Quick answer

A cyber libel case may be filed when a person knowingly publishes a defamatory imputation through Facebook, Messenger, TikTok, YouTube, a website, email, or another computer system, and the legal elements of libel are present. The usual first step is a complaint-affidavit before the proper Office of the City or Provincial Prosecutor, supported by authenticated or otherwise admissible evidence identifying the post, its author, its readers, and the person defamed.

A person accused of cyber libel should not ignore a demand letter, investigation request, or prosecutor’s subpoena. Preserve the complete online context, obtain the complaint and every attachment, and submit a detailed counter-affidavit within the deadline stated in the subpoena. Possible defenses include absence of a defamatory imputation, failure to identify the complainant, lack of publication to a third person, privileged communication, fair comment, truth published with good motives and justifiable ends, constitutional protection for speech on public issues, mistaken attribution, improper venue, and prescription.

Cyber libel is not established merely because a statement is offensive, embarrassing, harsh, mistaken, or damaging. The prosecution must prove every element beyond reasonable doubt, including that the accused was legally responsible for the publication.

What Philippine law considers cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 punishes libel, as defined under the Revised Penal Code, when committed through a computer system or a similar means.

Under Articles 353 and 355 of the Revised Penal Code, the prosecution generally must establish:

A defamatory imputation. The statement imputes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person to contempt.
Publication. The defamatory matter was communicated to at least one person other than the person defamed. A private message sent only to the complainant may be insulting or threatening, but it ordinarily does not satisfy the publication element of libel unless a third person received or perceived it.
Identification of the offended party. The complainant must be identifiable from the publication itself and its surrounding circumstances. The person need not always be named, but readers must be able to understand whom the statement concerns.
Malice. Malice may be presumed in an ordinarily defamatory publication unless the communication is privileged or the surrounding law requires proof of actual malice. The presumption is rebuttable.
Use of a computer system. The publication was made through information and communications technology, such as a social-media platform, website, online forum, messaging application, or email.
Responsibility of the accused. The evidence must connect the respondent to the creation or actionable publication of the content. An account name or screenshot alone does not invariably prove who controlled the account at the relevant time.

The Supreme Court sustained the constitutionality of cyber libel, subject to important limitations, in Disini v. Secretary of Justice. It treated the law as applying to the original author of the defamatory online statement, not automatically to everyone who merely receives, likes, or reacts to it.

A person who shares material while adding a new defamatory caption, accusation, or endorsement may present a different factual situation. Liability depends on whether that person made an independently actionable publication, not simply on the platform label attached to the activity.

Statements that are not automatically cyber libel

Not every negative online statement is criminal. Context, wording, audience, subject, and supporting evidence matter.

Opinion, criticism, and rhetorical language

An opinion that does not assert or imply a provably false defamatory fact may be protected. However, labeling an accusation as “my opinion” does not immunize it if the words reasonably communicate a factual charge—for example, that a specifically identifiable person stole money or committed fraud.

Courts examine the entire post, not an isolated word. Captions, images, hashtags, prior posts, comments, and the relationship between the parties can affect the meaning.

Speech involving public officials and public figures

Criticism of government conduct and public affairs receives strong constitutional protection. When a publication concerns a public official, public figure, or matter of legitimate public concern, the complainant may have to establish actual malice—that the publisher knew the factual accusation was false or acted with reckless disregard as to whether it was false.

Actual malice is not the same as anger, spite, political hostility, or an unpleasant tone. It concerns the publisher’s state of mind regarding truth or falsity. Evidence of verification, reliance on records, requests for comment, corrections, and the reliability of sources can therefore be important.

Protection for public-interest discussion is not unlimited. Deliberately fabricating evidence or knowingly publishing a false factual accusation is not converted into protected speech merely because the target holds public office.

Privileged communications

Article 354 recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments or remarks, of qualifying official proceedings or acts of public officers.

