Quick answer

To file a cyber libel case, preserve the online material and its context, confirm that all legal elements are present, and file a sworn complaint with the proper city or provincial prosecutor within one year from discovery of the allegedly defamatory publication. If the author is unknown or platform records are needed, seek investigative assistance from the NBI Cybercrime Division before data disappears.

To defend a case, act immediately upon receiving a subpoena, complaint, warrant, or court notice. Preserve—not destroy—the original material, obtain the complete case records, and submit a sworn, evidence-backed counter-affidavit on the date stated in the subpoena. Possible defenses include lack of authorship, publication, identification, defamatory meaning, or malice; privileged communication; fair comment on public affairs; truth coupled with the legally required motive; prescription; improper venue; defective electronic evidence; and double charging for the same publication.

A demand letter, deletion, apology, or affidavit of desistance does not by itself create, erase, or terminate criminal liability. Each case turns on the exact words, audience, author, context, dates, documents, and evidence.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or information and communications technology.

The prosecution must establish:

A defamatory imputation. The content attributes a crime, vice, defect, act, omission, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication to a third person. Someone other than the author and the person defamed must have received, read, heard, or viewed it. A message sent only to the subject ordinarily lacks this element, but a group chat, public post, email copied to others, or similar distribution may satisfy it.
Identification. The complainant must be identifiable to readers or viewers. The post need not use the person’s full name if its details allow people who know the circumstances to recognize the subject.
Malice. Article 354 generally presumes malice from a defamatory imputation, but the presumption does not operate in privileged communications. Statements involving a public officer’s official conduct or a public figure on a matter of legitimate public concern are subject to a more demanding actual-malice standard.
Use of a computer system or ICT. The publication must have been made online or through covered technology.
Responsibility of the accused as author. The prosecution must connect the respondent to the account and the publication. A profile name or isolated screenshot may not, by itself, prove who controlled the account or authored the content.

Courts read the publication as a whole and in its ordinary meaning, not from selected words stripped of context. Harsh criticism, ridicule, satire, insult, opinion, or an inaccurate statement is not automatically criminal libel; the complete legal test still applies.

Who can be charged

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author, but declared it unconstitutional as applied to people who merely receive and react to the post. It also invalidated aiding, abetting, and attempted cyber libel under Section 5 of the law.

Therefore:

Merely pressing “Like,” using a reaction, or sharing the original post without creating new defamatory content is not enough to make a person the original author.
A person who writes a new comment containing a separate defamatory accusation may be evaluated as the author of that new publication.
Copying, captioning, reposting, or otherwise presenting another person’s accusation as one’s own may require a fact-specific analysis. Do not assume that adding “CTTO,” “allegedly,” or a question mark prevents liability.

For the same online publication, a person should not be punished both for ordinary libel under the Revised Penal Code and cyber libel under Republic Act No. 10175. Disini held that double charging under both laws for the same offense violates the protection against double jeopardy.

The one-year deadline

The controlling rule is now clear: cyber libel prescribes in one year from discovery of the defamatory material by the offended party, the authorities, or their agents.

The Supreme Court reaffirmed this rule en banc on April 8, 2026, in Causing v. People. It rejected the former view that cyber libel prescribes in 12 or 15 years. It also held that an offended party is not legally presumed to have discovered a Facebook post on the date it was uploaded merely because it was public or widely accessible.

The date of discovery is a factual issue. Relevant evidence may include:

The complainant’s first reaction, comment, or message about the post
The date someone forwarded the content to the complainant
A threat to sue or a demand for deletion
Reports made to the platform, police, NBI, employer, or another agency
Earlier screenshots, emails, chats, or witness statements showing prior knowledge

Filing the criminal complaint with the prosecutor interrupts the running of prescription. Do not wait until the last day: venue, holidays, incomplete affidavits, missing evidence, and disputes over the discovery date can still defeat a late or defective filing.

A separate civil action for defamation is also generally subject to the Civil Code’s one-year limitation. Its proper basis, reckoning date, relationship to the criminal case, and venue should be reviewed independently.

