Quick answer

A cyber libel case may arise when the original author publishes, through a computer system, a malicious and defamatory factual imputation that identifies a person and is communicated to at least one third person. A post being false, insulting, viral, or damaging does not by itself complete the offense; every legal element, including authorship and malice, must be supported by admissible evidence.

To file, preserve the complete digital evidence, record when the material was first discovered, identify the author, select a legally proper venue, and submit a sworn complaint with supporting affidavits and documents to the appropriate city or provincial prosecution office. An anonymous-account case may require early assistance from the NBI or another authorized cybercrime unit so that provider data can be preserved and lawfully obtained.

To defend, do not ignore a prosecutor’s subpoena. Obtain the complete complaint and attachments, preserve your own evidence, and file a detailed counter-affidavit within the stated deadline. Potential defenses include absence of an element, lack of proof of authorship, privilege, truth published with good motives and for justifiable ends, the actual-malice rule for public officials or public figures, improper venue, and prescription.

Most importantly, the Supreme Court has now ruled with finality that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents—not automatically from the date of posting. Filing the complaint or information interrupts the period. The date of discovery is a factual issue, so both sides should preserve evidence showing exactly when the post became known. See Causing v. People, G.R. No. 258524, April 8, 2026.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or a similar technological means.

The prosecution must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Publication. At least one person other than the person defamed received, read, viewed, or heard the material. A private message sent only to the subject ordinarily lacks this element, although another offense or civil claim may still be possible.
Identification. The complainant is named or is identifiable from the words, images, surrounding facts, audience, or context. Omitting a name is not decisive if readers could still determine who was meant.
Malice. The imputation was malicious under the applicable statutory and constitutional standards.
Use of a computer system. The publication occurred through social media, a website, messaging service, email, online video, or another qualifying computer-based medium.
Authorship by the accused. The respondent must be shown to have authored the actionable statement. Ownership of an account or the appearance of a name in a screenshot may not, by itself, conclusively prove who made the post.

The entire publication matters. Courts assess the ordinary meaning, context, tone, accompanying images, audience, and circumstances—not merely an isolated word.

Not every online reaction is cyber libel

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author, but declared it unconstitutional as applied to people who merely receive and react to the post. A simple Like, Share, or reactive comment does not automatically make the user criminally liable for the original statement.

There is an important limit: a person who adds a new, independently defamatory factual accusation may become the original author of that new statement. Liability turns on the person’s own words and conduct, not merely the platform button used.

The same publication should not be used to prosecute its author separately for both traditional libel and cyber libel when that would punish the same offense twice.

Malice, privilege, truth, and public-interest speech

General rule on malice

Article 354 of the Revised Penal Code generally treats a defamatory imputation as malicious even if it is true, unless it falls within a recognized privilege. The context and evidence may rebut the presumption.

Statutory qualified privileges include:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments or remarks, of qualifying judicial, legislative, or official proceedings or acts that are not confidential.

The communication must stay within the purpose and audience of the privilege. Unnecessary distribution, embellishment, knowingly false additions, or proof of malice may defeat a qualified privilege.

Statements in legislative proceedings and relevant statements made in judicial pleadings may receive stronger protection, but the precise scope depends on the speaker, forum, relevance, and circumstances.

Truth is not always enough

Under Article 361, truth may be presented in a criminal libel case. As a general rule, acquittal on this defense requires proof both that the imputation was true and that it was published with good motives and for justifiable ends.

For an imputation that does not concern a crime, proof of truth is subject to additional statutory limits, including the rule governing statements about government employees and facts related to their official duties. A respondent should therefore avoid assuming that “I can prove it” automatically ends the case.

Public officials and public figures

When the complainant is a public official or public figure and the statement concerns official conduct or a proper matter of public concern, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. The burden is on the prosecution, and criminal guilt must be proved beyond reasonable doubt. See Daquer v. People, G.R. No. 206015.

Actual malice does not simply mean anger, hostility, or harsh language. It concerns the publisher’s state of mind regarding truth or falsity. Whether the standard applies, and whether it is met, depends on the complainant’s status, the subject of the statement, the sources consulted, the documents available, and the surrounding conduct.

Fair comment on a matter of public interest is protected, but calling an accusation an “opinion” does not control if the words reasonably imply undisclosed or provably false facts.

The one-year deadline

The current controlling rule is:

Cyber libel prescribes in one year.
The period begins when the alleged crime is actually discovered by the offended party, the authorities, or their agents.
An online post is not presumed discovered on the day it was uploaded merely because it was public or widely accessible.
Filing the complaint or information interrupts prescription.
If proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may begin running again under Article 91.
The period does not run while the offender is outside the Philippines, subject to the facts and applicable law.

