Quick answer

A cyber libel case is filed by submitting a sworn complaint and supporting evidence to the proper city or provincial prosecutor’s office. The complainant must establish a defamatory imputation, publication to another person, identification of the person defamed, malice, use of a computer system, and the respondent’s authorship. The National Bureau of Investigation or Philippine National Police may first help identify an anonymous account or preserve digital evidence, but a law-enforcement investigation is not always required before filing with the prosecutor.

A person accused of cyber libel should not ignore a subpoena. Preserve the account, post, device, sources, and complete conversation; obtain counsel; and submit a sworn counter-affidavit by the date stated in the subpoena. Possible defenses include lack of authorship, publication, identification, defamatory meaning, or malice; truth published for good motives and justifiable ends; privileged communication or fair comment; improper venue; and prescription.

The current controlling rule is especially important: criminal cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. In April 2026, the Supreme Court denied with finality the motions asking it to adopt a longer period. File promptly and do not assume that a demand letter, platform report, barangay complaint, or informal inquiry stops the one-year period. Causing v. People, G.R. No. 258524, April 8, 2026

What Philippine law treats as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act applies the Revised Penal Code’s law on libel when the prohibited act is committed through a computer system or a similar technological means. Common examples include an authored Facebook post, TikTok caption, online article, blog entry, tweet, public comment, or message sent to a group. Republic Act No. 10175

The prosecution must establish these matters:

Defamatory imputation. The words, images, video, or combination of them impute a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. The material was communicated to at least one person other than the person allegedly defamed. A message seen only by its sender and the person insulted ordinarily lacks this element. A group chat or post visible to other people may satisfy it.
Identification. The complainant was named or was reasonably identifiable from the words, images, tags, surrounding facts, or context. It is not always necessary for the post to state the complainant’s complete name.
Malice. As a general rule, a defamatory imputation is presumed malicious unless it is privileged or the applicable constitutional protections require actual malice to be proved. Malice and privilege remain highly dependent on the full context.
Use of a computer system. The publication was made through information and communications technology.
Authorship or responsibility for the publication. The accused must be linked to the authorship of the challenged material, not merely to an account bearing the accused’s name or photograph.

An offensive, rude, exaggerated, mistaken, or embarrassing post is not automatically cyber libel. The prosecution must prove every required element beyond reasonable doubt at trial.

Who can be liable for a post, comment, like, or share?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author, but declared it unconstitutional as applied to people who merely receive a post and react to it. The Court also invalidated the Cybercrime Prevention Act’s provisions on aiding or abetting insofar as they apply to cyber libel.

Accordingly:

Merely liking, reacting to, or sharing someone else’s post is not automatically cyber libel.
A person who writes a separate defamatory comment or adds a new defamatory caption may be treated as the author of that new statement.
A page administrator is not automatically criminally liable merely because the material appeared on a page. The evidence must connect that person to the authorship or legally relevant publication.
The same act cannot be prosecuted simultaneously as both ordinary libel and cyber libel without raising the double-jeopardy problem identified in Disini.

Possible penalties and civil liability

Traditional written libel is punishable under Article 355, as amended by Republic Act No. 10951. Because Section 6 of the Cybercrime Prevention Act raises the penalty by one degree, the imprisonment range for cyber libel is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years.

The Supreme Court has also held that the alternative fine for cyber libel ranges from ₱40,000 to ₱1,500,000. Depending on the circumstances, the court may impose imprisonment, a fine, or both. A fine-only sentence is possible but not automatic. Civil damages may also be awarded when properly pleaded and proved. Penalosa v. Ocampo, G.R. No. 256700, April 25, 2023

Preserve evidence before the post disappears

Digital evidence can be deleted, edited, hidden, or placed behind new privacy settings. Preserve it immediately and lawfully.

Keep the following:

Full-page screenshots showing the account name, profile or page, exact words or images, date and time, reactions, comments, and surrounding context.
The complete URL or permalink, not merely the platform’s home-page address.
A screen recording showing how the post is reached from the account or page.
The original electronic files and unedited screenshots. Keep backup copies without replacing the originals.
The device on which the post or message was received, when practical.
The complete conversation or thread, including earlier statements that explain the context.
The date and circumstances when the complainant, an agent, or an authority first discovered the post.
Names and affidavits of people who personally saw the publication.
Messages, admissions, prior posts, writing patterns, email addresses, phone numbers, or other facts linking the respondent to the account.
Platform reports, takedown notices, replies, demands, corrections, and apologies.
Documents showing actual consequences, such as lost work, cancelled contracts, customer messages, professional complaints, or necessary expenses.
For a defense based on reporting, records consulted before publication, interview notes, source communications, official documents, drafts, and efforts to verify or obtain the other side’s response.

