Quick answer

To file a cyber libel case, act quickly: preserve the online material and proof of authorship, determine the proper venue, and file a sworn complaint-affidavit with the appropriate City or Provincial Prosecutor’s Office. Assistance from the NBI Cybercrime Division or PNP Anti-Cybercrime Group may be useful when the author is unknown or platform records are needed, but a police report or platform complaint is not the same as filing the criminal complaint.

To defend a case, do not ignore a subpoena, delete evidence, contact witnesses improperly, or rely on a bare denial. Obtain counsel promptly and submit a sworn, evidence-supported counter-affidavit addressing authorship, publication, identification, defamatory meaning, malice, privilege, venue, prescription, and the reliability of the electronic evidence.

Cyber libel generally prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents—not automatically from the posting date. The Supreme Court affirmed this rule with finality in April 2026. Because the discovery date and interruption of prescription can be disputed, neither side should wait until the deadline is close.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the material is published through a computer system or a comparable technological means.

The prosecution must establish:

A defamatory imputation concerning a person—such as an accusation of a crime, vice, defect, or conduct tending to cause dishonor, discredit, or contempt;
Publication or communication of that imputation to at least one person other than the person defamed;
Identification of the person allegedly defamed, either by name or through details that reasonably allow others to recognize the person;
Malice, whether presumed under the general rule or proved as actual malice when the law requires it;
Use of a computer system or information and communications technology; and
The accused’s responsibility for publishing the material.

The material may be text, an image with a caption, a video, a meme, a comment, an online article, or another digital communication. Courts assess the complete statement and its context—not merely an isolated word or screenshot.

A message sent only to the person allegedly defamed ordinarily lacks publication to a third person. A group chat, copied email, public post, or message sent to someone else may satisfy publication. Who forwarded a private message, and whether the original sender intended or caused wider circulation, are factual questions.

Who may be held responsible?

The Supreme Court upheld cyber libel principally as applied to the original author of the defamatory online statement. In Disini v. Secretary of Justice, it invalidated the use of the Cybercrime Prevention Act’s general aiding-or-abetting provision against people who merely receive and react to online libel, including through common online actions such as liking or sharing.

That protection has limits. A person who adds a new defamatory caption, accusation, or comment may become the original author of that new statement. Editors, business managers, or people who actually cause publication may also face questions under Article 360 of the Revised Penal Code, depending on their proven participation.

Ownership of an account is relevant but does not automatically prove who created a particular post. Conversely, a simple claim that an account was hacked may carry little weight without supporting records, prompt reports, security alerts, device evidence, or credible testimony.

A person should not be prosecuted under both ordinary libel and cyber libel for the same single act of online publication. Disini held that double prosecution for the same libelous act would offend the rule against double jeopardy.

Statements that may be protected

Not every harsh, embarrassing, or offensive online statement is criminal libel. Possible defenses include the following.

No defamatory factual imputation

The statement may be criticism, satire, rhetorical exaggeration, or an opinion that does not assert or imply a false defamatory fact. Labels such as “opinion” or “allegedly,” however, do not automatically protect a post if its substance communicates a factual accusation.

The complainant was not identifiable

The name need not appear if readers familiar with the circumstances could identify the person. But a vague statement about a large, undefined group may fail the identification requirement. The relevant question is whether people other than the complainant reasonably understood the statement to refer to that person.

No publication to a third person

A communication known only to its author and the person concerned generally lacks the required publication. Evidence that other people actually received, viewed, or heard it may therefore be important.

Lack of authorship or participation

The respondent may show that another person controlled the account or device, that the exhibit does not correspond to the respondent’s account, or that the prosecution cannot reliably connect the respondent to the publication. Account access records, security notices, device records, travel or work records, and contemporaneous reports may be relevant.

Privileged communication

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments, of specified official proceedings or acts of public officers.

Other privileges have developed through jurisprudence, particularly for fair reporting and good-faith discussion of matters of public interest. A privilege is not a license to invent facts or publish accusations in bad faith. Once qualified privilege applies, the complainant generally must prove actual malice.

Public officials, public figures, and matters of public interest

When the statement concerns a public official, public figure, or a matter of legitimate public concern, constitutional protection for speech may require proof of actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Recklessness requires more than ordinary or even gross negligence; the evidence must support a high degree of awareness of probable falsity or serious doubts about the statement’s truth.

This standard does not protect knowing fabrications, retaliatory accusations, or allegations published while deliberately disregarding obvious reasons to doubt a source.

Truth, good motives, and justifiable ends

Truth is important, but it should not be treated as an automatic defense in every criminal libel case. Articles 354 and 361 impose conditions on when truth may be proved and require good motives and justifiable ends for acquittal. The rules differ when the imputation concerns a crime or the official duties of a government employee.