How to file a complaint

1. Check the elements before filing

Write down the exact defamatory words and explain:

What the ordinary reader would understand them to mean
Who was being identified and how readers would recognize that person
Who received or viewed the content
Why the content was malicious or outside any privilege
Why the named respondent was the author
When and how the complainant or authorities first discovered it
What facts support the proposed venue

Do not file solely because a post is offensive, embarrassing, false, or damaging. The sworn complaint must support every required element.

2. Preserve the electronic evidence

Before requesting deletion or responding publicly, preserve:

Full-page screenshots showing the post, account name, profile details, URL, date, time, audience setting, reactions, comments, and surrounding thread
A screen recording showing navigation from the account or page to the publication
The original image, video, audio, message, email, or downloaded file
The exact URL and any account, page, channel, group, post, or message identifier
Device information and original files, including metadata where available
Earlier and later versions of edited content
Notifications, emails, platform reports, takedown requests, and responses
Names and sworn statements of people who personally saw the material
Proof of authorship, such as admissions, linked messages, account-control evidence, or corroborating witnesses
Evidence of the discovery date and resulting harm

Keep untouched copies. Do not crop, annotate, rename, re-save, or alter the only copy. Record who collected each item, when, from what device, and how it was stored.

Under the Rules on Electronic Evidence, electronic documents must still be authenticated. A readable printout can qualify as an original if shown to reflect the data accurately, but admissibility and authorship are not established merely by printing a screenshot.

3. Identify the proper venue

Venue is not simply any place where the internet post could be opened. Under the Rule on Cybercrime Warrants, the criminal action is brought before the designated cybercrime court of the province or city where:

The offense or any element occurred;
Any part of the computer system used was situated; or
Legally cognizable damage took place.

The first court properly taking cognizance excludes the others. Because an overbroad allegation that a post was “accessible everywhere” may be insufficient, the complaint should state concrete venue facts. Public officers, overseas authors, corporate complainants, multiple authors, and posts created or hosted in different locations require particular care.

File the complaint with the city or provincial prosecution office that can lawfully bring the Information before the proper designated cybercrime court.

4. Prepare the complaint-affidavit

The complaint-affidavit should be sworn before a prosecutor or authorized government official, or, when allowed, a notary public. It should ordinarily include:

Complete names and addresses of the parties, if known
A chronological statement based on personal knowledge
The exact publication and a faithful translation if it is not in English or Filipino
The date of publication and date and manner of discovery
Facts proving identification, third-party publication, authorship, malice, and venue
Properly marked supporting documents
Witness affidavits
An explanation of how the electronic evidence was captured and preserved
Any proof of legal authority if a juridical entity is the complainant

Confirm the required number of originals and copies with the receiving office. The DOJ’s official preliminary-investigation filing checklist should be consulted before submission.

5. Seek investigative assistance when necessary

If the account is anonymous, has been deleted, appears hacked, or requires service-provider records, consider reporting promptly to the NBI Cybercrime Division. Investigators can take sworn statements, examine relevant devices, and pursue lawful preservation or disclosure procedures.

A private person should not hack an account, obtain passwords through deception, impersonate another person, or secretly seize a device. Provider records and private data must be obtained through lawful process.

6. Participate in the preliminary investigation

Cyber libel carries a prescribed imprisonment range reaching eight years, so it is handled through regular preliminary investigation under the 2024 DOJ-NPS Rules. The prosecutor determines whether there is prima facie evidence with reasonable certainty of conviction—not yet guilt beyond reasonable doubt.

The respondent is served with the complaint and supporting records and given an opportunity to file a counter-affidavit. A clarificatory hearing may be held when necessary. The prosecutor may dismiss the complaint or approve the filing of an Information in the proper Regional Trial Court.

An aggrieved party may generally move for reconsideration within 15 days from receipt of the prosecutor’s resolution under the 2024 rules. Further DOJ review may be available, but the proper reviewing authority, filing period, required motion to suspend court proceedings, and effect of an already-filed Information should be checked immediately with counsel.

How to defend against a complaint

Preserve the complete original record

Do not delete messages, destroy devices, reset an account, fabricate an explanation, ask witnesses to change their stories, or edit the only copy of the publication. Preserve drafts, source documents, research, private exchanges, account-security records, and the complete conversation.

After preservation, counsel can advise whether prompt removal, correction, or apology is appropriate. Removal may reduce harm, but it does not undo a publication already seen by a third person.