Do not crop away useful context, add annotations to the only copy, alter timestamps, impersonate another user, guess passwords, or enter an account without permission.

Electronic documents must still be authenticated. A printout can qualify as the equivalent of an original if it accurately reflects the data, but the party offering it must establish its integrity and reliability. Rules on Electronic Evidence, A.M. No. 01-7-01-SC

Proving who controlled or authored a social-media account

An account name, profile photograph, or screenshot alone may not conclusively prove authorship because dummy and impersonation accounts are easy to create.

The Supreme Court’s 2025 guideposts allow ownership, access, or authorship to be established through direct or circumstantial evidence, including:

an admission of account ownership, access, or authorship;
a witness who saw the person using the account or composing the message;
information in the post known only to that person or a small group;
distinctive language or writing patterns;
platform, internet-provider, telecommunications, geolocation, or device records;
conduct consistent with the post or message; and
other evidence connecting the person to the account or content.

Platform records and forensic examination are useful but are not indispensable in every case. XXX v. People, G.R. No. 274842, October 22, 2025

How to file a cyber libel complaint

1. Review the complete publication

Quote or reproduce the precise material complained of. Identify which words, image, video, caption, or combination allegedly carries the defamatory meaning. Explain:

what the statement means in its ordinary context;
why it refers to the complainant;
who received or saw it;
why the respondent is believed to be its author;
how a computer system was used; and
whether the material concerned a private dispute, public official, public figure, official proceeding, or matter of public interest.

Avoid filing based only on an isolated screenshot when the full thread changes the meaning.

2. Record the discovery date and file within one year

The one-year criminal prescriptive period begins when the material is discovered by the offended party, the authorities, or their agents—not automatically when it was first uploaded. An online post does not create presumed or constructive notice merely because it was public.

The discovery date is a factual issue. A reaction, comment, threat to sue, forwarded message, or other contemporaneous act may show earlier knowledge. Preserve evidence supporting the true date.

Filing a proper criminal complaint or information interrupts prescription under Article 91. Because an error can permanently bar the case, file well before the anniversary of discovery. Do not assume that deletion and later reappearance, or a simple share by another user, automatically creates a fresh period.

An independent civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. Its filing, venue, and relationship with any criminal case should be reviewed separately.

3. Identify the proper place of filing

A criminal complaint is normally submitted to the prosecutor’s office for preliminary investigation. The eventual court case belongs in a designated Regional Trial Court acting as a cybercrime court.

Under Section 2.1 of the Rule on Cybercrime Warrants, a cybercrime action may be filed where:

the offense or any element occurred;
any part of the computer system used is situated; or
damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of other courts. Libel also has special venue rules intended to prevent harassment through remote, out-of-town cases. Merely alleging that a post could be accessed anywhere in the Philippines is not enough. The complaint and eventual Information should state concrete venue facts.

Venue becomes particularly technical when the complainant is a public officer, the author or platform is abroad, the account is anonymous, or the parties live in different cities. Have counsel confirm the correct prosecutor’s office before filing.

4. Prepare the sworn complaint and attachments

The complaint-affidavit should ordinarily state:

the complainant’s and respondent’s identifying information and addresses, if known;
the exact publication and its URL;
the posting, discovery, and preservation dates;
the account, page, group, website, or platform used;
how the complainant is identified;
the identities of third persons who saw the material;
the factual basis for attributing authorship;
the defamatory meaning and surrounding context;
facts relevant to malice, privilege, or public interest;
the lawful venue basis; and
the relief or investigation requested.

Attach the electronic evidence, witness affidavits, relevant records, and properly marked annexes. The DOJ publishes an official preliminary-investigation requirements page, but verify the current number of copies, fees, filing hours, and any authorized electronic-filing procedure with the particular prosecution office.

5. Seek investigative help when necessary

Republic Act No. 10175 assigns cybercrime enforcement to the NBI and PNP. Their cybercrime units may assist with account attribution, device examination, witness interviews, and lawful requests for platform or subscriber information.

This is especially useful when:

the account is anonymous or impersonating someone;
the content is likely to be deleted;
subscriber, IP, or platform records may be needed;
the evidence is technically complex; or
cyber libel accompanies threats, hacking, identity theft, stalking, extortion, or unlawful disclosure.

A private party cannot simply compel a platform or telecommunications company to disclose protected subscriber or content data. Preservation, disclosure, interception, search, and examination are governed by statutory requirements and judicial warrants. Ask investigators promptly whether a lawful preservation request is warranted. The NBI provides an official cybercrime investigative-assistance procedure.