A respondent relying on truth should preserve the documents, recordings, public records, witnesses, and research that existed when the statement was published. Evidence obtained or manufactured only after publication may not establish the publisher’s original state of mind.

Prescription

In Causing v. People, resolved with finality on April 8, 2026, the Supreme Court held that cyber libel prescribes in one year, applying Articles 90 and 91 of the Revised Penal Code.

The one-year period begins upon discovery by the offended party, the authorities, or their agents. Online publication does not create a legal presumption that the complainant discovered the post immediately. The discovery date must be established through evidence.

The filing of the proper complaint or information interrupts prescription under Article 91. Current Supreme Court doctrine also treats filing with the prosecution office as interrupting prescription prospectively in cases handled through prosecutorial investigation. Even so, questions about the proper complaint, venue, dates, dismissal, and recommencement of the period can be decisive. File substantially before the deadline and obtain advice based on the actual records.

How to preserve online evidence

Preserve evidence before requesting removal or confronting the author. A screenshot alone may omit context and may later be challenged.

Keep, where available:

Full-page screenshots showing the account name, exact text or media, date, time, reactions, comments, and surrounding thread;
The complete URL or other unique post identifier;
A screen recording showing how the post is accessed from the profile or conversation;
The original downloaded image, video, audio, email, or message—not only a forwarded or compressed copy;
The device on which the post or message was received;
Platform notifications, emails, security alerts, and downloaded account data;
The date and circumstances of first discovery, including who sent the link and the original message or email;
Earlier and later versions of an edited post;
Evidence connecting the account to its alleged user, such as admissions, prior communications, or publicly visible account details;
Names and affidavits of people who personally saw the material and understood whom it referred to;
Evidence of harm, such as cancelled contracts, customer messages, workplace action, threats, or treatment records; and
For the defense, drafts, research notes, source materials, communications with sources, and records showing good-faith verification.

Keep an untouched copy of every original file. Record when and how each item was obtained. A lawyer or forensic specialist may compute file hashes or create a formal preservation record where authenticity is likely to be contested.

Under the Rules on Electronic Evidence, the party offering a private electronic document bears the burden of authenticating it. A printout can be treated as an original if it accurately reflects the electronic data, but it must still satisfy the rules on admissibility, integrity, and reliability. A witness with direct knowledge should be prepared to explain how the evidence was created, obtained, and preserved.

Do not hack an account, impersonate another person, install spyware, steal a device, or obtain private platform records unlawfully. Subscriber, traffic, and content data may require law-enforcement process and a court-issued cybercrime warrant.

How to file a complaint

1. Confirm that the legal elements are present

Identify the exact words, image, audio, or video complained of. Explain:

What defamatory fact it communicates;
Why it refers to the complainant;
Who received or viewed it;
Why the respondent is believed to be responsible;
When and how it was discovered;
What computer system or online service was used; and
What facts show malice or answer an expected claim of privilege.

Do not base the complaint merely on feeling insulted. The prosecutor must find prima facie evidence with reasonable certainty of conviction for every required element.

2. Determine the correct venue

Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed before the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used is situated; or
Where any part of the damage to the natural or juridical person took place.

The first court in which the criminal action is validly filed acquires jurisdiction to the exclusion of the others. The corresponding prosecution office should ordinarily handle the preliminary investigation.

Mere ability to access a website from a chosen location should not be treated as an unlimited right to file anywhere. The complaint and eventual Information must allege a concrete, supportable basis for venue. Residence, office location, device location, server or system facts, and where reputational damage occurred must be evaluated against the actual evidence.

3. Consider investigative assistance

The NBI Cybercrime Division or PNP Anti-Cybercrime Group may assist when:

The account is anonymous or fictitious;
Platform or subscriber records may be needed;
There is a risk that data will disappear;
The incident involves hacking, threats, extortion, impersonation, intimate images, or other possible offenses; or
Forensic examination is necessary.

A private demand letter cannot compel a platform to disclose protected subscriber or content data. Law-enforcement authorities may seek preservation and disclosure through the procedures authorized by the Cybercrime Prevention Act and the Rule on Cybercrime Warrants.

4. Prepare the complaint-affidavit

Under DOJ Department Circular No. 15, series of 2024, a regular preliminary investigation is initiated by filing:

The original sworn complaint-affidavit;
Two duplicate copies for the official file;
One additional copy for each respondent;
A completed NPS Investigation Data Form;
Witness affidavits; and
All supporting evidence.

The complaint-affidavit should state the parties’ names and addresses, the date and place of the offense, and a clear chronological account of how it was committed. It must be sworn before a prosecutor or another authorized government official, or, when they are unavailable, a notary public.

