Quick answer

To file a cyber libel case, preserve the online material and its digital context, determine the date it was actually discovered, and file a sworn complaint with the proper City or Provincial Prosecutor’s Office—normally within one year from discovery. The complaint must identify the original author, reproduce the allegedly defamatory statement, and present admissible and credible evidence covering every element of libel.

To defend a case, do not ignore a subpoena. Obtain the complete complaint and attachments, preserve your own records, and submit a detailed counter-affidavit addressing authorship, publication, identification, defamatory meaning, malice, privilege, truth and motive, prescription, venue, and the reliability of the digital evidence.

Cyber libel remains a criminal offense under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, applying the Revised Penal Code’s rules on libel to publication through a computer system.

What the prosecution must prove

Cyber libel has the traditional elements of libel, plus use of a computer system or similar information and communications technology. The prosecution must establish:

A defamatory imputation. The post, message, video, caption, article, image, or other material imputes a crime, vice, defect, act, omission, condition, status, or circumstance tending to cause dishonor, discredit, or contempt.
Publication. At least one person other than the person defamed received or understood the statement. A public Facebook post is not required; publication in a group chat, private online group, email thread, or restricted account may be enough if a third person saw it.
Identification. The complainant was named or was reasonably identifiable from the words, images, surrounding circumstances, or information known to the audience. A person need not always be named, but vague statements about an unidentifiable group may be insufficient.
Malice. The applicable kind of malice depends on the complainant and the nature of the communication.
Authorship through a computer system. The respondent authored the allegedly defamatory online statement. An account name or screenshot alone does not necessarily prove who controlled the account or created the material.

The Supreme Court summarized these elements and the governing standards in Disini v. Secretary of Justice.

The statement must be evaluated as a whole and in context. Adding “allegedly,” using quotation marks, posing an accusation as a question, or describing it as an “opinion” does not automatically prevent liability if an ordinary reader would understand it as asserting a damaging fact.

General rule on malice—and important exceptions

For defamatory statements against a private person, Article 354 of the Revised Penal Code generally presumes malice unless the accused shows good intention and a justifiable motive. That presumption does not eliminate the prosecution’s duty to establish the other elements.

Different rules apply in important situations:

Public officials and public figures

When the complainant is a public official or public figure and the statement concerns a matter within the protected scope of public discussion, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Reckless disregard requires more than ordinary or even gross negligence; the evidence must support a finding that the author entertained serious doubts about the statement’s truth.

Not every statement about a public employee automatically receives this protection. Courts consider the person’s role, the subject of the statement, and whether it relates to public duties or a legitimate matter of public concern.

Privileged communications

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty.
A fair and true report, made in good faith and without added comments, of a nonconfidential judicial, legislative, or other official proceeding, statement, or act of a public officer.

The privilege is not a license to publish unsupported accusations to an unnecessarily broad audience. Excessive publication, irrelevant insults, material inaccuracies, or proof of actual malice may defeat a qualified privilege.

Fair comment on matters of public interest may also be protected, depending on its factual basis, language, purpose, and context.

Truth is not always enough by itself

Under Article 361, truth is a defense in a criminal libel prosecution when the accused also proves that publication was made with good motives and for justifiable ends. For an imputation that does not constitute a crime, proof of truth is generally not admitted unless the statement concerns a government employee and facts related to official duties.

A defense should therefore document not only why the statement was true or reasonably supported, but also why publishing it served a proper purpose and why the scope and wording were justified.

Who may be charged

In Disini, the Supreme Court upheld cyber libel as to the original author, but declared it unconstitutional as applied to people who merely receive and react to a post. It also invalidated aiding or abetting liability under Section 5 insofar as it applies to cyber libel.

Accordingly:

Merely liking, receiving, or making a simple reaction to another person’s post is not cyber libel.
Merely using a platform’s share function is not, by itself, a sound basis for charging the user as an aider or abettor.
A person who adds a new defamatory caption, accusation, comment, narration, or edited presentation may become the original author of that new material.
Account ownership does not conclusively prove authorship. Investigators should examine access records, admissions, devices, account-control evidence, witnesses, and surrounding circumstances.
Liability of an editor, publisher, company officer, or juridical person requires a separate, fact-specific analysis. Position or employment title alone should not substitute for proof of participation and the applicable statutory requirements.

The one-year filing deadline

The controlling rule is now clear: cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents.

The Supreme Court adopted the one-year period in its 2023 decision in Causing v. People and reaffirmed it on April 8, 2026 in its resolution on the parties’ motions for reconsideration.