Qualified privilege generally removes the ordinary presumption of malice, requiring the complainant to prove actual malice. The privilege can be lost through unnecessary publication, excessive language, knowingly false statements, or use of the occasion for an improper purpose.

Statements made in judicial proceedings may receive broader protection when relevant to the proceeding, but reposting the same accusations to social media is a separate act that may not share the privilege.

Truth, good motives, and justifiable ends

Truth is highly important but should not be treated as an automatic defense in every situation. Under Article 361, acquittal on this ground generally requires proof that the matter was true and that its publication was made with good motives and for justifiable ends. Special rules apply to accusations involving public officers and their official duties.

A defendant relying on truth should be prepared to present admissible records and witnesses, not rumors, anonymous messages, or screenshots of uncertain origin.

The one-year prescriptive period

The Supreme Court has definitively ruled that cyber libel prescribes in one year under Articles 90 and 91 of the Revised Penal Code. In its April 8, 2026 en banc resolution in Causing v. People, the Court maintained that the period is counted from discovery of the offense by the offended party, the authorities, or their agents—not automatically from the date the material was posted.

The filing of a complaint or information interrupts prescription as provided by Article 91. Whether a particular case has prescribed can require evidence showing:

When the defamatory material was published;
When the complainant, authorities, or their agents actually discovered it;
When the complaint was filed;
Whether an alleged later act amounted to a new publication; and
Whether proceedings were terminated or suspended in a manner that caused prescription to run again.

A post’s continued online availability should not casually be treated as a new offense every day. On the other hand, materially editing, re-uploading, or deliberately publishing the accusation again may raise a republication issue. Each alleged publication must be examined separately.

A person planning to complain should not wait until the end of the year. Evidence, platform records, and account information can disappear much earlier. A respondent raising prescription should support the defense with proof rather than relying only on the date visible in a screenshot.

A separate civil action for injury to rights generally has its own one-year prescriptive period under Article 1147 of the Civil Code. The computation and interruption of the civil period may require a separate analysis.

How to file a cyber libel complaint

1. Preserve the publication before requesting removal

Save more than a cropped screenshot. Preserve:

The complete post, article, video, or message thread;
The full URL or platform link;
The account name, profile page, account identifier, and visible contact details;
Date and time information, including the time zone when relevant;
Comments, captions, hashtags, images, and linked materials supplying context;
The names of people who saw or received the publication;
Screen recordings showing how the page was reached;
Original downloaded files and their metadata;
Notifications, emails, or messages showing when the publication was discovered;
Earlier or later versions of an edited post; and
Communications showing admission, authorship, motive, or refusal to correct.

Keep the original device and unedited files. Store secure backup copies. Do not rely solely on a printed screenshot if the account’s ownership or the content’s authenticity may be disputed.

2. Assess every legal element

Before filing, identify precisely:

The exact words or media alleged to be defamatory;
The factual imputation conveyed;
Why it is defamatory rather than protected opinion;
How readers knew it referred to the complainant;
Which third persons received or viewed it;
Why the named respondent was the author or publisher;
Why the publication was malicious or made with actual malice, if required;
What computer system was used; and
Why the chosen place of filing is legally proper.

A complaint built mainly on conclusions such as “the post ruined my reputation” may be insufficient without the publication, context, identification, and proof of authorship.

3. Report promptly when technical investigation is needed

The NBI and the PNP are the principal law-enforcement authorities under the Cybercrime Prevention Act. Their cybercrime units can investigate account attribution and help initiate lawful preservation or disclosure procedures.

A private complainant cannot compel a platform or telecommunications company to disclose subscriber, traffic, or content data merely by sending a demand. The law and the Rule on Cybercrime Warrants require appropriate legal process for protected data.

Under Section 13 of the Cybercrime Prevention Act, specified traffic data and subscriber information are subject to a minimum statutory preservation period, while content data may be preserved upon a lawful order. Preservation is different from disclosure: obtaining the data ordinarily requires the appropriate warrant or court authority. Prompt reporting is therefore important when an anonymous, deleted, or impersonating account is involved.