Read the subpoena and attachments immediately

For a regular preliminary investigation, the subpoena should include the complaint and its attachments and set a hearing date that gives the respondent at least 10 days from receipt to prepare. The counter-affidavit and witness affidavits are submitted on the specified date.

Extensions are exceptional and generally require meritorious grounds; an allowed extension to file a responsive pleading should not exceed 10 days. A respondent who ignores the subpoena risks having the complaint resolved solely on the complainant’s evidence.

If attachments are missing or illegible, request the complete records in writing immediately. Do not assume that this automatically suspends the stated deadline.

File a specific, sworn counter-affidavit

Address every alleged element and attach the evidence supporting each defense. Depending on the facts, examine:

Authorship: Was the account yours? Who had access? Was it hacked, spoofed, or impersonated? Is there reliable evidence that you created or uploaded the content?
Exact publication: Does the complaint reproduce the correct words, image, video, translation, date, account, and version?
Publication: Is there evidence that a third person actually received or viewed it?
Identification: Would reasonable readers recognize the complainant, or is the supposed identification based on speculation?
Defamatory meaning: Does the full context communicate a factual accusation that tends to dishonor, or is it rhetorical criticism, satire, hyperbole, or opinion?
Malice: Was the statement made with knowledge of falsity, reckless disregard, or an unjustifiable purpose?
Privilege: Was it a protected private communication, fair official report, or fair commentary on a matter of legitimate public concern?
Truth and motive: What admissible records support the statement, and was it published with good motives and for justifiable ends where Article 361 requires both?
Public-official context: Did the statement concern official conduct, requiring the prosecution to prove actual malice?
Prescription: When did the complainant, authorities, or their agents actually discover the publication? Is there earlier evidence of knowledge?
Venue: Are concrete facts alleged and proved connecting the case to the chosen prosecution office and court?
Electronic evidence: Are the screenshots complete and authentic? Can the witness establish personal knowledge, integrity, account control, and accurate capture?
Applicable law: Was the publication made before cyber libel became punishable? Is the same act being charged twice under ordinary libel and cyber libel?

A bare denial, unsworn letter, or motion that does not present the respondent’s evidence may waste the principal opportunity to defeat the complaint before trial.

Privilege, truth, and public-interest speech

Privileged communications

Article 354 recognizes two statutory exceptions to presumed malice:

A private communication made in performing a legal, moral, or social duty
A fair and true report, made in good faith and without comments or remarks, of a non-confidential judicial, legislative, or other official proceeding, statements made in it, or acts performed by public officers in their functions

The privilege is qualified, not absolute. The publication must remain within the occasion and purpose of the duty. Excessive distribution, unrelated accusations, hostile embellishment, or proof of actual malice can defeat it.

Truth is not always enough

Under Article 361 of the Revised Penal Code, an accused relying on truth generally must also establish good motives and justifiable ends. Proof of the truth of a non-criminal act or omission is restricted unless the imputation concerns a government employee and facts related to official duties.

However, constitutional doctrines give stronger protection to fair commentary on public affairs. When an allegedly defamatory statement concerns a public officer’s official conduct, the prosecution must prove actual malice: knowledge of falsity or reckless disregard of whether the statement was false. Mere error or inaccuracy does not automatically meet that standard.

Whether someone is a public figure, whether the matter is genuinely of public concern, and whether the statement is fact or protected opinion are fact-sensitive questions.

What happens after an Information is filed

The filing of a prosecutor’s Information does not itself establish guilt. The judge must independently evaluate probable cause. The judge may dismiss the case for clear lack of probable cause, require additional evidence, or issue a warrant of arrest.

Cyber libel is bailable before conviction. If a warrant has been issued, coordinate through counsel for lawful surrender, bail, and recall or service of the warrant. Do not evade it. Bail amount and conditions are set by the court according to the governing rules and circumstances.

At trial, the prosecution must prove every element beyond reasonable doubt. Civil liability arising from the alleged offense is ordinarily deemed included unless it was waived, reserved, or previously filed separately.

If convicted, the ordinary period for taking a criminal appeal is generally 15 days from promulgation or notice of judgment, subject to the Rules of Criminal Procedure and any timely post-judgment motion. Treat receipt or promulgation of an adverse judgment as an urgent deadline.

