Quick answer

A cyber libel case generally begins with a sworn complaint before the proper City or Provincial Prosecutor, often after assistance from the National Bureau of Investigation or Philippine National Police cybercrime unit. The complainant must present evidence identifying the author and showing a defamatory online statement, publication to at least one third person, an identifiable victim, and the required form of malice.

The accused should not ignore a prosecutor’s subpoena. Obtain the complete complaint and attachments, preserve the account and device evidence, and submit a sworn, evidence-backed counter-affidavit on the date stated in the subpoena. Possible defenses include lack of authorship, publication, identification, defamatory meaning, or malice; privileged communication; protected fair comment; prescription; improper venue; and, in the proper case, truth published with good motives and for justifiable ends.

Cyber libel now prescribes in one year from discovery by the offended party, the authorities, or their agents, not automatically from the posting date. Filing the complaint or information interrupts prescription. This rule was affirmed with finality by the Supreme Court En Banc in April 2026. Because the discovery date and interruption of prescription can depend on evidence, both sides should obtain legal advice immediately rather than calculate the deadline informally.

What cyber libel means

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or similar information and communications technology. This can cover material posted through social media, websites, online forums, email, messaging platforms, and other computer-based channels.

The prosecution must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. The statement reached at least one person other than the person defamed. A viral or fully public post is unnecessary. A message sent only to the person concerned ordinarily lacks this element, but a group chat or forwarded message may supply it.
Identification. The complainant was named or was reasonably identifiable from the words, images, tags, surrounding facts, or context.
Malice. The applicable standard depends on the complainant, the subject, and whether the communication is privileged.
Use of a computer system or ICT.
Identity of the responsible author. An account name or screenshot alone does not necessarily prove who created the statement.

All elements must be evaluated in context. Harsh language, criticism, an insult, a negative review, or an inaccurate statement is not automatically cyber libel.

Malice, public figures, and privileged communications

For a defamatory statement about a private person, Article 354 of the Revised Penal Code generally presumes malice unless the communication is privileged or the surrounding law requires a different standard.

A stricter rule protects discussion involving public figures and public affairs. In criminal libel cases involving a public figure—particularly a public officer and conduct connected with public duties—the prosecution must prove actual malice: that the author knew the statement was false or acted with reckless disregard of whether it was false. Mere error, inaccuracy, or negligence does not by itself establish reckless disregard. The circumstances must show a high degree of awareness of probable falsity or serious doubts about the statement’s truth. The Supreme Court explains this standard in Daquer v. People.

Qualifiedly privileged communications include, among others:

A private communication made in the performance of a legal, moral, or social duty.
A fair and true report, made in good faith and without added defamatory commentary, of a non-confidential judicial, legislative, or official proceeding.
Fair commentary on established facts involving a legitimate matter of public interest, subject to the limits developed in Supreme Court decisions.

Privilege does not give unlimited permission to accuse someone. A qualified privilege removes the ordinary presumption of malice, but liability may remain if actual malice is proved.

Is truth a complete defense?

Not always. Article 361 generally requires proof both that the imputation was true and that it was published with good motives and for justifiable ends. Special rules apply to imputations involving government employees and facts related to their official duties. Constitutional protections for criticism of public officials and public figures may also place the burden of proving actual malice on the prosecution.

Do not assume that attaching a document, repeating another person’s accusation, or saying “allegedly” automatically avoids liability. The entire publication and the author’s verification, sources, context, and purpose matter.

The one-year filing deadline

In Causing v. People, G.R. No. 258524, April 8, 2026, the Supreme Court En Banc affirmed with finality that cyber libel prescribes in one year.

The period generally:

Begins when the alleged cyber libel is discovered by the offended party, the authorities, or their agents.
Is not presumed to begin merely because a post was publicly accessible.
Is interrupted by filing the complaint or information.
May run again if the proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.
Does not run while the offender is absent from the Philippines, under Article 91 of the Revised Penal Code.

