Quick answer

To file a cyber libel case, preserve the online material and original device, document when and how it was discovered, identify the author and witnesses who saw it, and file a sworn complaint with the prosecutor’s office connected to a legally proper venue. Technical investigation by the NBI or PNP may be necessary if the account owner is uncertain or platform records must be preserved.

To defend a case, do not ignore a prosecutor’s subpoena or court process. Preserve—not delete—account, device and login records; obtain the complete complaint; and file a detailed counter-affidavit by the stated deadline. Test every required element, including authorship, publication, identifiability, defamatory meaning, malice, use of a computer system, timeliness and venue.

Cyber libel is not established merely because an online statement is offensive, inaccurate or damaging. The prosecution must ultimately prove every element beyond reasonable doubt. Important defenses may include lack of authorship or publication, failure to identify the complainant, privileged communication, absence of actual malice where the higher constitutional standard applies, truth published with good motives and for justifiable ends, prescription, improper venue and insufficiently authenticated evidence.

Time is critical. Under the Supreme Court’s final April 8, 2026 ruling in Causing v. People, cyber libel generally prescribes in one year from discovery by the offended party, the authorities or their agents, not automatically from the posting date.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or a similar information and communications technology.

The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status or circumstance tending to dishonor, discredit or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, saw or heard the imputation. A message communicated only to the person criticized ordinarily lacks this element, but a group message or post seen by third parties may satisfy it.
Identifiability. The complainant must be identifiable from the words, images and surrounding circumstances. The person need not be expressly named, but witnesses must be able to connect the statement to that person.
Malice. The applicable standard depends on the complainant, the subject and whether the communication is privileged. For a private person, Article 354 generally presumes malice from a defamatory imputation unless good intention and a justifiable motive are shown. For qualifiedly privileged communications, public figures and particularly criticism of public officers relating to official conduct, the prosecution may have to prove actual malice.
Use of a computer system or ICT. This includes publication through social media, websites, online forums, email and comparable digital systems.
Authorship or legally attributable participation. The evidence must connect the respondent to the account and the particular post or message. A profile name or photograph alone may be inadequate because accounts can be impersonated, shared or compromised.

The Supreme Court upheld cyber libel against the original author, but declared it unconstitutional as applied to people who merely receive and react to the post. A simple “like,” reaction or routine share should not automatically create cyber-libel liability. However, a person who adds a new defamatory caption, materially republishes content as their own, or authors a separate accusation may face a different factual and legal analysis. See Disini v. Secretary of Justice.

Conduct occurring before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. Whether a later edit or republication creates a new offense is fact-sensitive and should not be assumed from the continuing availability of an old post.

The one-year deadline

Cyber libel generally prescribes in one year under Articles 90 and 91 of the Revised Penal Code. The period begins when the material is actually discovered by:

the offended party;
the authorities; or
an agent of either.

Posting something publicly does not, by itself, create a legal presumption that the complainant discovered it that day. Discovery can instead be shown through messages, reactions, comments, threats to sue, reports to the complainant or other conduct demonstrating knowledge.

Filing the proper complaint or information interrupts prescription. Because the correct discovery date, filing office and venue can be disputed, a complainant should not wait until the last few days. A respondent asserting prescription should gather evidence of the earliest actual discovery, such as the complainant’s prior reaction, message, demand letter or public response. Unless prescription is clear from the case record, the accused may bear the burden of proving it.

The Supreme Court reaffirmed these rules and denied reconsideration with finality in its April 8, 2026 resolution in Causing v. People.

A separate civil action for defamation is also generally subject to a one-year limitation, although rules on interruption, suspension and the relationship between criminal and civil proceedings require case-specific advice.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional written libel:

imprisonment from four years, two months and one day to eight years; or
a fine from ₱40,000 to ₱1,500,000; or
both, depending on the judgment.

A court may impose a fine alone when justified by the circumstances, but imprisonment remains legally available. The preference guidelines for fines in libel cases are discretionary, not an entitlement. The controlling calculation is explained in People v. Soliman.

Civil damages may also be recovered. The civil action arising from the alleged crime is ordinarily deemed included in the criminal case unless it is waived, reserved or previously filed, while an independent civil action for defamation may be available under Article 33 of the Civil Code. Double recovery for the same injury is not allowed.

A complaint filed with the prosecutor does not ordinarily cause an immediate arrest. If the prosecutor files an information, the RTC judge independently evaluates probable cause and may dismiss the case, require more evidence or issue a warrant. Bail is generally available as a matter of right before conviction for this offense, subject to court procedures and conditions.