Possible penalties and civil liability

Cyber libel is punishable one degree higher than traditional libel. The imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

The Supreme Court held in People v. Soliman that a court may impose a fine alone instead of imprisonment when warranted. Based on the amended fine for traditional libel and the one-degree increase, the current statutory fine range for online libel is ₱40,000 to ₱1,500,000. The law permits imprisonment, a fine, or both, depending on the judgment and applicable sentencing rules.

Civil damages may also be awarded, but they are not automatic. The claimant must establish the legal and evidentiary basis for actual, moral, exemplary, or other damages.

Common mistakes

Waiting until the one-year deadline is almost over
Assuming the period always runs from the upload date
Filing wherever the post happened to be viewed
Submitting cropped screenshots without URLs, context, or authentication
Failing to prove who controlled the account
Naming everyone who liked or shared the post as an accused
Treating falsity, insult, or reputational harm as a substitute for the legal elements
Assuming truth alone always defeats criminal libel
Ignoring public-interest, public-official, and privileged-communication doctrines
Publicly arguing the case and creating additional publications
Deleting the only preserved copy of the material
Ignoring a prosecutor’s subpoena because it is not an arrest warrant
Assuming an apology, settlement, or affidavit of desistance automatically ends the criminal case
Missing the short periods for reconsideration or appeal

When legal help is urgent

Consult a Philippine lawyer immediately if:

The one-year period may expire soon
The account is anonymous or platform data may be deleted
You received a prosecutor’s subpoena, court summons, Information, or arrest warrant
The case involves a public officer, journalist, corporate publisher, or multiple jurisdictions
Devices or accounts are being searched, seized, or demanded
The post was edited, copied, translated, or republished
There are several complainants, posts, or proposed counts
The publication also involves threats, stalking, identity theft, intimate images, minors, or personal-data exposure
A prosecutor’s resolution or court judgment has been received
Settlement discussions require admissions, deletion, retraction, or payment

Threats to physical safety, stalking, extortion, or non-consensual intimate images may involve offenses and remedies separate from cyber libel. Seek law-enforcement assistance without waiting for the defamation case.

FAQ

Is a demand letter required before filing?

No. A demand, takedown request, or request for apology is not an element or universal prerequisite of cyber libel. It may nevertheless become relevant to discovery, malice, mitigation, damages, or settlement.

Must the dispute first go through the barangay?

Generally no. Cyber libel’s prescribed imprisonment exceeds the penalty limit for mandatory Katarungang Pambarangay conciliation. Other related claims may be treated differently.

Can someone be charged for merely liking or sharing a post?

Not as an aider or abettor of the original cyber libel under Disini. But a new caption, comment, or accusation authored by that person can be evaluated as a separate publication.

Does deleting the post prevent a case?

No. The offense may already have been completed once a third person received the publication. Deletion can reduce continuing harm and may matter to mitigation, but it does not erase preserved evidence or accrued liability.

Is a screenshot enough?

Not necessarily. It must accurately show the material and be authenticated. The complainant must still prove publication, identity, authorship, context, and the other elements.

Is truth a complete defense?

Not automatically. Article 361 may require both truth and proof that the publication was made with good motives and for justifiable ends. Public-official and public-interest cases are also governed by constitutional actual-malice and fair-comment doctrines.

Can an affidavit of desistance end the prosecution?

Not by itself. Cyber libel is prosecuted in the name of the People of the Philippines. A complainant’s change of position may affect the evidence or civil aspect, but the prosecutor or court determines its legal effect.

Can a person go to jail for cyber libel?

Yes, imprisonment remains legally possible. A court may instead impose a fine alone when justified, but that result is not guaranteed.

Does a criminal complaint mean an immediate arrest?

No. A complaint before the prosecutor ordinarily begins preliminary investigation. An arrest warrant may issue only after an Information is filed and a judge independently finds probable cause, subject to the rules on lawful warrantless arrests.

This article provides general Philippine legal information, not advice for a particular case. Cyber libel outcomes depend heavily on the exact publication, evidence, dates, parties, and procedural history. Official sources and current rules were checked as of 3 August 2026.