Quick answer

A cyber libel case may be filed when a person knowingly publishes through a computer system an identifiable and maliciously defamatory statement that reaches at least one third person. The usual route is to preserve the online evidence, identify the author, prepare a sworn complaint with supporting affidavits and documents, and file it with the proper City or Provincial Prosecutor’s Office. If the author is anonymous or technical evidence is needed, seek help promptly from the NBI Cybercrime Division or PNP Anti-Cybercrime Group.

A person accused should not ignore a subpoena, delete evidence, contact witnesses to influence them, or answer publicly. Record when the papers were received, obtain the complete complaint and attachments, and have counsel prepare a counter-affidavit addressing every element, authorship, venue, prescription, privilege, truth, motive, and the reliability of the electronic evidence.

Cyber libel has a **one-year prescriptive period counted from actual

Quick answer

To file a Philippine cyber libel case, promptly preserve the complete online publication and evidence identifying its author, then file a sworn complaint with the proper prosecution office or seek investigative help from the NBI Cybercrime Division or PNP Anti-Cybercrime Group. A formal complaint should establish every element of libel, use of a computer system, authorship, proper venue, and timely filing.

To defend one, do not ignore the subpoena or delete evidence. Record when and how you received the papers, obtain the complete complaint and attachments, and submit a properly supported counter-affidavit on the date stated in the subpoena. Possible defenses include lack of authorship, no defamatory imputation, no publication to a third person, failure to identify the complainant, privileged communication, absence of the required malice, truth published with good motives and justifiable ends, improper venue, and prescription.

Cyber libel is criminal libel committed through a computer system or information and communications technology. It is governed principally by Article 353 and related provisions of the Revised Penal Code and Section 4(c)(4) of the Cybercrime Prevention Act of 2012. The Supreme Court has upheld cyber libel as constitutional as to the original author of the defamatory publication. A conviction is not automatic merely because a statement is offensive, false, or damaging.

What the prosecution must establish

The evidence must support all of these points:

Defamatory imputation. The publication attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. The statement was communicated to at least one person other than the person defamed. A message sent only to its subject ordinarily lacks this element, although a group chat, copied email, public post, or message forwarded to another person may satisfy it.
Identifiability. Readers could identify the complainant from the words, images, context, or surrounding circumstances. The complainant need not be expressly named, but mere personal belief that a vague statement refers to them is insufficient.
Malice. As a general rule, a defamatory imputation is presumed malicious unless good intention and a justifiable motive are shown or the communication is privileged. Different rules apply to privileged statements and speech concerning public officials, public figures, or matters of public concern.
Use of a computer system or ICT. The publication was made through a computer, smartphone, social-media platform, website, messaging service, email, or comparable technology.
Identity of the accused as author. The prosecution must connect the respondent—not merely a display name or profile photograph—to the publication. Account-control evidence, admissions, witnesses, device data, provider records, and consistent surrounding conduct may matter.

The statutory definition and relevant privileges appear in Articles 353 to 361 of the Revised Penal Code. Courts evaluate the publication as a whole and according to the natural meaning an ordinary reader would give it, not by isolating a single word.

Important exceptions and defenses

Privileged communications

Article 354 recognizes two statutory exceptions to the presumption of malice:

A private communication made to another person in the performance of a legal, moral, or social duty.
A fair and true report, made in good faith and without comments or remarks, of a non-confidential judicial, legislative, or other official proceeding, or of an official act performed by a public officer.

These are generally qualified privileges, not absolute immunity. The communication must stay within its proper purpose, audience, and factual setting. Excessive publication, unnecessary accusations, bad faith, or proof of actual malice may defeat the privilege.

A workplace complaint, report to authorities, or warning to a person with a legitimate interest may be privileged depending on whom it was sent to, why it was sent, what was said, and whether its distribution went beyond those who needed to know.