How to file a cyber libel complaint

1. Preserve the post before seeking its removal

Capture the evidence without altering it:

full-page screenshots showing the account name, content, date and surrounding thread;
the exact URL or permalink;
the date and time of capture;
the profile page and available account identifiers;
comments, reactions, shares and surrounding exchanges that establish context and publication;
a screen recording showing how the page was accessed;
downloaded copies, exports, emails, messages, photographs, audio or video in their original formats;
the original phone or computer used to view or receive the material; and
names and contact details of people who personally saw the publication.

Keep an untouched copy. Do not crop away context, add annotations to the only copy or rely solely on a forwarded screenshot.

Document the date of discovery separately. The complainant and the person who first reported the material should execute truthful affidavits explaining when and how each learned about it.

2. Determine whether the elements are supportable

Read the entire communication as an ordinary reader would. Identify:

the exact allegedly defamatory words;
what crime, vice, defect or discreditable circumstance they convey;
why the complainant is identifiable;
who other than the complainant saw or received them;
facts connecting the respondent to the account and post;
evidence relevant to falsity, motive or actual malice;
the computer system used; and
facts supporting the chosen venue.

Do not isolate a sentence that changes meaning when the full thread, satire, quotation or conversation is considered.

3. Secure technical assistance when identity or platform data matters

The NBI and PNP are the principal law-enforcement authorities under Republic Act No. 10175. Their cybercrime units may investigate account attribution and seek appropriate preservation or disclosure orders.

Under the law, traffic data and subscriber information held by service providers are subject to preservation rules, while content data may be preserved following a law-enforcement order. Disclosure and examination generally require the appropriate cybercrime warrant. A private demand to a platform is not a substitute for these legal processes.

Official reporting information is available through the DOJ Office of Cybercrime. Act quickly because providers do not necessarily retain all account, IP or content records indefinitely.

4. Select the proper venue

Cyber-libel criminal actions must be brought before the designated cybercrime court of the province or city:

where the offense or any element occurred;
where any part of the computer system used was situated; or
where the damage to the natural or juridical person occurred.

The court in which the action is first properly filed acquires jurisdiction to the exclusion of other courts. Mere technical accessibility of a webpage from anywhere should not be treated as unlimited permission to file in any location.

The complaint is ordinarily filed with the city or provincial prosecutor’s office corresponding to a proper judicial venue. Venue allegations should be specific and supported by evidence. The governing rule is discussed in the Supreme Court’s decision in Tieng v. Palacio-Alaras.

Because cyber libel is punishable by more than one year of imprisonment and a fine exceeding ₱5,000, prior barangay conciliation is not a mandatory condition for filing. It falls within the statutory exceptions in Section 408 of the Local Government Code.

5. Prepare the sworn complaint and supporting affidavits

A complaint-affidavit should clearly state:

the complete names and addresses of the parties, if known;
the date, place and manner of publication;
the exact words, images or recording complained of;
an accurate translation where necessary;
when and how the material was discovered;
why the words are defamatory;
why they identify the complainant;
who saw or received them;
why the respondent is believed to be the author;
the facts showing malice or, where required, actual malice;
facts establishing use of a computer system and proper venue; and
the resulting injury and requested action.

Attach witness affidavits and all supporting records. Affidavits must be based on personal knowledge, sworn before an authorized officer, and complete enough to establish a prima facie case with reasonable certainty of conviction. Local prosecution offices may require an Investigation Data Form, specific numbers of copies and other administrative documents; confirm the current checklist before filing.

6. Participate in the preliminary investigation

Cyber libel is handled under the regular preliminary-investigation track because its prescribed imprisonment may reach eight years.

Under DOJ Department Circular No. 015, series of 2024:

the prosecutor evaluates whether the complaint and evidence justify continuing the investigation;
if the case proceeds, the respondent receives a subpoena, the complaint and its attachments;
the scheduled submission must give the respondent at least 10 days from receipt to prepare a counter-affidavit;
the prosecutor may conduct clarificatory proceedings or require material records or testimony; and
the case is resolved according to the evidence submitted.

The DOJ standard is prima facie evidence with reasonable certainty of conviction: evidence should be admissible, credible, preservable and capable of proving every element if left uncontradicted. The Supreme Court upheld these rules in Meking v. Remulla.

An aggrieved party generally has 15 days from receipt of the prosecutor’s resolution to move for reconsideration. Any petition for review must comply with the applicable DOJ circulars and does not automatically stop court proceedings after an information has been filed.

