Quick answer

To file a Philippine cyber libel case, preserve the online material and proof of authorship, then submit a sworn complaint-affidavit with supporting evidence to the prosecution office for the proper venue. The evidence must establish a defamatory imputation, publication to someone other than the person defamed, identification of the offended person, malice, use of a computer system, and the respondent’s authorship or responsibility.

To defend a case, do not ignore the prosecutor’s subpoena. File a detailed counter-affidavit on time and address every element, including authorship, meaning, publication, identification, malice, privilege, truth and good motive, venue, and prescription. A bare denial is rarely enough.

Cyber libel generally prescribes in one year from discovery of the online publication by the offended party, the authorities, or their agents. Filing the complaint or Information interrupts prescription. Because the discovery date, venue, and interruption of prescription can be disputed, anyone close to the one-year mark should obtain legal help immediately. The Supreme Court confirmed this rule with finality in Causing v. People, G.R. No. 258524, April 8, 2026.

What must be proved

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on written libel when the publication is made through a computer system or similar technology. A mobile phone is included within the law’s definition of a computer system.

The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Identification. The complainant need not always be named. Identification may exist if readers familiar with the circumstances can reasonably tell who was being discussed.
Publication. At least one person other than the person defamed must have received, read, heard, or seen the imputation. A message sent only to the person concerned ordinarily lacks this element; a public post, group chat, email copied to others, video, livestream, or online article may satisfy it.
Malice. Defamatory imputations against private persons are generally presumed malicious unless a recognized justification or privilege applies. Where the statement concerns a public official, public figure, or qualifiedly privileged matter, the prosecution may have to prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false.
Use of a computer system. The publication was made online or through information and communications technology.
Identity of the author. The evidence must connect the respondent—not merely the respondent’s name or photograph—to the account and the particular post.

Insulting, rude, exaggerated, or offensive language is not automatically libel. The words must be evaluated in their complete context, including language, audience, accompanying images, surrounding posts, and the facts reasonably understood by readers. Calling a statement an “opinion” is not conclusive if it implies undisclosed defamatory facts.

Who may be liable

The principal target is the original author of the defamatory online statement. In Disini v. Secretary of Justice, the Supreme Court invalidated the application of “aiding or abetting” liability to online libel and explained that people who merely react, like, comment on, or share an existing post are not liable simply for that reaction.

That protection has limits. A person who adds a new and independently defamatory statement may become the original author of that new statement. Likewise, an editor, account administrator, employer, corporation, or media organization is not automatically criminally liable merely because of its position; actual participation, authority, authorship, and the applicable statutory rules must be proved.

The same online publication should not be charged simultaneously as both ordinary libel and cyber libel. Disini held that prosecuting the same act under both provisions would violate the rule against double jeopardy.

The one-year filing deadline

Cyber libel prescribes in one year, not 12 or 15 years. Under Articles 90 and 91 of the Revised Penal Code, as applied in Causing:

The period begins when the alleged cyber libel is actually discovered by the offended party, the authorities, or their agents.
There is no automatic presumption that the offended party discovered a social-media post on the day it was uploaded.
The publication date and discovery date may coincide, but they are not necessarily the same.
Filing the complaint or Information interrupts the prescriptive period.
If proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may run again.

Record exactly who discovered the post, when, how, and who was informed. Preserve messages, emails, affidavits, or other records supporting that chronology. Do not wait until the anniversary date; disputes about counting, filing completeness, and venue can be fatal.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. Its accrual and any tolling issues should be assessed separately.

Where to file

The criminal complaint ordinarily begins at the Office of the City or Provincial Prosecutor corresponding to the proper venue. It is not initially filed as a criminal Information directly by the complainant in court.

Under the Rule on Cybercrime Warrants, the eventual criminal action must be filed before the designated cybercrime court of the province or city:

where the offense or any element occurred;
where any part of the computer system used was situated; or
where any of the damage to a natural or juridical person took place.

Venue in criminal cases is jurisdictional. The fact that a post could be accessed everywhere does not give the complainant an unrestricted choice of location. The complaint should allege and support specific venue facts, not merely state that the material was accessed in a convenient city. The applicable venue rule is discussed in Tieng v. People, G.R. Nos. 164845, 181732 and 185315.

The Regional Trial Court has jurisdiction over violations of the Cybercrime Prevention Act. The Act may also apply to conduct outside the Philippines when, among other statutory grounds, the offender is a Filipino, an element occurred in the Philippines, a computer system used was wholly or partly situated here, or damage was caused to a person who was in the Philippines. Actual prosecution of a person abroad may require additional international and procedural steps.