Evidence of discovery may include the first screenshot, a message forwarding the post, an email to counsel, a comment or reaction by the complainant, a demand letter, a platform report, or a threat to sue. A complainant should state the discovery date candidly and attach corroboration. A respondent may contest that date through earlier messages, reactions, meeting records, witnesses, or other evidence.

Do not wait until the final days. An informal platform report, police blotter, demand letter, or consultation may not be the filing that interrupts prescription.

A civil action for defamation also generally carries a one-year prescriptive period under Article 1147 of the Civil Code. Accrual and interruption can present separate issues, so obtain advice immediately if a civil claim is being considered.

Evidence to preserve immediately

Preserve evidence before requesting deletion, blocking the account, or engaging publicly. Keep both readable copies and the underlying electronic material where possible.

Save:

Full-page screenshots showing the account name, profile, post, date, time, captions, images, comments, and visible URL;
A continuous screen recording showing how the post is reached from the account or page;
The exact URL, account ID, username, page ID, group or channel name, and privacy or audience setting;
Original downloaded images, audio, video, emails, messages, and attachments—not only forwarded or recompressed copies;
The device on which the material was first viewed, with the original files and messages intact;
Records showing the date and manner of first discovery;
Names and affidavits of people who personally saw the publication;
Evidence connecting the account to the alleged author, such as admissions, verified contact details, prior communications, consistent identifiers, or lawful provider records;
Documents supporting or disproving the accusation;
For a defense, research notes, source documents, interview records, drafts, corrections, and communications showing the publisher’s basis and motive;
For damages, lost contracts, customer messages, employment records, medical or counseling expenses, and testimony showing actual consequences.

Do not crop away context, alter timestamps, annotate the only copy, manufacture a reconstruction, or access another person’s account without authority. Maintain a record of who collected each item, when it was collected, where it was stored, and whether it was copied or converted.

Electronic material must still satisfy the rules on relevance, authenticity, integrity, hearsay, and the production of originals or admissible duplicates. Screenshots are useful, but a screenshot alone may not establish authorship, completeness, or reliability.

How to file a criminal complaint

1. Conduct an element-by-element review

Before filing, answer these questions with evidence:

What exact words, images, or sounds are alleged to be defamatory?
What factual imputation do they communicate?
How is the complainant identified?
Who other than the complainant received the material?
What proves that the respondent authored it?
When and how was it first discovered?
What evidence shows malice under the applicable standard?
Is the communication privileged?
If the complainant is a public official or figure, what proves actual malice?
Why is the chosen prosecution office and eventual court the proper venue?

A complaint that merely labels a post “fake,” “malicious,” or “viral” without proving each element is vulnerable to dismissal.

2. Secure early investigative help when needed

For an unknown or disputed account, report promptly to the NBI Cybercrime Division or another authorized cybercrime law-enforcement unit. The NBI provides an online complaint page and describes its investigative assistance for computer-crime victims.

The DOJ Office of Cybercrime also maintains cybercrime reporting information. Confirm whether a report has become a formally docketed criminal complaint; intake or referral alone should not be assumed to stop prescription.

Under Section 13 of RA 10175, providers must preserve certain traffic data and subscriber information for at least six months from the transaction. Content data may be preserved for six months following a lawful preservation order, with a permitted one-time extension. Provider disclosure ordinarily requires law-enforcement action and a court-issued warrant. A private complainant should not impersonate law enforcement or demand confidential subscriber data directly.

3. Select the proper venue

Cyber libel is tried in a designated Regional Trial Court acting as a cybercrime court. Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 or 5 of RA 10175 may be filed in the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The first properly filed court acquires jurisdiction to the exclusion of the others. Mere accessibility of a post everywhere should not be treated as unlimited venue. The complaint and eventual Information should allege concrete facts supporting the selected location. Venue in criminal cases can be jurisdictional, so have it checked before filing.

4. Prepare the sworn filing

The usual submission includes:

The original complaint-affidavit and the required copies;
The National Prosecution Service investigation data form;
Sworn affidavits of witnesses with personal knowledge;
Printed copies of the material, properly marked as annexes;
Electronic copies or storage media when required by the office;
Evidence of authorship, publication, identity, discovery, malice, and venue;
An affidavit explaining how the electronic evidence was obtained and preserved;
Relevant platform, investigator, or forensic records; and
The required proof of service, filing fee, or other office-specific requirements.