How to defend a cyber libel complaint

Act immediately on a subpoena

Record the exact date and method of receipt. Obtain the complete complaint and every attachment. Calendar the deadline stated in the subpoena; do not assume an extension will be granted.

Do not replace the counter-affidavit with an informal letter, social-media argument or bare motion to dismiss. The counter-affidavit should present the complete factual and legal defense, supported by sworn witness statements and documents. Evidence omitted at this stage may be harder to introduce in a later DOJ review.

Preserve exculpatory digital evidence

Keep:

the original device and account;
login histories, device lists and security alerts;
password-reset, recovery and hacking notifications;
platform data downloads;
drafts and original files;
messages showing who managed or had access to the account;
employment, travel, location or device records relevant to authorship;
the full unedited conversation; and
sources, official records and research relied on before publication.

Do not fabricate a hacking defense or erase account activity. If unauthorized access genuinely occurred, preserve the alerts and make a prompt, truthful report.

Challenge the case element by element

Depending on the evidence, a defense may show:

No authorship: the respondent did not own, control or use the account or did not write the post.
No publication: nobody other than the person criticized received the statement.
No defamatory meaning: the communication, read in context, did not impute a crime, vice, defect or discreditable condition.
No identifiability: reasonable readers could not determine who was being discussed.
No malice or actual malice: the statement was made after responsible verification and without knowledge of falsity or serious doubts about its truth.
Qualified privilege: the communication was made in good faith to a person with a corresponding interest or duty, was a fair and true report of a non-confidential official proceeding without added defamatory remarks, or was fair comment on a matter of public interest.
Truth with proper purpose: where Article 361 permits proof of truth, the statement was true and published with good motives and for justifiable ends.
Prescription: more than one year passed after actual discovery before the proper criminal complaint or information interrupted the period.
Improper venue: the alleged facts do not connect the chosen location to an element, computer system or damage.
Pre-effectivity conduct: the alleged online publication occurred before the cyber-libel provision took effect.
Insufficient electronic evidence: screenshots, testimony or account records do not reliably establish the content, publication or author.
Double prosecution: identical material cannot be separately punished as both traditional libel and cyber libel when they constitute the same offense.

Truth alone is not always a complete defense. Article 361 also requires good motives and justifiable ends, and proof of a non-criminal act or omission is subject to statutory limits unless it concerns a government employee’s official duties.

Calling a statement “opinion” is likewise not conclusive. Courts examine whether it communicates or implies a provably false factual accusation and consider the complete language, setting and audience.

Examine whether actual malice is required

Actual malice means publishing with knowledge that the statement was false or with reckless disregard of whether it was false. Reckless disregard requires more than ordinary carelessness: evidence must support a high awareness of probable falsity or serious doubts about the truth.

In its January 13, 2026 decision in Tan v. People, the Supreme Court acquitted a person accused of cyber libel against a municipal mayor because actual malice was not proved beyond reasonable doubt. The statements concerned the mayor’s official conduct. The Court stressed that errors or inaccuracies and mere negligence do not, by themselves, establish reckless disregard.

Not every person employed by the government, every candidate or everyone discussed online automatically falls under the same rule. Public-figure status, the subject of the statement and its connection to public affairs must be established from the facts.

Test authentication and account attribution

Electronic evidence must be shown to be authentic, reliable and accurate. Screenshots may be supported by people who personally saw the post, admissions by the author, platform records or other evidence of integrity. Objections to admissibility must be made at the proper time; silence may waive them.

The Supreme Court has recognized that ownership, access and authorship of a social-media account may be proved by direct or circumstantial evidence, including:

admissions;
a witness who saw the person use the account or compose the message;
information in the post known only to the alleged author or a limited group;
distinctive language or writing patterns;
consistent prior account activity;
ISP, telecommunications or platform records;
device-forensic results, geolocation and login history; and
other conduct linking the person to the account.

Conversely, the presence of a person’s name and photograph is not automatically conclusive.

Use available remedies promptly

If the prosecutor’s resolution is adverse, a motion for reconsideration generally must be filed within 15 days from receipt. A DOJ petition for review may be available, subject to the current appeal rules and the court level involved.

Once an information is filed in the RTC, counsel should examine:

whether the information alleges every element and proper venue;
prescription;
duplicity or double-jeopardy issues;
the validity of any arrest or cybercrime warrant;
denial or irregularity of preliminary investigation;
grounds for a motion to quash; and
arrangements for voluntary surrender and bail if a warrant has issued.