How to prepare and file a complaint

1. Preserve the online evidence immediately

Keep the material before requesting removal or confronting the author:

full-page screenshots showing the exact words, account name, profile, date and time;
the post’s direct URL and account or page identifier;
screen recordings showing navigation from the profile to the post;
original photos, audio, video, emails, or downloaded files;
comments and surrounding conversation needed to explain context;
visible privacy settings, audience, reactions, and shares;
the original device used to view or receive the material;
platform download or account-export data, when available;
names and affidavits of people who personally saw the publication;
records showing the discovery date and resulting harm;
demand letters, replies, admissions, apologies, or refusal to correct.

Save unedited originals and working copies. Avoid relying only on cropped screenshots. Do not hack an account, guess passwords, impersonate another person, install spyware, or unlawfully obtain private communications.

Law-enforcement agencies can use preservation orders and cybercrime warrants to obtain or preserve subscriber, traffic, and computer data. Because service-provider records may not remain available indefinitely, technical investigation should begin promptly.

2. Confirm the account’s authorship

A name and photograph on an account may not, by themselves, prove who controlled it. Relevant evidence can include:

an admission of ownership, access, or authorship;
a witness who saw the respondent use the account or create the post;
information in the post known only to the respondent or a small group;
distinctive language, spelling, nicknames, or writing patterns;
previous messages or acts consistent with the account’s use;
login alerts, platform records, IP information, geolocation, device history, or forensic findings.

These guideposts were recognized by the Supreme Court in XXX v. People, G.R. No. 274842, October 22, 2025.

3. Prepare the complaint package

The current DOJ-NPS process generally requires:

an original sworn complaint-affidavit and the required copies for every respondent;
a completed NPS Investigation Data Form;
sworn statements from material witnesses;
documentary, electronic, photographic, audio, video, or physical evidence;
proof of authority if the complaint is filed for a corporation or through a representative;
the respondent’s complete last-known address and proof supporting it;
an organized annex list and legible copies.

The affidavit should state the exact publication, its meaning and context, the complainant’s identification, how it reached third persons, the respondent’s authorship, the discovery date, the venue facts, and the supporting evidence for every element. Translate material written in a local language where necessary, while preserving the original text.

The complaint must be subscribed and sworn to before a prosecutor or authorized government officer, or, when they are unavailable, a notary public. Confirm the office’s current copy, payment, and submission requirements before filing. The DOJ’s published schedule of fees lists a ₱1,000 complaint fee for libel.

4. Consider technical investigation

A complainant may first seek assistance from the PNP Anti-Cybercrime Group or the NBI’s cybercrime investigators, particularly where:

the account is anonymous or apparently fake;
authorship is disputed;
platform or telecommunications records are needed;
devices require forensic examination; or
the post has been deleted.

A police or NBI report may strengthen the case, but reporting to an investigative agency is not always the same as completing the required filing before the prosecution office. Confirm that a properly docketed complaint has been filed before relying on it to interrupt prescription.

5. Participate in preliminary investigation

The 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings require prima facie evidence with reasonable certainty of conviction. This means the evidence must be assessed as admissible, credible, capable of preservation and presentation, and sufficient—if uncontroverted—to prove all elements and identify the responsible person. The Supreme Court upheld this prosecutorial standard in Meking v. Remulla, G.R. No. 280455.

The prosecutor may require more evidence before docketing, dismiss the complaint at the initial assessment, subpoena the respondent, conduct a clarificatory hearing, or require limited reply and rejoinder affidavits. A regular preliminary investigation is generally to be resolved within 60 calendar days from assignment, subject to a maximum 30-day extension in specified situations such as complex issues, countercharges, consolidation, or reassignment. These are official processing periods and do not guarantee that every case will finish within that time.

How to respond if you are accused

Treat a subpoena as a real deadline

A prosecutor’s subpoena is not yet an arrest warrant, but ignoring it can allow the case to be resolved using the complainant’s evidence alone. In a regular preliminary investigation, the hearing and counter-affidavit deadline stated in the subpoena should give the respondent at least 10 days from receipt.

Immediately record:

the date and manner of service;
the prosecutor’s docket number;
the date, time, and place of hearing;
the deadline stated in the subpoena;
every complaint, affidavit, and annex actually received.

Request missing annexes promptly and in writing. Do not assume that a request for extension has been granted unless the prosecutor issues an order.