State facts in chronological order. Quote the exact actionable material and explain, without exaggeration, who saw it and why it identifies and defames the complainant.

File with the appropriate Office of the City Prosecutor or Office of the Provincial Prosecutor. E-filing and virtual proceedings are recognized alternatives under current DOJ rules, but availability and technical requirements vary by prosecution office. Confirm the accepted channel directly; sending an affidavit to an unofficial email address may not constitute filing.

5. Participate in preliminary investigation

Cyber libel undergoes preliminary investigation because of its prescribed penalty. Under DOJ Department Circular No. 15, series of 2024, prosecutors apply the standard of prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, capable of preservation, and sufficient to establish the elements and the identity of the responsible person if left uncontroverted. The Supreme Court upheld these rules in G.R. No. 280455.

The respondent receives a subpoena with the complaint and supporting documents and is directed to submit a counter-affidavit. The regular preliminary-investigation procedure generally affords at least 10 calendar days, but the controlling date is the one in the subpoena or order. Reply- and rejoinder-affidavits may follow when allowed or directed.

If the prosecutor finds the required evidence, an Information is filed in the designated cybercrime court. The judge then independently evaluates judicial probable cause and determines whether to dismiss the case, issue a warrant, or take the action authorized by the Rules of Criminal Procedure.

An aggrieved party may generally move for reconsideration of the prosecutor’s resolution within 15 days from receipt under the 2024 DOJ-NPS Rules. Further review is governed by the applicable DOJ appeal rules. These short periods should be calendared immediately.

How to defend during preliminary investigation

Read the subpoena and attachments completely

Confirm:

The docket number and prosecution office;
The deadline and hearing date;
Whether all complaint affidavits and annexes were attached;
The exact post and count being charged;
The alleged publication, discovery, and venue dates; and
Whether the complainant is suing as a private person, public official, public figure, or juridical entity.

If material attachments are missing, promptly request complete copies and an appropriate extension. An extension is not automatic. Do not simply skip the deadline: the prosecutor may resolve the case on the complainant’s evidence.

Build the counter-affidavit around evidence

Address every element and every material allegation. Depending on the facts, establish:

You did not author or control the account;
The exhibit is incomplete, altered, unauthenticated, or taken out of context;
No third person received the communication;
The complainant was not identifiable;
The words were not defamatory in their ordinary context;
The statement was a protected report, fair comment, or duty-based communication;
The factual accusation was true and made with good motives and for justifiable ends;
The complainant is a public official or figure and the prosecution cannot prove actual malice;
You relied on identified documents or credible sources and did not know the statement was false;
You merely reacted to another person’s post and did not author a new defamatory accusation;
The complaint was filed more than one year after actual discovery;
The alleged act occurred before cyber libel became punishable and cannot be prosecuted retroactively;
The venue allegations are unsupported; or
The same conduct is being charged twice in violation of constitutional protections.

Attach the source records, complete conversation, original files, witness affidavits, and evidence of discovery or earlier knowledge. Bare denials and purely argumentative motions are usually less useful than a sworn factual response.

Protect your rights without obstructing the case

A prosecutor’s subpoena is not itself a conviction or arrest warrant. Nevertheless, an NBI interview, custodial questioning, device request, search warrant, or court warrant calls for immediate legal advice.

Do not destroy files, reset devices, fabricate sources, pressure witnesses, threaten the complainant, or post attacks about the pending case. Do not provide passwords, consent to a search, or surrender devices without understanding the legal basis and consequences. A lawful cybercrime warrant may authorize disclosure, search, seizure, or examination, but its scope and implementation remain subject to constitutional and procedural safeguards.

Penalties and civil exposure

For cyber libel committed under the current penalty structure, the possible imprisonment is one degree higher than traditional libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

If a fine is imposed, the Supreme Court has fixed the current range at ₱40,000 to ₱1,500,000. The court may impose imprisonment, a fine, or both, depending on the circumstances. A fine-only sentence is legally possible; it is not guaranteed. The judiciary’s preference guidance in libel cases does not remove imprisonment as an available penalty. See People v. Soliman, G.R. No. 256700 and RA 10951.

Civil damages may be awarded separately from the criminal penalty. Under Rule 111, civil liability arising from the offense is generally deemed instituted with the criminal case unless it is waived, reserved for a separate action, or previously filed. Article 33 of the Civil Code also permits an independent civil action for defamation, subject to its own procedural and prescriptive rules. There can be no double recovery for the same injury.