Public officials, public figures, and public concerns

Criticism of official conduct and discussion of matters of legitimate public concern receive stronger constitutional protection. When the applicable public-official or public-figure doctrine applies, liability requires proof of “actual malice”—knowledge that the statement was false or reckless disregard of whether it was true.

“Actual malice” is a specific legal standard, not simply hostility, anger, or harsh language. Whether a person is a public figure and whether the publication genuinely concerns a public matter are fact-dependent. Personal accusations unrelated to public functions require separate analysis. The Supreme Court discusses these distinctions in Cabatian v. People.

Truth is not always enough

Under Article 361, truth may be offered as a defense, but acquittal generally also requires proof that the publication was made with good motives and for justifiable ends. For an imputation of an act or omission that is not a crime, proof of truth is subject to an additional statutory restriction unless it concerns a government employee and facts related to official duties.

Keep the records that supported the statement when it was published. A document discovered only after publication may prove truth, but it does not necessarily establish the author’s earlier good faith or lack of recklessness.

Likes, shares, and comments

In Disini v. Secretary of Justice, the Supreme Court held Section 4(c)(4) valid as to the original author but unconstitutional as applied to persons who merely receive and react to the post. It also invalidated aiding or abetting liability under Section 5 as applied to cyber libel.

A person who merely likes or mechanically shares another person’s post is therefore differently situated from its author. However, a commenter or sharer who adds a new defamatory accusation may become the original author of that new statement. The exact words and manner of republication matter.

Material published before the law took effect

An online publication made before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. The Supreme Court applied this principle to a 2011 Facebook post in Peñalosa v. Ocampo.

Do not assume that later editing, reposting, or materially republishing old content has no legal effect. Those circumstances require individual assessment.

The one-year filing period

Cyber libel prescribes in one year from discovery of the publication by the offended party, the authorities, or their agents. Filing the complaint or information interrupts the period under Article 91 of the Revised Penal Code.

In its April 8, 2026 resolution in Causing v. People, the Supreme Court confirmed the one-year period and rejected an automatic presumption that a person discovered a Facebook post on the day it was uploaded. Actual discovery is a factual question that may be shown by messages, reactions, comments, threats to sue, witness testimony, and other surrounding conduct.

Practical consequences:

Record the exact date, time, and circumstances in which the complainant—or someone acting for them—first discovered the publication.
Preserve the message or notification through which the post was first reported.
Do not wait until the last day. Disputes may arise over discovery, proper venue, completeness of the filing, or whether a particular submission interrupted prescription.
Do not assume that reporting a post to the platform, sending a demand letter, making a police blotter entry, or emailing an informal narrative necessarily interrupts the criminal prescriptive period.
A separate civil action for defamation is also subject to a one-year period under Article 1147 of the Civil Code, but accrual, interruption, and its relationship with the criminal case require case-specific advice.

Evidence to preserve immediately

Screenshots are useful, but screenshots alone may not establish authenticity, authorship, completeness, or context. Preserve:

The complete URL, platform, account name, profile identifier, publication date, displayed time, privacy setting if visible, and date of capture.
Full-page screenshots showing the post, profile, comments, captions, images, and surrounding thread—not only a cropped sentence.
A screen recording that begins with the account profile and navigates to the publication and its URL.
The original image, video, audio, email, direct message, or downloaded platform data where lawfully available.
Original devices and files, including metadata. Avoid editing, converting, annotating, or repeatedly resaving the only copy.
Messages showing when and from whom the complainant first learned of the post.
Names and contact details of third persons who saw or received the publication.
Evidence connecting the account to the alleged author, such as admissions, prior communications, consistent contact details, or witnesses with personal knowledge.
Documents supporting truth, good faith, privilege, public interest, or the factual basis for the publication.
Evidence of harm, such as lost contracts, customer messages, workplace action, treatment records, or reasonable corrective expenses, if damages will be claimed.
Copies in at least two secure locations, together with a simple log showing who collected each item, when, and from what device or account.