Important qualifications apply:

The period does not necessarily begin on the original posting date. It begins upon actual discovery, unless posting and discovery occurred on the same day.
There is no automatic legal presumption that a person discovered a post immediately merely because it was publicly available online.
The filing of the criminal complaint with the proper prosecutor interrupts the running of prescription.
If proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, Article 91 may cause the period to run again.
The period does not run while the offender is absent from the Philippines, subject to the proper application of Article 91.
Prescription is often a factual defense. The parties may need evidence of the precise discovery date and the events that interrupted or restarted the period.

Record the discovery date carefully. Preserve the message that first brought the post to the complainant’s attention, the sender’s details, timestamps, and an affidavit from the person who found or forwarded it.

Do not wait until the last few days. Venue questions, incomplete affidavits, office closures, and missing evidence can jeopardize a complaint.

Where the case should be filed

A private complainant ordinarily begins by filing a complaint-affidavit with the City or Provincial Prosecutor’s Office corresponding to the proper territorial venue. The prosecutor—not the complainant—files the Information in court if the required evidentiary standard is met.

Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 is filed before the designated cybercrime court of the province or city:

Where the offense or any of its elements occurred;
Where any part of the computer system used is situated; or
Where damage to a natural or juridical person occurred.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. The Supreme Court discussed this rule in Henares v. Tieng.

Venue must rest on concrete facts. The mere assertion that an online article could be accessed in a particular city should not be treated as an unlimited choice of venue. The complaint and eventual Information should state the facts connecting the offense, computer system, or reputational damage to the chosen place.

Philippine jurisdiction may still exist when the author was abroad, including circumstances identified in Section 21 of Republic Act No. 10175. Cross-border cases, however, usually require prompt assistance from investigators and careful analysis of jurisdiction, service, evidence, and enforcement.

Evidence to preserve immediately

Capture the evidence before requesting deletion, blocking the account, or sending a demand. Preserve:

Full-page screenshots showing the exact words, images, account name, date, time, reactions, comments, and surrounding conversation;
The complete URL or platform-specific link—not only a cropped screenshot;
Screen recordings showing how the post was located and opened;
A downloaded or exported copy in its original available format;
The original message, email, image, audio, or video file and available metadata;
The device used to view or create the material;
Account profile information, usernames, account IDs, prior names, and public contact details;
Witness affidavits explaining who saw the material, when they saw it, and how they recognized the complainant;
Evidence linking the respondent to the account and the particular post;
The message or event establishing the date of discovery;
Earlier and later versions of an edited post;
Research files, official records, source communications, drafts, and fact-checking records relevant to truth, good faith, or actual malice;
Proof of actual effects, such as lost clients, cancelled contracts, disciplinary action, threats, or messages showing reputational harm.

Keep original files unchanged. Work from copies and record who collected each item, when, from what device, and by what method. Screenshots may be useful, but a cropped or unexplained image can be challenged as incomplete, altered, unauthenticated, or disconnected from the respondent.

If platform or service-provider records may disappear, ask the NBI Cybercrime Division, the PNP Anti-Cybercrime Group, or counsel about a lawful preservation request. Section 13 of Republic Act No. 10175 provides for preservation of subscriber information and traffic data for at least six months from the transaction and preservation of specified content data for six months from a law-enforcement order, with a possible one-time six-month extension. Disclosure of protected data ordinarily requires the appropriate court warrant.

The NBI Cybercrime Division’s official service page explains its investigative-assistance process. Reporting to the NBI is useful where authorship is disputed, an account is anonymous, forensic examination is needed, or provider records must be preserved—but it does not replace timely filing with the proper prosecutor.

How to file the complaint

1. Map the facts to every element

Before filing, identify:

The exact allegedly defamatory words or material;
Their full context and meaning;
The person defamed and how readers identified that person;
The third parties who saw or received the material;
The original author and evidence of authorship;
The computer system or online platform used;
Facts showing malice or, where required, actual malice;
The date and manner of discovery;
The factual basis for venue; and
The evidence available to authenticate and present each item at trial.

2. Prepare a detailed complaint-affidavit

The sworn complaint should narrate facts from personal knowledge, reproduce or attach the exact publication, and explain each exhibit. Avoid conclusions such as “the respondent committed cyber libel” without the supporting facts.

Include the respondent’s complete and last known address when available. An inaccurate or deliberately incomplete address may prevent proper notice and create serious due-process problems.

Attach the complainant’s and witnesses’ affidavits, the Investigation Data Form, and organized supporting evidence. Use an exhibit index and retain a complete stamped receiving copy.

The DOJ’s current filing checklist for preliminary-investigation complaints lists two copies of the Investigation Data Form and five copies—plus one for each respondent—of the complaint-affidavit, witness affidavits, and supporting documents. Confirm the receiving office’s current local requirements before filing.