Preserve—not destroy—your evidence

Do not delete accounts, wipe devices, fabricate conversations, instruct witnesses, or alter files. Preserve:

the device and account used;
login and security notifications;
account downloads and administrator-access records;
drafts and source documents;
messages identifying the source of information;
research, public records, interviews, and fact-checking efforts;
employment, travel, or location records relevant to authorship;
hacking reports, password-reset notices, or unauthorized-login evidence;
the complete context of the post, not only the challenged sentence.

After preservation and legal advice, removing a harmful post may limit further damage. Deletion does not automatically erase liability or make existing copies inadmissible.

Build the counter-affidavit around the elements

The counter-affidavit should give a coherent factual account and attach supporting evidence. Possible defenses include:

No authorship or control. The account was fake, hacked, shared, or operated by another person, supported by concrete records rather than speculation.
No defamatory imputation. The words, read in context, were not capable of causing dishonor, discredit, or contempt.
No identification. Reasonable readers could not identify the complainant.
No publication. The statement was communicated only to the complainant and not to a third person.
No qualifying online act. The accused did not publish the statement through a computer system.
Qualified privilege. The communication was made in the performance of a legal, moral, or social duty; was a fair and true good-faith report of a non-confidential official proceeding without added comments; or was fair commentary on a matter of public interest.
Public-official or public-figure protection. The prosecution cannot establish actual malice—knowledge of falsity or serious doubts recklessly disregarded.
Truth with good motives and justifiable ends. Under Article 361, truth is not always an automatic defense. The accused generally must also establish good motive and a justifiable purpose. Special rules govern non-criminal imputations against government employees relating to their official duties.
Fair opinion based on established facts. A reasonable opinion on public matters may be protected when the supporting facts are disclosed or established. A supposed “opinion” based on invented facts is not protected merely by its label.
Prescription. More than one year elapsed from the legally relevant discovery date before interruption.
Improper venue or lack of jurisdiction.
Simple reaction or sharing. The respondent only received or reacted to another person’s post and did not author a new defamatory imputation.
Double jeopardy or prior disposition, where legally applicable.

Qualified privilege removes the ordinary presumption of malice, but it is not absolute. It may be defeated by proof of actual malice. Personal attacks unrelated to official conduct or public interest may fall outside the privilege.

Observe the filing method

A counter-affidavit is ordinarily filed at the preliminary-investigation hearing. Personal appearance may not be required when the affidavit was properly sworn before a prosecutor, an authorized government officer, or, in their absence, a notary public.

Electronic filing of certain later submissions may be allowed through the prosecution office’s official email, generally in readable, unencrypted PDF form with the required verified declaration. Hard copies must still be submitted by the date ordered. Follow the prosecutor’s written instructions; an email sent to an unofficial address may not count.

What happens after the prosecutor’s resolution

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. Only one should be expected, and it must identify material factual or legal errors rather than repeat the original affidavits.

Because cyber libel is an RTC case, a qualifying resolution may be elevated through a verified petition for review to the Secretary of Justice under the DOJ’s appeal rules. The appeal is generally taken within 15 days from receipt of the resolution or the denial of a timely motion for reconsideration. Filing requirements are strict.

If an Information has already been filed in court:

a DOJ appeal does not automatically stop the court case;
the petition for review must be accompanied by the required motion to suspend proceedings filed in court;
the trial court retains authority over the case and independently decides any prosecution request to withdraw the Information;
suspension of arraignment based on a pending DOJ review is limited by the Rules of Criminal Procedure.

Before entering a plea, the accused and counsel should assess whether a motion to quash is available—for example, because the Information does not charge an offense, the court lacks jurisdiction, criminal liability has been extinguished by prescription, or double jeopardy applies. Arraignment can waive some objections, although the Rules preserve certain fundamental grounds.

Arrest, bail, and possible penalties

Filing a complaint-affidavit does not itself authorize an arrest. If the prosecutor files an Information, the judge must independently evaluate probable cause before issuing a warrant.

Cyber libel is bailable before conviction. Bail is not a payment to dismiss the case; it secures the accused’s appearance. The amount and conditions depend on the court’s applicable schedule and the circumstances. A person who learns of an arrest warrant should obtain counsel and arrange a lawful voluntary surrender and bail application rather than evade authorities.

The imprisonment range for cyber libel is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years. However, imprisonment is not mandatory in every conviction.

In People v. Soliman, G.R. No. 256700, the Supreme Court held that a court may impose:

imprisonment;
a fine instead of imprisonment; or
both, depending on the circumstances.

The current fine range identified in Soliman is ₱40,000 to ₱1,500,000. Judicial policy allows consideration of a fine alone in an appropriate libel case, but it does not remove imprisonment as a lawful option.