Electronic evidence must still satisfy rules on relevance, admissibility, and authentication. Under the Rules on Electronic Evidence, the party offering a private electronic document bears the burden of showing its authenticity, integrity, and reliability.

Do not obtain evidence by hacking an account, guessing passwords, impersonating another person, installing spyware, or unlawfully intercepting communications. If provider records, subscriber information, or forensic extraction are needed, ask law enforcement and counsel about the proper cybercrime warrant or preservation process.

How to file a complaint

1. Assess the exact publication

Transcribe the allegedly defamatory words accurately and identify the images, captions, links, or video portions that supply context. Explain:

What the words would ordinarily mean.
Why they refer to the complainant.
Who other than the complainant saw them.
Why the respondent is believed to be the author.
When the publication was discovered.
How a computer system was used.

Do not replace the actual publication with a summary such as “the respondent ruined my reputation.” The prosecutor needs the precise words and surrounding context.

2. Determine the proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 of the Cybercrime Prevention Act may be filed before the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where any of the resulting damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Venue in a criminal case is jurisdictional, so the complaint should allege concrete venue facts rather than merely stating that the post was accessible everywhere.

The preliminary-investigation complaint should ordinarily be brought to the prosecution office corresponding to a legally supportable venue. Multiple locations, overseas authors, anonymous accounts, and remote complainants make early legal advice especially valuable.

3. Prepare the complaint-affidavit

The complaint-affidavit should be sworn and based on personal knowledge or properly identified authentic records. It should include:

Full identities and addresses of the parties, to the extent lawfully known;
A chronological statement of material facts;
The exact publication and its context;
Facts supporting each element;
Date and manner of discovery;
Facts supporting venue;
Witness affidavits;
An indexed set of documentary and electronic exhibits; and
An explanation of how each exhibit was obtained and preserved.

Avoid exaggeration, unsupported conclusions, edited exhibits, and allegations copied from another case. A knowingly false sworn statement can create separate legal consequences.

4. File with the appropriate prosecution office

Cyber libel ordinarily undergoes preliminary investigation before an information is filed in the Regional Trial Court. Current prosecutor proceedings are governed by DOJ Department Circular No. 015, the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, whose validity was upheld in Meking v. Remulla.

Submit the original complaint-affidavit, the required Investigation Data Form, complete evidence, and sufficient copies for every respondent. Confirm the current filing method, office hours, electronic-filing availability, and copy requirements with the particular prosecution office. An email or online report should not be assumed to complete formal filing unless that office accepts it as such.

5. Seek investigative assistance when necessary

A complainant may approach the NBI Cybercrime Division or PNP Anti-Cybercrime Group when:

The author uses an anonymous or fake account;
Provider or subscriber records may be necessary;
Evidence is rapidly disappearing;
A device needs forensic examination; or
Related acts involve hacking, threats, extortion, intimate images, identity theft, or coordinated harassment.

The NBI’s official computer-crime assistance procedure provides for a complaint sheet, interview, sworn statements, supporting documents, and examination of a relevant device. A law-enforcement investigation can help build the case, but it does not remove the need to monitor prescription.

6. Participate in preliminary investigation

The respondent will ordinarily receive a subpoena with the complaint and attachments. The complainant may be allowed or directed to submit a reply-affidavit after the counter-affidavit, followed in appropriate cases by a rejoinder or clarificatory hearing.

Answer only material defenses and submit evidence that could not reasonably have been included earlier. Preliminary investigation is not a social-media debate; inconsistent public statements can damage credibility.

How to defend against a complaint

1. Treat the subpoena as urgent

Record the date, time, manner, and address of service. Obtain the full complaint, annexes, and any missing or illegible pages. Under the 2024 DOJ-NPS Rules, the subpoena must set the filing or hearing date and generally give the respondent at least ten days from receipt of the subpoena and complaint-affidavit to prepare the counter-affidavit.