3. File in the proper prosecution office

A cyber libel charge carries a maximum imprisonment exceeding six years, so it undergoes regular preliminary investigation under DOJ Department Circular No. 15, series of 2024.

The current DOJ-NPS standard is prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, capable of preservation and presentation, and sufficient—if left uncontroverted—to establish every element and the respondent’s identity.

Filing at the barangay is not a substitute. Cyber libel falls outside the ordinary Katarungang Pambarangay penalty limits.

4. Monitor the preliminary investigation

If the complaint is sufficient, the prosecutor will issue a subpoena and provide the complaint and supporting evidence to the respondent. The respondent may submit a counter-affidavit and supporting affidavits or documents.

The prosecutor may hold a physical or virtual clarificatory hearing, require additional evidence, or issue subpoenas for material records or testimony. Preliminary investigation is not a trial, and the parties do not conduct ordinary cross-examination.

Under the 2024 DOJ-NPS rules:

The investigating prosecutor generally has 60 calendar days from assignment to resolve a preliminary-investigation complaint.
A maximum 30-day extension is allowed for specified circumstances such as complex issues, countercharges, consolidation, or reassignment.
A party seeking reconsideration must file a motion within 15 days from receipt of the resolution.

These administrative periods do not guarantee automatic dismissal when an office acts late. Keep records of all filing, assignment, hearing, and receipt dates.

5. Understand what happens next

If the complaint is dismissed, the aggrieved party may seek reconsideration and, when available, a petition for review under the applicable DOJ rules. If an Information is filed, any petition for review should be accompanied by the appropriate request to suspend court proceedings; filing an administrative review does not automatically stop the criminal case.

If the prosecutor approves the charge, the Information is filed in the proper designated Regional Trial Court. The judge independently evaluates probable cause and may dismiss the case, require additional evidence, or issue a warrant of arrest. Filing a complaint with the prosecutor does not itself produce an arrest warrant.

How to defend a cyber libel complaint

Act as soon as the subpoena arrives

Note the exact date and manner of receipt. The controlling deadline is the date stated in the subpoena or prosecutor’s order. Immediately obtain:

The complaint-affidavit;
Every witness affidavit;
All screenshots, files, storage media, and other attachments;
Any supplemental submission;
The Investigation Data Form and stated venue facts; and
The complete docket number and hearing schedule.

Do not replace a substantive counter-affidavit with a bare motion asking for dismissal unless counsel determines that the current rules and circumstances permit the chosen procedure. If a deadline cannot reasonably be met, request an extension before it expires and obtain a written order.

Answer the case element by element

A useful defense review asks:

Authorship: Did the respondent write or upload the statement? Who controlled the account? Was it hacked, impersonated, shared, automatically generated, or managed by several people?
Publication: Did any person other than the complainant receive or understand it?
Identification: Could readers reasonably identify the complainant?
Defamatory meaning: Does the entire context actually impute a discreditable fact, or is it protected criticism, parody, hyperbole, or nonactionable opinion?
Malice: Is malice presumed, rebutted, or required to be proved as actual malice?
Privilege: Was the communication made pursuant to a legal, moral, or social duty, or was it a fair and true report of a nonconfidential official proceeding?
Truth and purpose: What admissible evidence establishes truth, good motives, and justifiable ends?
Public-interest speech: Is the complainant a public official or public figure, and does the statement concern official conduct or a matter of public concern?
Prescription: When was the material actually discovered, and when was the complaint filed? Is the alleged discovery date credible and supported?
Venue: Do the complaint and evidence connect the offense, computer system, or damage to the chosen province or city?
Digital reliability: Are the screenshots complete and authentic? Do metadata, URLs, source files, or testimony connect them to the accused?
Retroactivity: Was the alleged online publication made before the Cybercrime Prevention Act took effect? A pre-effectivity post cannot be punished retroactively merely because it remained accessible.

Support denials with evidence. Preserve devices, account logs, security alerts, travel records, drafts, source materials, official documents, and witnesses. A general denial is usually weaker than a documented explanation.

Do not delete, overwrite, fabricate, or coach evidence. Do not pressure the complainant or witnesses. Avoid reposting the accusation while defending yourself; a new authored publication may create a separate issue.

Possible penalties and civil exposure

For cyber libel, the imprisonment prescribed is one degree higher than for traditional written libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

A fine may be imposed instead of imprisonment, or together with it. Applying Republic Act No. 10951 and Article 75 of the Revised Penal Code, the Supreme Court held that the fine for online libel ranges from ₱40,000 to ₱1,500,000. It also confirmed that a trial court may, in its discretion and based on the circumstances, impose a fine alone. Imprisonment nevertheless remains legally available. See People v. Soliman.

