable and defamatory fact.

Rhetorical criticism, satire, hyperbole, and comment may be treated differently from a concrete accusation such as theft, fraud, adultery, corruption, or professional misconduct. Context is crucial.

Truth is not always enough by itself

Under Article 361 of the Revised Penal Code, proof of truth may be admitted in specified circumstances. Acquittal generally requires not only proof that the imputation was true but also that it was published with good motives and for justifiable ends. Special restrictions apply when the imputation concerns matters that do not constitute crimes and when the offended person is not a public officer.

A defendant should therefore avoid treating “but it was true” as a complete defense without documents, reliable sources, and evidence of the purpose and circumstances of publication.

Privileged communications

Article 354 recognizes qualifiedly privileged communications, including:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of specified official proceedings or acts.

Privilege is not a blanket exemption. Excessive publication, irrelevant accusations, misleading additions, lack of good faith, or proof of actual malice may defeat a qualified privilege.

Statements made in judicial proceedings may receive stronger protection when relevant to the proceeding, but the protection does not necessarily extend to repeating the allegations publicly online.

Public officials and matters of public concern

Speech about government and public affairs receives heightened constitutional protection. A public official generally cannot obtain liability for criticism relating to official conduct without the constitutionally required showing of actual malice—knowledge that the statement was false or reckless disregard of whether it was false.

“Actual malice” is not merely anger, ill will, or strong language. It concerns the speaker’s state of mind regarding falsity. The classification of a person as a public figure, and whether the statement concerns public conduct or a private matter, can require close legal analysis.

Private and group messages

Publication does not require a public Facebook post or a large audience. Sending a defamatory message to even one third person may satisfy publication. A direct message sent only to the person criticized ordinarily presents a different issue because no third person received it, although other laws may still apply.

A post in a private group, workplace chat, community page, or group message may still be published for libel purposes.

Anonymous or fake accounts

A screen name does not establish the real author. Subscriber information, login records, device evidence, admissions, witnesses, linked accounts, and other circumstances may be relevant.

Complainants cannot compel platforms or telecommunications providers to disclose protected data merely by sending a private demand. The Cybercrime Prevention Act and the Supreme Court’s rules require the proper law-enforcement process and, for protected information, the appropriate court warrant or order.

The one-year prescription period

In Causing v. People, G.R. No. 258524, October 11, 2023, the Supreme Court ruled that cyber libel prescribes in one year, abandoning the earlier view that it prescribed in 12 years.

The period is counted from the date the crime is discovered by the offended party, the authorities, or their agents. Publication and discovery often occur on the same day, but not always. The party relying on a later discovery date should be ready to prove when and how discovery occurred.

Article 91 of the Revised Penal Code states that prescription is interrupted by the filing of the complaint or information and may begin running again if the proceedings terminate without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused. The accused’s absence from the Philippines may also affect computation.

Do not assume that an old post creates a fresh one-year period each day it remains accessible. Likewise, editing, updating, reposting, or creating a new publication raises fact-specific questions and should not be relied upon casually as either restarting or avoiding prescription.

A civil action for injury to rights or defamation may have its own one-year period under Article 1147 of the Civil Code. Criminal and civil remedies should therefore be evaluated separately.

How to preserve online evidence

Online material can be deleted, edited, made private, or detached from its account. Preserve evidence before requesting removal or confronting the author.

Keep:

full-page screenshots showing the post, account name, date, time, comments, caption, images, and surrounding context;
the exact URL or other unique location of the content;
a screen recording showing how the account and post were accessed;
copies of the webpage, message thread, email, attachments, and original media files;
visible account details, profile identifiers, usernames, and previous names;
notifications, message headers, and available metadata;
the names and sworn accounts of people who personally viewed or received the publication;
documents explaining why the complainant was identifiable;
records of harm, such as lost work, cancelled contracts, client messages, or medical records, when relevant;
for the defense, drafts, source materials, official records, interview notes, correspondence, and documents relied upon before publication; and
the original devices and accounts, without wiping, resetting, fabricating, or altering their contents.