These objections have different deadlines. Some must be raised before arraignment or are waived.

Evidence both sides should preserve

Both complainant and respondent should retain:

original digital files and devices;
complete posts and conversations, not isolated excerpts;
URLs, timestamps and account identifiers;
platform export files and metadata;
witness names and contemporaneous messages;
account-security and login records;
reports to the NBI, PNP, employer or platform;
demand, correction, apology or retraction communications;
official records relied upon;
proof of the actual discovery date;
proof connecting the case to the chosen venue; and
records of business, medical or other measurable harm, where damages are claimed.

Maintain a simple evidence log recording who collected each item, when it was collected and whether it was copied or transferred. Preserve private data lawfully; do not hack an account, impersonate another person or obtain records through coercion.

Common mistakes

Waiting because the post remains online, despite the one-year period.
Saving only a cropped screenshot without the URL, date or context.
Assuming a profile name proves who authored the post.
Filing wherever the post could technically be viewed.
Treating barangay conciliation as a mandatory prerequisite.
Assuming truth, “opinion,” humor or anger automatically defeats liability.
Publicly reposting the accusation while announcing plans to sue.
Deleting the only evidence or wiping devices after receiving notice of a case.
Ignoring a prosecutor’s subpoena because it is not yet a court summons.
Submitting an unsworn denial instead of a complete counter-affidavit.
Contacting, threatening or harassing witnesses.
Assuming an apology, deletion, settlement or affidavit of desistance automatically terminates the criminal case.

A retraction or apology may affect motive, damages or penalty, but it does not automatically erase a completed offense. An affidavit of desistance is relevant but does not bind the prosecutor or court because a criminal case is prosecuted in the name of the People of the Philippines. The parties may compromise the civil aspect without necessarily extinguishing criminal liability.

When legal help is urgent

Consult a Philippine lawyer immediately if:

the one-year period is close to expiring;
a platform may soon delete subscriber, traffic or content data;
the author used an anonymous, dummy or compromised account;
you received a prosecutor’s subpoena, resolution, information or warrant;
your counter-affidavit, motion for reconsideration or appeal deadline is running;
the case concerns a journalist, whistleblower, election, public official or matter of public interest;
law enforcement wants to search or examine a device;
the publication also involves threats, stalking, doxxing, intimate images, child abuse or gender-based online harassment; or
there is an immediate threat to anyone’s safety.

An accused who cannot afford private counsel should inquire promptly about representation through the Public Attorney’s Office, subject to its eligibility and merit requirements. Complainants and respondents may also explore qualified legal-aid programs.

Frequently asked questions

Can a case be filed after the post was deleted?

Yes. Deletion does not necessarily erase liability, but the complainant must still prove the post, its author, publication and all other elements with admissible evidence.

Is naming the complainant required?

No. It is enough if the person is identifiable from the language, images and circumstances. Speculation by the complainant alone is not necessarily sufficient.

Are likes, reactions and shares automatically cyber libel?

No. Disini protects people who merely receive and react to the original post. Liability may still be examined if a person authors a new defamatory caption or independently republishes an accusation as their own.

Can a corporation or organization be defamed?

Yes. Article 353 recognizes a juridical person as a possible offended party, but the entity must be identifiable and the other elements must still be proved.

Is a private message cyber libel?

It can be if it is sent to at least one third person and the other elements exist. A message sent solely to the person criticized ordinarily lacks publication, although other offenses may apply depending on its contents.

Does deleting the post or apologizing end the case?

No. It may help demonstrate remorse, reduce damages or support a request for a fine rather than imprisonment, but it does not automatically dismiss the criminal charge.

Can the parties settle?

They may settle or compromise civil claims. The complainant may express a desire not to continue, but criminal prosecution remains under state control. Dismissal is not guaranteed.

Can someone be arrested as soon as a complaint is filed?

Ordinarily, no. A regular preliminary investigation comes first. If the prosecutor later files an information, the RTC judge independently determines whether to issue a warrant. A valid warrantless arrest is possible only under the limited circumstances allowed by the Rules of Criminal Procedure.

What if the author or platform is outside the Philippines?

Philippine jurisdiction may exist where the accused is Filipino regardless of the place of commission, or where an element occurred, a relevant computer system was situated, or damage was caused to a person in the Philippines. Cross-border identification and evidence normally require formal law-enforcement and international-cooperation processes.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel liability depends on the precise words, audience, account evidence, dates, documents and procedural history. Sources and current rules were checked as of July 31, 2026.