Check the receiving office’s current filing, paper, electronic-copy, and identification requirements before submission. E-filing and virtual proceedings are alternatives under the DOJ rules but depend on the facilities and instructions of the particular prosecution office; do not assume that emailing documents alone completes filing.

5. Do not delay for a demand letter or barangay proceeding

A takedown request, correction demand, cease-and-desist letter, platform report, police blotter, or barangay complaint is not a statutory prerequisite to a cyber libel complaint and should not be assumed to interrupt prescription.

Barangay conciliation is generally not required because the prescribed imprisonment for cyber libel exceeds the Katarungang Pambarangay penalty limit. A voluntary correction, apology, or settlement discussion may still be useful, but it must not consume the filing period.

6. Follow the preliminary investigation

The prosecutor will evaluate the complaint and, if warranted, issue a subpoena requiring the respondent to submit a counter-affidavit. The complainant may be allowed to file a reply-affidavit, followed by a rejoinder from the respondent.

The DOJ rules allow a motion for reconsideration of a regular preliminary-investigation resolution within 15 calendar days from receipt. Further review may be available under the applicable DOJ appeal rules, but the proper reviewing office and deadline depend on who issued the resolution and whether an Information has already been filed. Seek counsel immediately upon receipt rather than waiting for the period to expire.

How to respond if you are accused

1. Treat a subpoena as urgent

A subpoena from a prosecutor is not yet a conviction or necessarily an arrest warrant. It is, however, a formal opportunity to present evidence before an Information is filed.

The subpoena should provide sufficient time—generally at least 10 days from receipt—to submit a counter-affidavit. Follow the actual deadline stated. Extensions are exceptional under the 2024 DOJ rules and, when justified, may not exceed 10 days. Do not assume an informal request automatically extends the period.

2. Obtain the complete complaint and exhibits

Check whether you received every annex. Identify:

The exact statement charged;
The alleged publication date and discovery date;
The account and URL;
The claimed basis for authorship;
The people who allegedly saw it;
The complainant’s basis for identification;
The venue allegations; and
Any missing, cropped, altered, or unauthenticated exhibits.

3. Prepare a fact-specific counter-affidavit

A counter-affidavit should answer the evidence paragraph by paragraph and attach documents and witness affidavits. Depending on the facts, address:

Lack of authorship, account control, or participation;
Absence of publication to a third person;
Failure to identify the complainant;
Non-defamatory meaning in full context;
Truth, source records, good motives, and justifiable ends;
Qualified privilege or fair comment on a matter of public interest;
Absence of actual malice;
Defective authentication or incomplete electronic evidence;
Wrong venue;
Publication before the Cybercrime Prevention Act became effective;
Prescription and the true discovery date; and
Inconsistencies between the complaint and its exhibits.

Do not file a template containing unsupported accusations against the complainant. False statements in a sworn counter-affidavit may create separate legal problems.

4. Preserve first, then consider removing the material

Keeping a defamatory post online may increase harm and complicate settlement. Deleting it immediately without preserving an exact copy and associated data may destroy evidence needed for the defense.

Have counsel supervise preservation and decide whether to remove, restrict, correct, or annotate the post. Do not edit it in a way that obscures its history. Later edits or reposts may raise separate publication and timing issues.

5. Avoid retaliation and public argument

Do not threaten the complainant, coach witnesses, publish private evidence, or launch new accusations online. Publicly attacking the complaint can generate additional statements, witnesses, or charges. Communications about settlement should pass through counsel where possible.

6. If an Information is filed in court

Cyber libel cases fall within the jurisdiction of the Regional Trial Court, specifically a designated cybercrime court. The judge independently determines whether probable cause exists for an arrest warrant.

Cyber libel is bailable before conviction, but the court sets the conditions and amount. If an Information or warrant may already exist, counsel can verify the docket and arrange a lawful response, including voluntary surrender and bail when appropriate. Evading service can worsen the situation.

Court remedies may include a motion to quash on grounds recognized by Rule 117, objections to inadmissible evidence, and appropriate motions after trial. Defenses apparent from disputed facts normally require evidence and cannot always be resolved through a motion to quash.

A notice of appeal in a criminal case generally must be filed within 15 days from promulgation or notice of the appealable judgment or final order, subject to interruption by a timely motion for new trial or reconsideration. Obtain appellate advice immediately after judgment.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than ordinary written libel. The imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years.

A court may impose a fine as an alternative to imprisonment. In People v. Soliman, the Supreme Court held that the legally permissible fine range for online libel is ₱40,000 to ₱1,500,000. A fine-only sentence is legally possible but is not guaranteed. The court determines the proper penalty from the law and the circumstances proved.