Record who collected each item, when it was collected, and how it was stored. A screenshot proves what appeared on a screen, but it does not necessarily prove who authored the content. Electronic evidence may require authentication under the Rules on Electronic Evidence.

If deletion or loss is imminent, ask a lawyer or cybercrime investigator about a lawful preservation request. Section 13 of the Cybercrime Prevention Act provides preservation periods for specified computer data, but it does not give a private person unrestricted access to that data.

How to file a criminal cyber-libel complaint

1. Confirm the exact publication

Identify every statement complained of, its date, platform, URL, audience, author, and why it is defamatory. Avoid submitting only selected fragments when the complete post or conversation changes the meaning.

Separate the author’s words from quotations, comments by other users, automated previews, and material written by unrelated persons.

2. Check identification and publication

Explain how readers knew the statement referred to you, especially if it did not use your complete name. Identify at least one third person who saw or received it.

A complainant’s personal interpretation is not enough when no reasonable reader could identify them.

3. Assess falsity, privilege, and public-interest issues

Collect the records that disprove the accusation. Anticipate defenses based on truth, fair comment, qualified privilege, official proceedings, good faith, public concern, or lack of actual malice.

A criminal complaint should disclose material context rather than conceal portions that may be unfavorable.

4. Act within one year of discovery

Document the discovery date and file promptly. A demand for apology, negotiation, platform report, or barangay discussion should not be assumed to suspend criminal prescription.

Cyber libel is generally not a dispute for mandatory barangay conciliation when its nature, penalty, parties, or territorial circumstances place it outside the Katarungang Pambarangay system. Obtain case-specific advice instead of relying on a barangay filing to protect the one-year deadline.

5. Prepare the sworn complaint and supporting affidavits

The complaint should ordinarily contain:

the complainant’s identity and contact details;
the respondent’s known identity and address;
a chronological account based on personal knowledge;
the exact allegedly defamatory statements;
facts showing publication and identification;
the discovery date;
facts connecting the respondent to the account or publication;
properly marked supporting documents and electronic records;
witness affidavits where available; and
a verification or sworn declaration in the form required by the receiving office.

Do not exaggerate facts, edit screenshots misleadingly, or claim personal knowledge of matters learned only from someone else.

6. File with the proper prosecutor’s office

A criminal complaint is ordinarily filed for investigation with the prosecutor’s office that has territorial authority over the offense. Because online publication can involve several locations, jurisdiction and venue must be established from concrete facts—not merely from the complainant’s preferred location.

Section 21 of the Cybercrime Prevention Act gives Regional Trial Courts jurisdiction over violations of the Act where the statutory jurisdictional connections exist and provides for designated cybercrime courts. This does not mean that every prosecutor or RTC in the Philippines is automatically a proper venue.

Before filing, verify with the receiving prosecution office:

whether it accepts walk-in, authorized representative, courier, or approved electronic submissions;
the required number and format of copies;
notarization or oath requirements;
documentary and media-storage requirements; and
current procedures under the DOJ-NPS rules.

Filing practices may vary by office and may change through official issuances. Obtain and retain a stamped receiving copy or official electronic acknowledgment.

7. Consider an NBI or PNP cybercrime investigation

The Cybercrime Prevention Act identifies the NBI and PNP as cybercrime law-enforcement authorities. Their specialized units may assist when:

the account is anonymous;
device examination is required;
records are likely to disappear;
subscriber, traffic, or content data must be sought through lawful process;
the evidence involves account compromise or impersonation; or
related cyber offenses may have occurred.

An investigative report can help, but it does not replace the prosecutor’s independent evaluation.

8. Participate in the preliminary investigation

Under the current DOJ-NPS framework, the prosecutor assesses whether the evidence meets the governing standard for filing a criminal case. The respondent must be given the prescribed opportunity to answer, subject to lawful service and applicable exceptions.

Comply strictly with every subpoena, order, and stated deadline. Do not rely on an assumed period from an older rule: use the deadline written in the current subpoena or order, and promptly request any legally permitted extension before it expires.

If the prosecutor finds sufficient basis, an information may be filed in the proper Regional Trial Court. The court—not the complainant or prosecutor—ultimately determines guilt beyond reasonable doubt.