Cyber libel is bailable before conviction under the ordinary rules because it is not punishable by reclusion perpetua or life imprisonment. The court determines the amount and conditions of bail.

Criminal liability may be accompanied by civil damages. Article 33 of the Civil Code also recognizes an independent civil action for defamation, proved by preponderance of evidence. Civil actions for defamation are generally subject to a one-year prescriptive period, so a complainant considering civil relief should seek advice promptly.

A retraction, apology, correction, deletion, or affidavit of desistance may affect damages, credibility, prosecutorial assessment, or sentencing, but it does not automatically erase a completed offense or require dismissal. Once a criminal case is filed, it is prosecuted in the name of the People of the Philippines.

Common mistakes

Assuming the one-year period always runs from the posting date instead of actual discovery;
Waiting for a platform’s takedown process before preserving evidence or filing;
Submitting only cropped screenshots without URLs, context, source files, or authenticating witnesses;
Charging every person who liked, received, or simply shared a post;
Treating account ownership as conclusive proof of authorship;
Filing in a convenient city without concrete venue facts;
Omitting the exact words complained of or failing to explain how the complainant was identifiable;
Assuming truth alone is an absolute defense;
Assuming “opinion,” “allegedly,” or a question mark automatically prevents liability;
Publicly repeating the accusation during the dispute;
Ignoring a prosecutor’s subpoena or relying on an informal promise that the complainant will withdraw;
Deleting devices, messages, drafts, or account data after receiving notice of a complaint; and
Expecting an NBI or police report, demand letter, or barangay proceeding by itself to interrupt prescription.

When legal help is urgent

Consult a Philippine criminal lawyer immediately when:

The one-year prescriptive period is close to expiring;
A prosecutor’s subpoena or court order has been received;
A warrant of arrest, search warrant, disclosure warrant, or examination order has been issued;
The account is anonymous or service-provider records may soon be deleted;
The author, server, or important witness is outside the Philippines;
Several posts, complainants, respondents, or possible criminal offenses are involved;
The statement concerns a public official, journalist, whistleblower, confidential source, or pending official proceeding;
The digital file may have been edited, fabricated, or generated through impersonation;
There are accompanying threats, stalking, doxxing, intimate-image abuse, identity theft, or danger to personal safety; or
An Information has already been filed in court.

If the respondent cannot afford private counsel, eligibility for assistance from the Public Attorney’s Office should be checked promptly. A person facing arrest should not evade authorities; counsel can verify the warrant, arrange lawful surrender when appropriate, and prepare bail documents.

Frequently asked questions

Is a demand letter required before filing?

No. A demand for deletion, correction, or apology is not an element of cyber libel and is not generally a prerequisite to a criminal complaint. It may still be strategically useful, but preserve the evidence first and do not let negotiations consume the one-year period.

Can a case continue if the post was deleted?

Yes. Deletion does not undo publication. The case will depend on the quality and admissibility of preserved copies, testimony, platform records, admissions, and other evidence.

Is one screenshot enough?

Sometimes it may help establish a prima facie case, but it is frequently challenged. A stronger submission includes the URL, full context, source or native file, collection details, account-identification evidence, and testimony from someone who personally accessed the material.

Is a private message cyber libel?

If the message was sent only to the person defamed, the publication element may be absent. If it was sent to another person, copied to others, or posted in a group chat, publication may exist. Different crimes or civil remedies may apply even when libel’s publication element is missing.

Can I be charged for sharing another person’s post?

A simple platform reaction or share is not punishable as aiding or abetting cyber libel under Disini. But adding your own defamatory caption, accusation, edited image, or narration can make you the original author of new material.

Can criticism of a government official be cyber libel?

Legitimate criticism of official conduct and public affairs receives strong constitutional protection. Criminal liability involving a public official or public figure generally requires proof of actual malice. False factual accusations published with knowledge of falsity or serious doubts about their truth may still be punishable.

Does an apology automatically end the case?

No. It may support settlement efforts, mitigation, or a request for leniency, but the prosecutor or court is not automatically bound to dismiss a criminal case.

Can an anonymous account be investigated?

Yes, but lawful identification may require technical investigation, preservation of provider data, and court-issued cybercrime warrants. Report the matter promptly to a qualified cybercrime law-enforcement unit and preserve everything already available.

Will a complaint immediately result in arrest?

No. A prosecutor first evaluates the complaint through preliminary investigation. If an Information is later filed, the judge independently determines whether probable cause exists for a warrant. A respondent should nevertheless act immediately upon receiving official process.

Official sources

This article provides general legal information, not advice for a particular case and not a substitute for reviewing the actual post, affidavits, digital files, dates, and court or prosecutor records with a Philippine lawyer. Laws and procedures were checked against official sources through August 2, 2026.