Civil liability for damages may accompany the criminal case. Under Rule 111, the civil action arising from the offense is generally deemed included unless it is waived, reserved, or filed ahead of the criminal case. A separate civil action for defamation may also be available under Article 33 of the Civil Code, subject to procedural rules and the generally applicable one-year period for actions for libel or slander under Article 1147.

A correction, apology, settlement, or affidavit of desistance may affect damages, credibility, prosecutorial judgment, or sentencing, but it does not automatically extinguish a criminal case. Criminal prosecution is brought in the name of the People of the Philippines, and dismissal after filing may require the prosecutor’s concurrence and court approval.

Common mistakes

Waiting because the post is still online and assuming prescription has not begun;
Counting one year only from publication without investigating the discovery date;
Treating a platform report, police blotter, or demand letter as the filing of a criminal complaint;
Filing wherever the post could be viewed without a proper venue basis;
Submitting cropped screenshots with no URL, context, witness, or authentication;
Failing to preserve the original device and file;
Naming an account holder without evidence identifying the actual publisher;
Assuming truth alone always defeats criminal libel;
Assuming “opinion,” “allegedly,” or a question mark automatically protects an accusation;
Treating every share or reaction as criminal, contrary to Disini;
Ignoring a subpoena or relying on an unsworn explanation;
Deleting posts, messages, account logs, or security notices before preservation;
Contacting witnesses to influence their testimony;
Publishing the complaint, counter-affidavit, or private exhibits online; and
Missing the 15-calendar-day period for reconsideration of a prosecutor’s resolution or the applicable court-appeal deadline.

When legal help is urgent

Consult a Philippine lawyer immediately if:

The first-discovery anniversary is approaching;
A prosecutor’s subpoena, resolution, Information, or court order has been received;
An arrest warrant may have been issued;
The accused or account holder is abroad;
The account is anonymous or platform records may soon disappear;
The publication involved a news organization, public official, election, whistleblowing, or confidential source;
The material was edited, reposted, or first published before the Cybercrime Prevention Act;
The complaint names editors, officers, employees, or several account users;
Hacking, threats, extortion, identity theft, stalking, intimate images, or child-related material is also involved;
There is pressure to sign an affidavit of desistance, admission, or settlement; or
The same publication is the subject of both criminal and civil proceedings.

People who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its indigency, merit, and conflict-of-interest rules. The Integrated Bar of the Philippines and law-school legal-aid clinics may also have referral or assistance programs.

Frequently asked questions

Must the complainant first ask for an apology or takedown?

No. A demand is not an element or filing prerequisite. It may be strategically useful, but it should not delay preservation or filing.

Is a screenshot enough?

Sometimes it may contribute to proof, but a screenshot is not automatically conclusive. It must be relevant, complete, and properly authenticated. Preserve the URL, context, original file or device, and testimony explaining how it was obtained.

Can a deleted post still support a case?

Yes, if reliable copies, witnesses, platform data, admissions, or other competent evidence establish the post and its author. Deletion may make authentication and context more difficult, which is why prompt preservation matters.

Can cyber libel be committed in a private group chat?

Yes, potentially. Publication requires communication to someone other than the person defamed; a private group may contain third persons. Privilege, duty, context, and malice must still be assessed.

Is merely sharing someone else’s post cyber libel?

Mere sharing or reacting cannot automatically be prosecuted as aiding or abetting cyber libel under Disini. But adding an independently defamatory caption or comment can create direct responsibility for the new statement.

Can a company be the victim?

Yes. Article 353 covers both natural and juridical persons, although the company must still establish identification, defamatory meaning, publication, and the other elements.

Can a public official file cyber libel?

Yes, but criticism of official conduct and matters of public interest receives strong constitutional protection. The prosecution may have to prove actual malice, depending on the statement and context.

Can an anonymous account be investigated?

Yes. Preserve the account URL and identifiers and seek prompt assistance from cybercrime investigators. Platforms ordinarily disclose protected user data only through valid legal process. A case cannot proceed to judgment against an unidentified person, so reliable identification remains necessary.

Does removing the post end the case?

No. Removal may limit continuing harm and assist settlement, but it does not erase a completed publication or automatically extinguish criminal or civil liability.

Is imprisonment automatic after conviction?

No. The Supreme Court has confirmed that a fine may be imposed instead of imprisonment. The actual sentence remains for the court to determine, and civil damages may still be awarded.

Does cyber libel always prescribe one year after posting?

No. The current controlling rule is one year from discovery by the offended party, authorities, or their agents. Publication and discovery may occur on different dates, and filing the proper complaint or Information interrupts prescription.

Official legal sources

This article provides general Philippine legal information, not legal advice or an attorney-client relationship. Outcomes depend on the complete publication, evidence, dates, venue, and procedural history. Law and official sources checked through 3 August 2026.