How to defend a cyber-libel complaint

1. Do not contact or threaten the complainant

Arguments, takedown demands, retaliation, doxxing, and new posts can create additional evidence or separate legal problems. Preserve the material before changing anything, then obtain advice on whether a correction, takedown, or response is appropriate.

2. Obtain the complete case records

Secure copies of:

the complaint-affidavit;
annexes and electronic evidence;
witness affidavits;
the subpoena and proof of service;
the docket number and investigating office; and
every order stating a deadline.

A defense cannot be prepared reliably from a social-media announcement or an incomplete screenshot.

3. Preserve the account and source evidence

Do not delete the account, wipe the device, fabricate a source, alter timestamps, or ask witnesses to coordinate stories. Preserve drafts, revision histories, account-security notices, login records available to you, research materials, communications, and official documents relied upon.

If the account was compromised, report the compromise promptly to the platform and appropriate authorities, preserve the acknowledgments, and document when access was lost and recovered.

4. Test every element

A counter-affidavit may address, where supported:

No authorship: another person created or controlled the account or wrote the charged words.
No publication: the material was not communicated to a third person.
No identification: the complainant was neither named nor reasonably identifiable.
No defamatory imputation: the full context shows criticism, opinion, satire, hyperbole, or another non-defamatory meaning.
Truth and justification: reliable evidence supports the statement and its legitimate purpose.
Qualified privilege: the communication was made pursuant to a duty or was a fair and true good-faith report within Article 354.
Absence of actual malice: where the constitutional actual-malice standard applies, the available evidence shows reasonable investigation and good-faith reliance rather than knowledge of falsity or reckless disregard.
Prescription: more than one year elapsed from the legally relevant discovery date before filing.
Improper venue or lack of jurisdictional facts: the complaint does not establish the necessary territorial connection.
No offense at the time: penal laws cannot ordinarily be applied retroactively to conduct completed before their effectivity.
Insufficient or unauthenticated electronic evidence: the evidence does not reliably establish the content, source, integrity, or authorship of the publication.

Use only defenses supported by facts and documents. Inconsistent theories can undermine credibility.

5. Submit a complete counter-affidavit on time

A counter-affidavit is evidence, not merely an argumentative pleading. It should give a clear chronology, identify which allegations are admitted or denied, explain the basis of each denial, and attach the supporting records.

Do not assume that a later trial will cure an incomplete preliminary-investigation response. If documents cannot be obtained before the deadline, consult counsel immediately about the available procedural request.

6. Challenge coercive digital searches lawfully

Government access to devices, accounts, communications, subscriber information, traffic data, or content data is subject to the Constitution, the Cybercrime Prevention Act, and the Rule on Cybercrime Warrants.

Ask for the legal basis and a copy of any warrant or order. Do not physically obstruct officers executing lawful process, but do not casually consent to a broader search than intended. Evidence obtained without the required warrant or beyond its authorized scope may be challenged.

Penalties and possible civil liability

Article 355 of the Revised Penal Code, as amended by Republic Act No. 10951, provides imprisonment or a fine for libel. Section 6 of the Cybercrime Prevention Act generally raises the penalty by one degree when a Revised Penal Code offense is committed through information and communications technology.

The precise imposable penalty depends on the charging theory, applicable amendments, mitigating or aggravating circumstances, and the court’s sentencing determination. Courts have also issued guidance encouraging the judicious use of fines in appropriate libel cases; that guidance does not erase the possibility of imprisonment.

The offended person may also pursue civil damages. Civil liability may be addressed with the criminal case or, when legally available, through a separate civil action. The choice affects prescription, evidence, damages, and procedure, so it should be made deliberately.

A criminal complaint is not a guaranteed method of obtaining a takedown, apology, retraction, or damages. Those objectives may require separate platform, civil, or negotiated remedies.