Follow the date written in the subpoena. Do not assume that an extension will be granted. Failure to respond may allow the prosecutor to resolve the complaint from the complainant’s evidence.

2. Preserve—not delete—your records

Preserve the device, account data, drafts, messages, source documents, access logs, and original version of the publication. Deleting or altering material may destroy evidence that supports the defense and may create damaging inferences.

If the account was compromised, immediately preserve login alerts, password-reset notices, device lists, security emails, police reports, and communications with the platform. A bare claim that “I was hacked” is unlikely to be persuasive without supporting evidence.

3. Review each element separately

A strong counter-affidavit does more than deny the accusation. It should test:

Authorship: What admissible evidence ties the account and post to the respondent?
Defamatory meaning: Is the statement a factual accusation, protected opinion, rhetorical exaggeration, satire, or an ambiguous remark?
Publication: Did anyone other than the complainant receive it?
Identification: Would a reasonable reader know the statement referred to the complainant?
Malice: Was the communication privileged, responsibly investigated, or made on documented grounds?
Truth and purpose: What records support the statement, and why was publication justified?
Computer-system element: Does the evidence show qualifying online publication?
Venue: Are concrete facts alleged and proved for the chosen city or province?
Prescription: When did the complainant, authorities, or their agents actually discover the publication?
Ex post facto concerns: Did publication occur before the law took effect?

Affidavits should identify the source and authenticity of every supporting record. Arguments should be tied to evidence, not merely stated as legal conclusions.

4. Avoid damaging reactions

Do not:

Contact or pressure the complainant or witnesses;
Publish a new accusation in response;
Ask others to coordinate stories;
Fabricate supporting documents;
Ignore a warrant or physically resist a lawful search;
Voluntarily disclose an entire device without understanding the requested scope; or
Assume that an apology, deletion, settlement, or affidavit of desistance automatically ends the criminal case.

Cyber libel is prosecuted in the name of the People of the Philippines. A complainant’s desistance may be considered, but it does not by itself compel the prosecutor or court to dismiss the case.

What happens after preliminary investigation

If the prosecutor finds the required prima facie evidence with reasonable certainty of conviction, an information may be filed in the designated Regional Trial Court acting as a cybercrime court. The judge independently determines probable cause for purposes of issuing a warrant of arrest and may dismiss the case or require additional evidence when appropriate.

If a warrant is issued, consult counsel immediately about lawful surrender and bail. Cyber libel is bailable before conviction, but the court determines the amount and conditions; there is no universal bail amount that applies to every case.

An aggrieved party may file a motion for reconsideration of a prosecutor’s resolution within 15 days from receipt under the current DOJ-NPS Rules. Further DOJ review is governed by additional circulars and strict procedural requirements. Filing a review request does not always suspend proceedings automatically, especially after an information has reached court.

Once in court, the case proceeds through arraignment, pretrial, trial, judgment, and any timely appeal. The prosecution must prove guilt beyond reasonable doubt. The lower preliminary-investigation standard is not a conviction.

Possible penalties and civil liability

The imprisonment range for cyber libel is one degree higher than traditional libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

A fine may be imposed as an alternative to imprisonment. The Supreme Court held in People v. Soliman that the permissible fine for cyber libel ranges from ₱40,000 to ₱1,500,000. A court may impose imprisonment, a fine, or both according to the governing provisions and circumstances.

Supreme Court Administrative Circular No. 08-2008 recognizes a preference for a fine in suitable libel cases, but expressly preserves judicial discretion to impose imprisonment. It is not a promise that every first-time offender will receive only a fine.

Civil damages may also be claimed with the criminal action or through an appropriate separate or independent civil action, subject to the Rules of Court, the Civil Code, prescription, and rules against double recovery.