4. Prepare the complaint-affidavit

The complaint-affidavit should narrate facts from personal knowledge and attach properly marked evidence. It should explain the publication, identification, defamatory meaning, authorship, malice, discovery date, and basis for venue.

Witnesses who actually saw the publication or can identify the account holder should execute their own affidavits. A witness should not claim personal knowledge based solely on what another person said.

False statements in an affidavit can create separate criminal liability. The complaint must disclose relevant context, including statements that may support privilege, truth, or lack of identification.

5. File with the proper prosecutor’s office

The complaint is generally filed for preliminary investigation with the Office of the City or Provincial Prosecutor corresponding to the legally proper venue. If technical investigation is still required, the complainant may first seek assistance from the NBI or PNP cybercrime unit.

Venue should not be selected merely because the complainant happened to open the post in a convenient city. Section 2.1 of the Rule on Cybercrime Warrants provides that criminal actions for Section 4 and Section 5 cybercrime offenses are filed before the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where any of the damage to a natural or juridical person took place.

The court where the criminal action is first validly filed acquires jurisdiction to the exclusion of the others. The complaint and eventual Information must contain sufficient factual allegations supporting the selected venue. Venue is especially fact-sensitive when the author, server, complainant, and affected audience are in different places or countries.

6. Participate in preliminary investigation

For cases handled by DOJ prosecutors, preliminary investigation is governed by the 2024 DOJ–National Prosecution Service Rules. The Supreme Court recognized those rules in A.M. No. 24-02-09-SC and later upheld their validity in Meking v. Remulla.

The prosecutor evaluates whether the evidence establishes a prima facie case with reasonable certainty of conviction. This requires attention to whether the evidence is admissible, credible, capable of preservation and presentation at trial, and sufficient to establish every element and the respondent’s identity.

The prosecutor may dismiss the complaint or find sufficient basis to file an Information in the designated Regional Trial Court. A preliminary investigation is not yet a trial, and a finding allowing the filing of charges is not a judgment of guilt.

How to defend against a cyber libel complaint

1. Record the deadline immediately

Upon receiving a subpoena, note:

The date and manner of receipt;
The deadline stated in the subpoena;
The hearing date;
The prosecutor and docket number;
The required number of copies; and
Whether the complaint and every listed attachment were actually included.

Under the current DOJ-NPS procedure, a respondent is generally afforded at least 10 calendar days from receipt of the subpoena and complete supporting records to submit a counter-affidavit. Follow the actual subpoena and current office instructions. If documents are missing or more time is genuinely necessary, raise the issue and request appropriate relief in writing before the deadline. Do not assume that an extension will be granted.

Failure to respond can result in resolution based on the complainant’s evidence.

2. Preserve your own evidence before changing anything

Save the complete account history, original drafts, source materials, correspondence, access logs, device records, and the full conversation surrounding the post. Preserve evidence showing:

Who had access to the account;
Whether the account was hacked, impersonated, or shared;
The sources consulted before publication;
Attempts to verify information;
Requests for comment and responses received;
The intended and actual audience;
Corrections, clarifications, or retractions;
Privacy settings;
The absence of third-party recipients; and
The complete context omitted from the complaint.

After evidence is secured and counsel is consulted, stopping further publication may reduce continuing harm. Do not fabricate, backdate, alter, or selectively delete records. Deletion does not necessarily erase platform or recipient copies and may damage credibility.

3. Challenge the elements one by one

A counter-affidavit should identify the precise evidentiary or legal defect, such as:

The statement is not defamatory in its complete context;
It is protected opinion, satire, rhetorical hyperbole, or fair criticism;
The complainant was not named and was not reasonably identifiable;
No third person received the statement;
The respondent did not create, control, or publish the content;
The evidence does not authenticate the account or screenshot;
The publication is true and was made with good motives and justifiable ends;
The communication was privileged;
The complainant is a public official or public figure and cannot prove actual malice;
The post concerns a public issue and was based on reasonable verification;
The complaint was filed after prescription;
Venue is unsupported or improperly laid;
The alleged conduct occurred before the Cybercrime Prevention Act became effective;
The prosecution is attempting to punish a mere like, reaction, or passive receipt; or
The evidence is inadmissible, incomplete, misleading, or incapable of preservation for trial.