Common mistakes

Mistakes by complainants

Waiting for negotiations or a platform response while the one-year period runs.
Saving cropped screenshots without URLs, dates, context, or witness details.
Naming a page owner without evidence that the person authored the post.
Treating every insult or negative review as criminal libel.
Filing in a convenient but unsupported venue.
Suppressing context that reveals opinion, privilege, correction, or uncertainty.
Demanding subscriber data directly from a platform without lawful process.
Assuming deletion automatically proves guilt.
Charging both ordinary libel and cyber libel for the same online publication despite the double-jeopardy concern recognized in Disini.

Mistakes by respondents

Ignoring a subpoena or missing the stated counter-affidavit deadline.
Deleting the post, account, messages, or device data before preservation.
Posting new attacks against the complainant or witnesses.
Assuming anonymity, a disclaimer, “allegedly,” or a question mark prevents liability.
Relying on rumor or an unnamed source without preserving corroboration.
Claiming truth without proving good motives and justifiable ends.
Treating personal hostility as the only form of legally relevant malice.
Submitting unsworn denials without supporting evidence.
Giving investigators passwords or broad device access without understanding the warrant, order, or requested consent.

When legal help is urgent

Seek a Philippine lawyer immediately if:

the one-year anniversary of discovery is approaching;
a subpoena, prosecutor’s order, summons, warrant, or information has been received;
police or NBI personnel seek access to a device or account;
an arrest has occurred or bail must be arranged;
the author is unknown and platform records may soon disappear;
the post concerns a public official, journalist, whistleblower, election, official proceeding, or public controversy;
the material was republished, edited, translated, or posted across several jurisdictions;
a child, intimate image, threat, impersonation, hacking, or personal-data exposure is involved;
the complainant or respondent is outside the Philippines; or
criminal and civil cases are being considered at the same time.

The Public Attorney’s Office may be able to assist qualified indigent persons, subject to its governing rules and conflict checks. A private lawyer experienced in criminal procedure, media law, or digital evidence may be appropriate for complex cases.

Frequently asked questions

Can I file because someone insulted me on Facebook?

Possibly, but an insult alone does not automatically establish cyber libel. The post must be evaluated for a defamatory imputation, publication, identification, malice, authorship, and the computer-system element. Context and applicable privileges matter.

Is a screenshot enough?

A screenshot is useful but may not be enough. It can show displayed content, yet still leave disputes about authenticity, completeness, authorship, timing, account control, and alteration. Preserve the URL, full context, witnesses, original files, and device or platform information.

Can I sue an anonymous account?

A complaint may begin with an unidentified author, but the person must eventually be identified and linked to the publication through lawful, admissible evidence. Cybercrime investigators and court-authorized process may be necessary.

Is sharing a defamatory post automatically cyber libel?

No. Disini protects people who merely receive and react to the original post from liability under the cyber-libel and aiding-or-abetting provisions discussed there. A new caption, adoption of the accusation as one’s own, or a materially new publication may require a separate analysis.

Does deleting the post end the case?

No. Deletion does not erase an already completed publication, although it may affect continuing harm, available evidence, or the parties’ positions. Preserve evidence before removal.

Must the complainant first send a demand letter?

A demand letter is not generally an element of cyber libel. It may support settlement or correction, but it should not be assumed to suspend prescription.

Can a private message be cyber libel?

It may be if it was sent to at least one third person and the other elements exist. A message sent only to the person criticized ordinarily lacks publication to a third party, although its contents may implicate other laws.

Can truth defeat the charge?

Truth can be a defense in the circumstances allowed by Article 361, generally together with good motives and justifiable ends. The defense requires proof, not merely the accused’s assertion.

Where is the case filed?

The proper prosecutor and RTC depend on legally significant territorial facts, including where an element occurred, the location and use of relevant computer systems, and where statutory damage was caused. Online accessibility everywhere does not safely justify filing anywhere.

How long do I have to file?

Cyber libel generally prescribes in one year from discovery by the offended party, authorities, or their agents, under Causing v. People. Because the discovery date, interruption, prior proceedings, republication, and the accused’s absence may affect computation, obtain advice and file well before the apparent deadline.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel liability and procedure depend on the exact words, evidence, dates, parties, and locations involved. Official primary sources were checked as of September 19, 2026.