Evidence may show earlier discovery—for example, a reaction to the post, a response, a threat to sue, a message discussing it, or another contemporaneous act. A complainant should record the actual discovery date and how the material was found. A respondent disputing timeliness should preserve evidence showing that the complainant, an agent, or the authorities discovered it earlier.

Do not wait until the final days. Venue, completeness, oath requirements, and the identity of the proper respondent can delay formal filing.

How to file a criminal complaint

1. Preserve the online evidence immediately

Before requesting deletion or confronting the account owner, preserve:

Full-page screenshots showing the statement, account name, profile details, date and time, reactions, comments, privacy or audience setting, and surrounding context.
The exact URL or permalink of the post, profile, video, image, or message.
A screen recording showing how the material was accessed from the profile or conversation.
Original image, audio, or video files, without editing or conversion.
Messages, notifications, emails, and witnesses showing when the material was discovered.
Names and affidavits of people who personally saw or received the publication.
Evidence connecting the account to the respondent, such as admissions, known contact details, linked pages, prior communications, or platform information lawfully obtained.
Evidence of reputational or financial consequences, if available.
The device used to access the material and an untouched backup of the files.

Keep a simple evidence log stating who collected each item, when, from what device, and where it is stored. Do not crop away relevant context, alter metadata, impersonate another person, hack an account, or obtain private data unlawfully.

Because platform records may disappear, consider promptly approaching the NBI or PNP cybercrime unit. Under the Cybercrime Prevention Act and the Rule on Cybercrime Warrants, law-enforcement authorities may seek preservation, disclosure, search, or examination orders when their legal requirements are met. A private screenshot does not replace platform or forensic evidence where authorship is disputed.

2. Check every element before filing

Prepare a short case chronology answering:

What exact words, images, audio, or video are alleged to be defamatory?
What defamatory meaning do they convey?
How is the complainant identified?
Who other than the complainant received or viewed them?
What proves that the respondent authored or controlled the publication?
When and how was the material discovered?
Where was it posted, sent, received, or harmful?
Is the complainant a private person, public figure, public officer, or juridical person?
Does the material concern official conduct or a matter of legitimate public interest?
Is the communication privileged?
What evidence shows falsity and, where required, actual malice?

A complaint should quote or reproduce the material accurately. Paraphrasing it in a more damaging way creates avoidable credibility problems.

3. Choose the proper venue

Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 may be brought before the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where any damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the other qualified courts.

The preliminary complaint should normally be filed with the City or Provincial Prosecutor whose territorial jurisdiction corresponds to a legally supportable venue. Pleading that a post could be accessed “anywhere” is not a safe substitute for specific venue facts.

4. Prepare and file the complaint-affidavit

Under DOJ Department Circular No. 015, series of 2024, a regular preliminary investigation begins with:

The original sworn complaint-affidavit;
Two duplicate copies for the prosecution office;
An additional copy for each respondent;
A completed NPS Investigation Data Form;
Witness affidavits; and
Documentary, electronic, and other supporting evidence.

The complaint-affidavit should give the parties’ names and addresses, the date and place of the offense, the material facts, the applicable venue facts, and the evidence supporting every element and the respondent’s identity. Follow the receiving office’s current administrative requirements. Do not assume that an informal email, police blotter, platform report, or social-media message to an agency constitutes formal filing.

Cyber libel’s prescribed imprisonment reaches beyond six years, so it is subject to regular preliminary investigation. Prosecutors now apply the standard of prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, preservable, and capable of proving all elements and the responsible person’s identity. The Supreme Court upheld these DOJ rules in Meking v. Remulla.

5. Participate in the preliminary investigation

If the complaint proceeds:

The prosecutor issues a subpoena attaching the complaint and evidence.
The respondent must receive at least 10 days before the scheduled submission of the counter-affidavit.
A reply may be required if the counter-affidavit raises material new matters.
A rejoinder may then be allowed.
A reply or rejoinder must generally be filed within 10 calendar days from receipt of the pleading answered.
An extension is exceptional, must be justified by the interests of justice, and may not exceed 10 days.
The prosecutor may conduct a clarificatory hearing or require additional evidence.