6. Participate in preliminary investigation

Cyber libel carries a maximum imprisonment exceeding six years and is therefore handled through regular preliminary investigation under the 2024 DOJ-NPS Rules.

The prosecutor evaluates whether there is prima facie evidence with reasonable certainty of conviction. If the case proceeds, the respondent receives a subpoena with the complaint and supporting evidence. The subpoena should provide at least 10 days from receipt before the scheduled preliminary-investigation hearing and submission of the counter-affidavit.

The 2024 rules allow electronic filing and virtual proceedings as alternatives when authorized. Follow the directions of the particular prosecution office; there is no basis to assume that every office accepts documents through an informal email address.

The Supreme Court upheld the DOJ’s authority to issue these rules in Meking v. Secretary of Justice, G.R. No. 280455, November 11, 2025.

7. Act promptly after the prosecutor’s resolution

The prosecutor may dismiss the complaint or approve the filing of an Information in court. Under the 2024 DOJ-NPS Rules, an aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. Further review is governed by the DOJ’s applicable appeal rules and depends on which prosecutor or office issued the resolution.

If an Information has already been filed, a petition for review does not by itself guarantee that court proceedings will stop. The appropriate motion to suspend proceedings may also be necessary. These remedies are technical and should be handled by counsel.

How to defend a cyber libel complaint

Do not ignore the subpoena

Record when and how it was received. The controlling deadline is the date stated in the subpoena, subject to the applicable DOJ rules. Extensions are not automatic and are allowed only when the interests of justice justify them.

Do not replace the counter-affidavit with a bare motion to dismiss. State all factual and legal defenses under oath and attach the supporting evidence. Failure to submit can result in the complaint being resolved solely on the complainant’s evidence.

Preserve evidence instead of deleting it

Keep the challenged content, complete thread, account records, login alerts, source files, drafts, research, and devices. Deletion may destroy evidence that supports context, truth, privilege, non-authorship, or an earlier discovery date.

If the account was hacked, impersonated, or accessed by another person, preserve:

security alerts and password-reset notices;
login-history or device-session records;
reports made to the platform;
police, NBI, or help-desk reports;
evidence of who else had access;
travel, work, or device records showing the accused’s location; and
proof of earlier impersonation or compromise.

Do not fabricate a hacking defense. Authorship can be proved circumstantially even without platform records.

Examine every required element

A strong counter-affidavit deals separately with each element:

No defamatory imputation: The statement does not impute a crime, vice, defect, or discreditable circumstance when read fairly and in context.
No publication: No third person received or understood the material.
No identification: A reasonable reader could not identify the complainant.
No authorship: The accused neither controlled the account nor wrote or published the statement.
No cyber element: The prosecution cannot show the relevant use of a computer system.
No malice or actual malice: The communication was privileged, fair comment, made pursuant to a duty, or published without knowledge of falsity or reckless disregard where that higher standard applies.
Prescription: More than one year elapsed from provable discovery before the proper criminal proceeding was instituted.
Improper venue: The complaint or Information does not allege and support a lawful venue.
Mere reaction or share: The accused merely received or reacted to another person’s post and did not author the challenged imputation.
Double prosecution: The same act is being charged as both ordinary and cyber libel contrary to Disini.

Truth, opinion, privilege, and public-interest speech

Truth is important but is not always enough by itself

Article 361 permits truth to be presented in a criminal libel case. As a general rule, acquittal based on truth also requires a showing that the publication was made with good motives and for justifiable ends.

Proof of truth for an imputation that is not a crime is restricted unless it concerns a government employee and facts relating to the discharge of official duties. The precise operation of these rules changes when constitutional protection for public-interest speech applies. Revised Penal Code provisions discussed in Flor v. People

Qualified privilege can defeat the presumption of malice

Article 354 recognizes, among others:

a private communication made in performing a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of a non-confidential official proceeding or official act.

The communication must be limited to proper recipients and made in a manner reasonably connected to the duty. Posting an accusation publicly to thousands of people may exceed what the duty required.

Fair comment on matters of public interest may also be privileged. An opinion reasonably inferred from disclosed or established facts receives greater protection than a disguised assertion of invented fact. Qualified privilege is not absolute: it may be defeated by proof of actual malice.

Public officials and public figures face a higher malice standard in protected contexts

When the publication concerns a public official’s official conduct, a public figure, or a matter of legitimate public interest, the prosecution may be required to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was true.