General denials are less useful than a paragraph-by-paragraph response supported by records and witness affidavits.

4. Do not submit a casual written explanation

A prosecutor’s case is decided from sworn evidence. An emotional letter, unsworn social-media response, or one-page denial may make damaging admissions without properly presenting a defense.

The counter-affidavit should be reviewed as carefully as testimony at trial. Statements made under oath can be used against the respondent, and inconsistent versions may affect credibility.

5. Consider remedial steps carefully

A correction, takedown, apology, or retraction does not automatically extinguish criminal liability. It may nevertheless reduce harm, affect damages, explain good faith, or assist settlement discussions where legally permissible.

Do not condition removal on payment, threaten retaliatory publication, pressure witnesses, or contact the complainant in a manner that could be characterized as intimidation. Communications should ordinarily pass through counsel once a formal case is pending.

What happens after the prosecutor’s resolution

If the complaint is dismissed, the complainant may have remedies under DOJ rules, subject to strict periods and the proper reviewing authority. If the prosecutor finds sufficient evidence, an Information may be filed in the designated Regional Trial Court.

After an Information is filed:

The judge independently determines probable cause for a warrant of arrest;
The accused may be arrested or allowed to post bail, depending on the court’s action;
Arraignment and pretrial follow;
The prosecution must prove guilt beyond reasonable doubt;
The defense may object to inadmissible or unauthenticated electronic evidence;
Criminal and civil liability may be adjudicated; and
Either side may pursue the remedies allowed by the Rules of Court.

A respondent should not wait for arrest before obtaining counsel. Once a case is in court, filing deadlines and available remedies become more technical.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than the corresponding penalty for conventional libel because of Section 6 of the Cybercrime Prevention Act. Exposure may include imprisonment, a fine, or both, as well as civil damages. The fine provisions for conventional libel were adjusted by Republic Act No. 10951.

The precise sentencing range depends on the applicable law, the date of the offense, the form of the Information, modifying circumstances, and sentencing rules. Courts have been encouraged in appropriate libel cases to consider a fine rather than imprisonment, but this is not an automatic entitlement and does not remove the possibility of incarceration in a cyber libel conviction.

A complainant may also seek actual, moral, exemplary, and other legally recoverable damages. Damages must be properly alleged and proved; they are not awarded solely because a publication was unpleasant.

Electronic evidence: what makes a screenshot stronger

Electronic documents are admissible only when the requirements of the Rules on Electronic Evidence and ordinary evidentiary rules are met. A stronger evidence package ordinarily includes:

A witness who personally accessed and can identify the content;
The complete post rather than a cropped excerpt;
The URL, account details, timestamps, and surrounding thread;
Original files or reliable exports;
Evidence connecting the account to the alleged author;
Consistent device, subscriber, or platform records obtained lawfully;
Proof that a third person received or viewed the material; and
An explained chain of custody for downloaded or forensically acquired data.

Notarizing a screenshot does not by itself prove that the content is authentic, that the accused authored it, or that every statement shown is true. Likewise, an anonymous account is not automatically attributable to the person whom the complainant suspects.

Common mistakes by complainants

Waiting close to the prescriptive deadline;
Saving only a cropped screenshot without the link or account details;
Naming everyone who liked or viewed the post as respondents;
Assuming that hurt feelings alone establish defamation;
Filing where the post was merely accessed without establishing legal venue;
Failing to prove who controlled an anonymous or shared account;
Omitting the surrounding conversation or material favorable to the respondent;
Treating rumor as proof of publication or authorship;
Publicly reposting the accusation while announcing the complaint; and
Demanding removal before preserving the evidence.