The DOJ rules direct the investigating prosecutor to resolve a preliminary-investigation complaint within 60 calendar days from assignment, subject to a maximum 30-day extension in specified situations. These are administrative disposition periods, not a guarantee that the entire prosecution or court case will finish within that time.

An aggrieved party may move for reconsideration of the prosecutor’s resolution within 15 days from receipt. Further DOJ review is governed by separate appellate rules. If an information has already been filed in court, a DOJ appeal does not by itself halt the court case; an appropriate motion to suspend must be considered.

How to defend the complaint

1. Do not ignore the subpoena

Record the date and manner of receipt. Obtain a complete copy of the complaint, witness affidavits, screenshots, files, and every attachment. The prosecutor may resolve the case without the respondent’s version if a properly served respondent unjustifiably fails to file a counter-affidavit.

2. Preserve—do not manipulate—the relevant data

Preserve the account, device, original drafts, source material, private messages, login alerts, and security records. If the account was compromised, secure it without destroying historical information and retain password-reset notices, unfamiliar-login alerts, support tickets, and device records.

If the publication remains online, obtain legal advice on preserving an authenticated copy and whether to remove, correct, or clarify it. Deletion, apology, or correction may be relevant to circumstances and mitigation, but none automatically ends criminal liability. Continuing to repost or argue publicly can create additional evidence or new statements.

3. File a specific, evidence-backed counter-affidavit

A useful counter-affidavit addresses each element separately and attaches available proof. Possible issues include:

The respondent did not create, publish, or control the account or statement.
The complainant cannot authenticate the screenshot or identify the author.
No third person received the communication.
The complainant was not reasonably identifiable.
The words were not defamatory when read in full context.
The publication was a protected opinion or fair comment based on established facts rather than a false factual accusation.
The communication was privileged.
Actual malice cannot be proved where that standard applies.
The imputation was true and published with the legally required motives and ends.
The case prescribed because discovery occurred more than one year before filing.
Venue is unsupported.
The alleged publication occurred before the Cybercrime Prevention Act became applicable.
The respondent merely received or reacted to another person’s post.

A bare denial is rarely enough when objective records are available. Conversely, the respondent need not prove innocence at preliminary investigation; the prosecutor must decide whether the prosecution evidence, including the defense evidence, meets the current charging standard.

4. Distinguish authorship from a mere reaction

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but invalidated the aiding-or-abetting provision as applied to people who merely receive and react to the post. A bare Like, routine Share, or reaction is not treated as aiding or abetting cyber libel.

This does not immunize a person who writes a separate defamatory caption, comment, message, or original post. Liability for newly authored words must be assessed on its own facts.

5. Respond promptly if an information is filed

Cybercrime cases fall within Regional Trial Court jurisdiction and are handled by designated cybercrime courts. After an information is filed, the judge independently evaluates probable cause and may dismiss the case, require more evidence, issue a warrant, or take other action allowed by the Rules of Criminal Procedure.

Counsel should promptly examine:

The sufficiency of the information;
Jurisdiction and venue;
Prescription;
Double jeopardy or prior prosecution for the same libelous publication;
The legality and scope of any cybercrime warrant;
Suppression or exclusion of unlawfully obtained electronic evidence;
Bail and voluntary-surrender arrangements if a warrant exists; and
Defenses that must be raised before arraignment.

Cyber libel is generally bailable before conviction. Do not evade a warrant or attempt an informal surrender without coordinating with counsel and the proper court.

Penalties and civil exposure

For cyber libel committed after the fine adjustments in Republic Act No. 10951, the possible penalties are:

Imprisonment: prisión correccional in its maximum period to prisión mayor in its minimum period—approximately four years, two months and one day to eight years;
Fine: ₱40,000 to ₱1,500,000;
Both imprisonment and fine, depending on the judgment; and
Civil liability or damages, when legally established.

In People v. Soliman, the Supreme Court held that a court may impose a fine alone in an appropriate cyber libel case. Fine-only treatment is discretionary, not a guaranteed sentence. The law still authorizes imprisonment.