Civil damages may also be awarded. When the criminal case is instituted, civil liability arising from the offense is generally deemed included unless waived, reserved, or previously filed. Article 33 of the Civil Code also permits an independent civil action for defamation based on a preponderance of evidence, but double recovery for the same act is prohibited.

Common mistakes

Waiting for the post to “go viral” before preserving and filing it.
Saving only a cropped screenshot without a URL, account identifier, context, or witness.
Assuming that a profile name and photograph conclusively prove authorship.
Failing to establish when the post was discovered.
Filing in a convenient location without specific venue facts.
Treating every insult, criticism, negative review, or accusation as cyber libel.
Assuming truth alone always defeats the case.
Calling a factual accusation an “opinion” without disclosing a reliable factual basis.
Reposting the challenged words while publicly discussing the case.
Threatening the complainant, respondent, or witnesses.
Ignoring a prosecutor’s subpoena or relying on an unapproved extension request.
Filing a motion to dismiss instead of a substantive counter-affidavit.
Believing that deletion, apology, settlement, or an affidavit of desistance automatically ends the criminal case.
Filing a DOJ appeal without separately asking the trial court to suspend proceedings.
Obtaining “evidence” through hacking, unlawful account access, or fabricated chats.

When legal help is urgent

Seek a Philippine criminal-law lawyer immediately if:

the one-year prescription period is approaching;
a prosecutor’s counter-affidavit deadline is near;
an Information or arrest warrant has been issued;
authorship depends on platform records or device forensics;
the account is anonymous, hacked, shared, or managed by several people;
the post involves a public official, journalist, whistleblower, workplace grievance, or official proceeding;
the material includes threats, doxxing, intimate images, sexual harassment, minors, or identity theft, because other laws may apply;
law enforcement asks for a device, password, consent to search, or custodial statement;
there are several related posts, respondents, venues, or foreign parties.

People who cannot afford private counsel may inquire about eligibility for assistance from the Public Attorney’s Office or an Integrated Bar of the Philippines legal-aid office.

Frequently asked questions

Is a demand letter required before filing?

No. A prior demand, takedown request, or request for apology is not an element of cyber libel. It may nevertheless help document notice, continuing harm, admissions, refusal to correct, or a possible settlement.

Does deleting the post prevent a case?

No. Copies, witness testimony, platform data, and device evidence may remain available. Prompt deletion and a sincere correction or apology may be relevant to malice, damages, or penalty, but do not automatically extinguish liability.

Can I be charged merely for sharing or liking a post?

A simple reaction, like, or share is not punishable as aiding or abetting cyber libel under Disini. But adding your own defamatory accusation can be treated as a separate publication for which you are the original author.

Can a private message be cyber libel?

Possibly, but publication to a third person remains necessary. A message sent only to the person defamed ordinarily lacks publication. A group message, copied email, or message forwarded by the author to others may be different.

Can an anonymous or dummy account be investigated?

Yes. Preserve the exact URL, account ID, messages, timestamps, and any identifying patterns. Investigators may seek subscriber, traffic, platform, or device data through lawful preservation and warrant procedures. Identification is not guaranteed, particularly where records are unavailable or held abroad.

Is a false statement required?

Falsity is central where actual malice must be proved, but traditional Philippine libel rules can presume malice from a defamatory imputation against a private person even when the imputation is true. Truth must usually be paired with good motives and justifiable ends to obtain acquittal under Article 361.

Does an apology or affidavit of desistance automatically dismiss the case?

No. A criminal action is prosecuted under the direction and control of the public prosecutor, and after an Information is filed, the court controls its disposition. An apology, settlement, or desistance may affect the evidence, civil claims, or prosecutorial assessment but does not by itself command dismissal.

Can the complainant choose a civil case instead?

Yes. Article 33 of the Civil Code permits an independent civil action for damages arising from defamation, generally requiring proof by preponderance of evidence. The one-year limitation, venue, litigation costs, and interaction with any criminal case should be assessed before filing.

Can police arrest someone as soon as a complaint is filed?

Ordinarily, no. A complaint undergoes preliminary investigation, the prosecutor decides whether to file an Information, and the judge independently determines whether an arrest warrant should issue. Warrantless arrest is allowed only under the limited circumstances provided by law, not merely because an old post remains viewable online.

Official sources

This article provides general legal information, not legal advice or an attorney-client relationship. Cyber libel outcomes depend on the exact words, context, parties, evidence, dates, account records, and procedural history. Law and official procedures were checked through July 31, 2026.