Mere error, inaccuracy, poor investigation, or negligence is not automatically actual malice. Reckless disregard ordinarily requires evidence that the author seriously doubted the truth or had a high degree of awareness of probable falsity. The protection is not a license to fabricate accusations or publish them despite obvious reasons to doubt them. Daquer v. People, G.R. No. 206015, June 30, 2021

What happens if an Information is filed in court?

The filing of a complaint with the prosecutor does not itself mean that the respondent will be arrested. If the prosecutor files an Information, the RTC independently evaluates probable cause for issuing a warrant.

Because cyber libel is not punishable by reclusion perpetua, life imprisonment, or death, bail is generally a matter of right before conviction. The amount and conditions are set by the court. A person who learns of an Information or warrant should have counsel verify it directly with the court and arrange the proper surrender and bail procedure rather than evade service.

At trial, the prosecution must prove guilt beyond reasonable doubt. The defense may challenge the admissibility and authentication of electronic evidence, cross-examine witnesses about discovery and authorship, and present its own witnesses, records, devices, sources, and expert evidence.

Common mistakes to avoid

Relying on old claims that cyber libel prescribes in 12 or 15 years. The current controlling ruling is one year from discovery.
Waiting for the platform to answer before filing near the prescriptive deadline.
Treating a demand letter or barangay report as guaranteed interruption of prescription.
Filing wherever the post happened to be viewed without a valid venue basis.
Saving only a cropped screenshot with no URL, account details, date, or surrounding context.
Assuming that an account name or photograph conclusively proves who authored the post.
Assuming that truth automatically ends the case without examining good motive, justifiable purpose, privilege, and public-interest rules.
Publicly reposting the accusation “for evidence,” thereby increasing the harm.
Deleting the account, thread, messages, research, or device data after receiving a complaint.
Ignoring the subpoena or filing an unsworn denial without supporting evidence.
Naming every person who liked or shared a post despite Disini.
Threatening criminal prosecution solely to force payment or an unrelated concession.
Accessing another person’s account without authority while trying to collect evidence.

When legal help is urgent

Consult a Philippine criminal lawyer immediately when:

the one-year anniversary of discovery is approaching;
a subpoena, prosecutor’s resolution, Information, or warrant has been received;
the account is anonymous, compromised, or likely to be deleted;
the dispute involves a journalist, public official, public figure, employer, school, or regulated profession;
the post relies on confidential sources or official records;
the author, platform, computer system, or complainant is outside the Philippines;
several related complaints have been filed in different cities;
the publication includes threats, stalking, hacking, identity theft, doxxing, intimate images, extortion, or a child; or
a search, seizure, examination, or disclosure of device or account data is requested.

Frequently asked questions

Can a case be filed if the post has already been deleted?

Yes, if admissible evidence of the post, publication, authorship, and other elements was preserved. Deletion may make proof harder, so witnesses, original files, URLs, account records, and lawful platform or device evidence become important.

Is a private group chat covered?

It can be. Publication exists when a defamatory statement is communicated to a third person. A group chat may satisfy that element even if it is not open to the general public. Privilege and context must still be examined.

Is a one-to-one message sent only to the person insulted cyber libel?

Ordinarily, it lacks publication because no third person received it. Other offenses may nevertheless apply depending on the words and circumstances.

Can a company file a cyber libel complaint?

Potentially. Article 353 protects both natural and juridical persons, but the company must still be identifiable and must establish the other elements.

Can I file against an anonymous account?

A complaint or investigative request may be initiated, but the case cannot rest on speculation. NBI or PNP assistance may be needed to develop lawful evidence of identity, control, or authorship.

Does an apology or affidavit of desistance automatically dismiss the case?

No. Cyber libel is a public offense prosecuted in the name of the People of the Philippines. A retraction, apology, settlement, or affidavit of desistance may affect the evidence, damages, or prosecutorial assessment, but it does not automatically compel dismissal.

Does every new share restart the one-year period?

No. Prescription depends on the charged act and the date it was discovered. A mere share by another user should not automatically be treated as a fresh publication by the original author. A separately authored defamatory caption or later republication by the accused requires its own factual analysis.

Can the complainant file both ordinary libel and cyber libel for the same post?

The same online act should not be punished under both provisions. Disini held that dual prosecution for ordinary libel and online libel based on the same act violates the protection against double jeopardy.

Must the complainant first demand a retraction?

No. A prior demand is not an element of cyber libel. It may be useful for correction, settlement, proof of notice, or mitigation of harm, but it should not be allowed to consume the one-year filing period.

Official sources

This article provides general legal information, not advice for a particular case. Cyber libel outcomes depend on the exact words, context, evidence, parties, dates, and venue. Consult a Philippine lawyer promptly for case-specific advice. Laws and official sources were checked as of 25 July 2026.