The civil action arising from the offense is generally deemed included in the criminal case unless it is waived, reserved, or previously instituted under the applicable rules. An independent civil action for defamation may also present separate procedural and prescriptive questions. There can be no double recovery for the same injury.

An affidavit of desistance or private settlement does not automatically dismiss the criminal case because the prosecution is brought in the name of the People of the Philippines. It may affect the evidence or the complainant’s participation, but the prosecutor or court determines the legal consequence.

Common mistakes to avoid

Waiting because the post is still online and assuming prescription has not begun.
Saving only a cropped screenshot without the URL, account, timestamp, and surrounding thread.
Failing to preserve proof of the discovery date.
Treating an account name as conclusive proof of authorship.
Assuming every false or offensive statement is cyber libel.
Assuming truth alone always defeats the charge.
Filing in a convenient city without facts supporting venue.
Ignoring a subpoena or filing an unsworn letter instead of a counter-affidavit.
Reposting the disputed accusation while demanding that others delete it.
Editing files, wiping a phone, fabricating a conversation, or accessing another person’s account without authority.
Discussing defense strategy, sources, or admissions publicly.
Assuming a demand letter, apology, deletion, settlement, or desistance automatically starts or ends a criminal case.

When legal help is urgent

Speak with a Philippine criminal-law practitioner immediately if:

The one-year period may expire soon;
The publication or account is disappearing;
The author is unknown or a platform must be asked to preserve identifying records;
A subpoena, prosecutor’s resolution, court notice, warrant, or search order has been received;
A device or account has been seized or examined;
The complainant is a public officer, public figure, company, journalist, or media organization;
Several posts, respondents, complainants, or possible venues are involved;
The post also contains threats, intimate material, personal data, allegations involving a child, or other conduct potentially covered by separate laws;
The respondent is outside the Philippines; or
An adverse prosecutor’s resolution or court judgment has been received. Prosecutor reconsideration and ordinary court-appeal periods can be as short as 15 days.

Frequently asked questions

Must the post be public or viral?

No. Publication requires communication to at least one third person. A restricted post, email, or group-chat message can qualify. Audience size may affect the evidence and damages but is not the basic test for publication.

Is a demand letter required before filing?

No. A demand, request for correction, or takedown notice is not an element or universal precondition. It may help establish discovery, notice, later conduct, or a possible resolution, but it can also affect the case strategy.

Must the parties first go to the barangay?

Generally, no. Cyber libel carries imprisonment exceeding one year and a fine exceeding the Katarungang Pambarangay threshold, placing it outside mandatory barangay conciliation.

Can a case be filed against a fake or anonymous account?

An investigation may begin, but a conviction still requires reliable proof identifying the responsible person. Prompt law-enforcement assistance is important because subscriber, traffic, and content data are subject to preservation periods and lawful-disclosure requirements.

Does deleting the post prevent filing?

No. Deletion does not erase an already completed publication. It may make proof more difficult and may be considered with an apology or correction, but it does not automatically extinguish liability.

Can a Like, Share, or short agreement lead to liability?

A mere reaction or routine Share is not punishable as aiding or abetting cyber libel under Disini. A person who adds an independently defamatory caption or statement may be evaluated as the author of that new material.

Is proof of actual financial loss required?

Not to establish the basic criminal offense. The imputation must tend to cause dishonor, discredit, or contempt. Proof of specific loss becomes more important when actual damages are claimed.

Can the same material produce both ordinary libel and cyber libel charges?

The Supreme Court held in Disini that the same libelous publication cannot support duplicative prosecutions under ordinary libel and cyber libel in violation of the protection against double jeopardy. Whether two publications are genuinely the same or are separate authored acts depends on the evidence.

Official primary sources

This article provides general Philippine legal information, not advice for a particular case. Cyber libel conclusions depend heavily on the exact words, context, authorship evidence, complainant’s status, discovery date, venue, and procedural record. Sources and current rules were checked through July 31, 2026.