A deletion, correction, apology, settlement, or affidavit of desistance does not automatically erase a completed offense or compel the prosecutor or court to dismiss it. These steps may reduce continuing harm, affect the evidence, or matter in evaluating motive and penalty. Preserve the original evidence and obtain advice before negotiating or making public admissions.

Common mistakes

Waiting for the platform to respond while the one-year period continues to run;
Treating a barangay blotter, demand letter, or online report as the formal criminal complaint;
Filing wherever the post could be opened without proving a statutory venue ground;
Submitting cropped screenshots that omit the URL, date, author, audience, or surrounding thread;
Assuming the account name alone proves authorship;
Failing to document the date of first discovery;
Claiming truth without proving good motives and justifiable ends;
Assuming every insult or negative opinion is a defamatory factual imputation;
Charging a person solely for a Like, Share, or simple reaction;
Adding a new accusation while sharing someone else’s post;
Ignoring a prosecutor’s subpoena or filing a motion instead of a factual counter-affidavit;
Deleting or editing evidence before preserving it;
Posting about the case, attacking witnesses, or circulating the disputed material again;
Assuming an apology or affidavit of desistance automatically ends the prosecution; and
Missing the 15-day period for reconsideration or the separate deadlines for further review.

When legal help is urgent

Consult a Philippine criminal-law or cybercrime lawyer immediately if:

The one-year deadline is near or the discovery date is disputed;
The account is anonymous, deleted, impersonated, or located abroad;
Provider preservation or a cybercrime warrant may be needed;
You received a prosecutor’s subpoena, NBI invitation, court summons, or warrant;
A device was seized or authorities requested passwords or consent to search;
The case concerns a journalist, whistleblower, public official, public figure, or confidential source;
Multiple posts, platforms, complainants, or venues are involved;
The statement relied on leaked, private, medical, financial, or unlawfully obtained material;
There are related threats, stalking, doxxing, intimate images, identity theft, or physical-safety risks; or
Settlement discussions may require a retraction, admission, payment, or affidavit.

If threats or physical danger accompany the publication, prioritize safety and report those acts separately. Cyber libel does not replace other remedies that may apply to threats, harassment, identity theft, privacy violations, or unlawful image sharing.

Frequently asked questions

Is a false and hurtful post automatically cyber libel?

No. The complainant must still establish a defamatory imputation, publication to a third person, identification, malice, computer-system use, and the respondent’s authorship. Some false statements are protected by privilege or constitutional rules.

Is one screenshot enough?

Sometimes it may support a complaint, but it is rarely the strongest complete proof. Preserve the URL, full thread, account identifiers, original files, discovery records, witness testimony, and evidence linking the respondent to the publication.

Can I be charged for sharing somebody else’s post?

A simple Share or reaction is not automatically punishable under the Supreme Court’s ruling in Disini. If you add your own new defamatory factual accusation, however, that added statement may be treated as an original publication.

Do I have to send a demand letter before filing?

No general demand-letter requirement completes the offense of cyber libel. A demand may support a correction or settlement effort, but it is not a substitute for timely formal filing.

When does the one-year period begin?

From actual discovery by the offended party, the authorities, or their agents—not automatically from upload. The date is proven from the parties’ conduct and surrounding evidence. Filing the complaint or information interrupts the period.

What if the post is several years old but was discovered only recently?

A complaint may still be timely if filed within one year of genuine discovery. The accused may challenge the claimed discovery date with evidence of earlier knowledge. The Supreme Court has rejected an automatic presumption that all public posts are discovered when uploaded.

Is truth a complete defense?

Not invariably. The general statutory defense requires truth together with good motives and justifiable ends, and proof of truth is subject to Article 361. Different constitutional considerations apply to public officials, public figures, and matters of public concern.

Can an anonymous account be charged?

Yes, if investigators can lawfully identify the author and establish the elements. Prompt preservation is important because provider records may be retained only for limited periods. Subscriber data does not automatically prove who physically authored a post, so other evidence may still be necessary.

Can a case be filed anywhere the post was read?

No. Venue must be based on one of the grounds in the Rule on Cybercrime Warrants and supported by specific facts. Universal online accessibility does not create unlimited venue.

Does deleting the post end the case?

No. Deletion does not undo an already completed publication. It may limit continuing harm and may be considered with an apology or corrective action, but evidence should be preserved first.

Is cyber libel bailable?

Yes. Before conviction, the offense is bailable as a matter of right. The court determines the bail and any conditions after considering the charge and applicable rules. Obtain counsel immediately if a warrant has issued.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the exact publication, evidence, dates, parties, venue, and procedural history. Laws and official sources were checked through July 31, 2026.