Common mistakes

Waiting because the post remains online, despite the one-year prescriptive period.
Saving only a cropped screenshot with no URL, date, profile, or context.
Assuming a profile name automatically proves authorship.
Filing wherever the complainant happens to be without establishing a statutory venue fact.
Treating every insult, negative review, or criticism as criminal libel.
Assuming truth alone is always a complete defense.
Confusing ordinary hostility with the constitutional “actual malice” standard.
Naming everyone who liked, shared, hosted, or received a post despite the limits imposed by Disini.
Ignoring a subpoena or submitting a bare denial without evidence.
Deleting posts, accounts, messages, or devices after learning of a complaint.
Repeating the accusation in a demand letter, press conference, or retaliatory post.
Assuming a platform report, barangay entry, police blotter, apology, or private settlement automatically starts or ends a criminal case.
Combining cyber libel with threats, harassment, data-privacy violations, or intimate-image offenses without separately identifying the elements and evidence for each law.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year period may expire soon;
A subpoena, prosecutor’s resolution, information, arrest warrant, or search warrant has been received;
The author is anonymous and platform records may disappear;
Several cities or provinces could claim venue;
The publication concerns a public official, journalist, whistleblower, election, government transaction, or major public controversy;
A device is being requested for forensic examination;
The matter involves threats, stalking, extortion, doxxing, hacking, children, or non-consensual intimate material; or
A settlement, retraction, or affidavit of desistance is being proposed.

Indigent accused persons may ask the Public Attorney’s Office about eligibility for representation during preliminary investigation and trial. Immediate threats to life or safety should be reported to the nearest police station or emergency authorities without waiting for the cyber libel process.

FAQ

Is a false Facebook post automatically cyber libel?

No. Falsity may be important, but the prosecution must still prove a defamatory imputation, publication to a third person, identifiability, the legally required malice, use of a computer system, and the accused’s authorship.

Can a private message constitute cyber libel?

A message sent only to the person it concerns generally lacks publication to a third person. A group message, copied email, forwarded message, or communication to another recipient may satisfy publication. A duty-based private communication may also be qualifiedly privileged.

Can I sue an anonymous account?

A complaint may be possible, but identifying admissible evidence is essential. Report promptly to a cybercrime investigator so lawful preservation, disclosure, and warrant procedures can be considered. Do not attempt to hack or impersonate the account.

Can someone be charged for sharing a defamatory post?

A mere recipient or reactor is protected by the limits stated in Disini. A person who adds a new defamatory accusation can be treated as the original author of that added material. The exact content and conduct control.

Does deleting the post prevent a case?

No. Deletion does not erase a completed publication or copies already preserved. It may also destroy relevant evidence. Obtain advice and preserve a complete copy before changing anything.

Does an apology end the case?

Not automatically. An apology or retraction may affect settlement, damages, credibility, or the court’s assessment, but criminal prosecution belongs to the State once properly commenced.

Can criticism of a politician be cyber libel?

Yes, potentially—but criticism of official conduct and matters of public concern receives strong constitutional protection. The applicable actual-malice standard requires proof of knowing falsity or reckless disregard for truth. Fair criticism, supported reporting, and good-faith discussion are not automatically criminal.

Where will the case be tried?

In a designated cybercrime Regional Trial Court with proper venue under the Rule on Cybercrime Warrants. Venue may rest where an element occurred, where part of the computer system used was situated, or where legally cognizable damage took place.

How long do I have to submit a counter-affidavit?

Follow the date stated in the subpoena. In a regular DOJ-NPS preliminary investigation, that date should generally give at least ten days from receipt of the subpoena and complaint-affidavit. Do not assume an extension is available.

Can the court impose only a fine?

Yes. The Supreme Court has confirmed that a fine may be imposed instead of imprisonment, but the choice and amount depend on the law and circumstances. Fine-only treatment is not guaranteed.

Official sources

This article provides general legal information, not advice for a particular case and not an attorney-client relationship. Cyber libel outcomes depend heavily on the exact publication, evidence, dates, parties, and venue. Philippine legal sources and procedures were checked as of August 3, 2026.