Common mistakes by respondents

Ignoring the subpoena because the post has already been deleted;
Posting more accusations in response to the complaint;
Threatening the complainant or witnesses;
Missing the counter-affidavit deadline;
Filing a bare denial without exhibits;
Admitting authorship before reviewing the exact evidence;
Altering account histories or destroying devices;
Assuming “freedom of speech” is a complete defense;
Assuming truth alone ends every libel inquiry; and
Treating an apology or deletion as an automatic dismissal.

When legal help is urgent

Seek immediate assistance from a lawyer, the PAO if financially qualified, or an appropriate cybercrime unit when:

A prosecutor’s subpoena has been received;
The one-year prescriptive period is close to expiring;
The account is anonymous, hacked, deleted, or located abroad;
A platform preservation request or cybercrime warrant may be necessary;
An Information or warrant of arrest may already exist;
The publication accuses someone of a serious crime;
The case involves a journalist, public official, election issue, or confidential source;
The material contains intimate images, threats, doxxing, or a child’s information;
There is pressure to pay money in exchange for withdrawing or suppressing content; or
The same incident may also involve threats, extortion, identity theft, data-privacy violations, or violence against women and children.

Cyber libel may not be the only applicable remedy or offense. The proper legal response must be selected from the actual words, manner of publication, evidence, relationship of the parties, and resulting harm.

Frequently asked questions

Can I file cyber libel over a Facebook post or comment?

Yes, if all elements are supported by evidence. The fact that something appeared on Facebook does not by itself establish defamatory meaning, authorship, identification, malice, or publication to a third person.

Is a private Messenger message cyber libel?

A message sent only to the person insulted ordinarily lacks publication to a third person. If it was sent to a group chat or copied to others, publication may exist. The message may also implicate other laws depending on its content.

Is sharing a defamatory post automatically cyber libel?

No. Under Disini, liability does not automatically attach to everyone who merely receives, likes, or reacts to content. A person who adds and publishes a new defamatory accusation may be treated differently based on the particular facts.

Can an anonymous account be charged?

Yes, but the responsible person must first be identified through admissible evidence and lawful investigative processes. Suspicion, writing style, or an account photograph may be insufficient without corroboration.

Does deleting the post prevent a case?

No. Recipients, platform records, cached copies, screenshots, or device evidence may remain. Deletion may reduce further harm but does not erase an already completed publication.

Is cyber libel a continuing offense while the post remains online?

The mere continued availability of a post should not automatically be equated with a new offense each day. A material edit, re-upload, or deliberate fresh publication may require separate analysis.

Can I sue if the accusation is true?

A complaint may still be filed, but truth and the purposes of publication are central issues. The defense must ordinarily establish the relevant facts through admissible evidence and address good motives and justifiable ends.

Where should the case be filed?

Venue depends on where an element occurred, where a relevant part of the computer system was situated, or where legally cognizable damage occurred under the applicable cybercrime rules. Merely opening the post in a preferred city is not a safe basis for venue.

How long do I have to file?

Cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents, subject to interruption and other rules under Article 91. Because the discovery date and any alleged republication may be disputed, obtain advice and act promptly.

Can the parties settle?

The civil aspect may sometimes be settled. Whether and how a criminal complaint may be withdrawn, dismissed, or otherwise resolved depends on its procedural stage and prosecutorial or court authority. An affidavit of desistance does not automatically require dismissal of a public offense.

Will an apology automatically dismiss the case?

No. An apology, correction, or retraction may be relevant to good faith, mitigation, damages, or settlement, but it does not automatically erase criminal liability.

Official legal sources

This article provides general legal information, not advice for a particular complaint or defense. Cyber libel cases are highly dependent on the exact publication, evidence, discovery date, identity of the parties, and venue. The law and official sources were checked as of August 25, 2026.