Online threats and doxxing can feel urgent, humiliating, and unsafe, especially when your address, workplace, school, family details, photos, or private messages are being exposed online. In the Philippines, these situations may involve several laws at once: cybercrime, grave threats, data privacy violations, gender-based online sexual harassment, voyeurism, identity theft, cyberlibel, or even violence against women and children. The right first move is not only to “report the post,” but to preserve evidence properly, file with the correct office, and describe the facts in a way investigators and prosecutors can act on.

What Counts as Online Threats and Doxxing?

An online threat happens when someone uses Facebook, Messenger, Telegram, TikTok, X, Instagram, email, SMS, forums, gaming chats, or another digital platform to threaten harm. Examples include:

“I will kill you.”
“I will go to your house tonight.”
“I will post your private photos if you do not pay.”
“I know where your child studies.”
“I will ruin your business and send people to your address.”
“Pay me or I will leak your chats.”

Doxxing means maliciously exposing or spreading someone’s personal information to harass, intimidate, shame, endanger, or pressure them. Common doxxing details include:

Home address or live location
Mobile number or email address
Workplace, school, or schedule
Photos of family members or children
Government IDs, passport, driver’s license, or ACR I-Card
Bank account, GCash/Maya details, or transaction records
Private screenshots, medical information, or intimate details

Philippine law does not have one single “Anti-Doxxing Act” that covers every possible situation. Instead, doxxing is usually handled under a combination of laws depending on what was posted, how it was obtained, why it was posted, and what harm or threat accompanied it.

Main Philippine Laws That May Apply

Cybercrime Prevention Act: RA 10175 of 2012

The main cybercrime law is the Cybercrime Prevention Act of 2012, Republic Act No. 10175.

RA 10175 covers specific cybercrime offenses, including:

Illegal access when an account or system was hacked
Computer-related identity theft when someone intentionally acquires, uses, misuses, transfers, or alters identifying information belonging to another person
Cyberlibel when defamatory statements are published through a computer system
Other crimes under the Revised Penal Code or special laws when committed through information and communications technology, under Section 6 of RA 10175

This is why an ordinary threat under the Revised Penal Code can become a cyber-related case if it was made through Messenger, email, social media, SMS, or another ICT platform.

Revised Penal Code: Threats, Coercion, and Unjust Vexation

The Revised Penal Code, Act No. 3815, remains important even if the act happened online.

Relevant provisions include:

Situation	Possible offense
“I will kill you,” “I will burn your house,” “I will rape you,” or another threat to commit a crime	Grave threats under Article 282
“Pay me or I will harm you,” where the threat involves a crime	Grave threats, possibly with a condition
Threats to do a wrong that may not itself be a crime, especially with a demand	Light threats under Article 283
Repeated harassment, intimidation, or disturbance that may not neatly fit another crime	Unjust vexation under Article 287
Forcing someone to do or stop doing something through violence or intimidation	Grave coercion under Article 286

For online threats, the exact words matter. “I will expose you” is different from “I will kill you.” “I will post your address” is different from “I will send people to your house.” Save the exact message, not just your summary of it.

Data Privacy Act: RA 10173 of 2012

Doxxing often involves personal information, so the Data Privacy Act of 2012, Republic Act No. 10173, may apply.

The Data Privacy Act protects personal information and sensitive personal information. Sensitive personal information includes details such as age, marital status, health, education, government-issued IDs, and other legally protected data.

Possible violations may include:

Unauthorized processing of personal information
Malicious disclosure
Unauthorized disclosure
Processing personal information for an unauthorized purpose
Unauthorized access or intentional breach

The National Privacy Commission has also recognized doxxing as a harmful use of personal data in the context of scraped publicly available personal data. NPC Advisory No. 2026-01 describes doxxing as the malicious public disclosure of personal data intended to harass or intimidate.

A privacy complaint is especially relevant when the offender posted your address, ID, phone number, photos, medical information, private records, or family details without a lawful basis.

Safe Spaces Act: RA 11313 of 2019

The Safe Spaces Act, Republic Act No. 11313, also called the “Bawal Bastos Law,” covers gender-based online sexual harassment.

This may apply if the online threats or doxxing involve:

Sexual threats
Misogynistic, homophobic, transphobic, or sexist abuse
Cyberstalking
Repeated unwanted messages
Posting or threatening to post sexual content
Online attacks based on sex, gender, sexual orientation, or gender identity
Impersonation or false online posts meant to harm someone in a gendered or sexual way

This law can be important for women, LGBTQIA+ persons, students, employees, creators, and foreigners targeted with sexualized harassment online.

Anti-Photo and Video Voyeurism Act: RA 9995 of 2009

If the threat involves intimate photos or videos, the Anti-Photo and Video Voyeurism Act of 2009, Republic Act No. 9995, may apply.

This law covers the taking, copying, selling, sharing, showing, or broadcasting of sexual images or videos without written consent, even if the person originally consented to the recording.

A common example is sextortion: “Send money or I will post your nude photos.” This should be treated as urgent because the evidence may disappear quickly and the harm can be severe.

Civil Code Remedies for Privacy, Dignity, and Damages

Even when the main case is criminal, civil liability may also arise. The Civil Code provisions often relevant to online harassment include:

Article 19: every person must act with justice, give everyone his due, and observe honesty and good faith
Article 20: a person who causes damage contrary to law must indemnify the injured party
Article 21: a person who willfully causes loss or injury in a manner contrary to morals, good customs, or public policy may be liable
Article 26: protects dignity, personality, privacy, and peace of mind, including meddling with or disturbing another’s private life

These provisions may support claims for damages when doxxing causes fear, humiliation, lost work, family distress, or reputational harm.

Where to File a Cybercrime Complaint in the Philippines

You may file with law enforcement, the prosecutor, or a specialized agency depending on the facts.

Office	Best for	Practical notes
PNP Anti-Cybercrime Group (PNP-ACG)	Online threats, doxxing, hacked accounts, fake profiles, cyberstalking, extortion, identity theft	You may start through the PNP-ACG eComplaint portal or go to the nearest Regional Anti-Cybercrime Unit
NBI Cybercrime Division (NBI-CCD)	More technical cybercrime complaints, account tracing, forensics, serious online threats, scams, extortion	The NBI Citizens Charter lists its Investigative Assistance for Victims of Computer Crimes as available to the general public
City or Provincial Prosecutor’s Office	Formal criminal complaint for preliminary investigation	Usually requires a notarized complaint-affidavit and evidence
National Privacy Commission (NPC)	Doxxing, malicious disclosure, misuse of personal data, unauthorized posting of personal information	File a notarized complaint-assisted form through the NPC complaint process
Women and Children Protection Desk, DSWD, or local police	Threats involving women, children, intimate images, sexual exploitation, or domestic/relationship abuse	Important for urgent protection and child-related cases
Platform reporting tools	Takedown, account suspension, content removal	Useful, but not a substitute for a formal complaint if you want investigation or prosecution

You do not need to know the offender’s real name before reporting. If you only know a username, profile link, phone number, email address, GCash name, or Telegram handle, include those details. Investigators may later seek subscriber information or other data through the proper legal process.

Step-by-Step Guide to Filing a Cybercrime Complaint

1. Secure Your Immediate Safety First

If the threat suggests imminent physical harm, do not wait for a full cybercrime case to develop.

Do these immediately:

Call local police or emergency assistance if someone is going to your home, school, or workplace.
Inform building security, barangay officials, school administrators, or workplace security if your address or schedule was exposed.
Avoid meeting the offender alone.
Tell trusted family members or housemates what happened.
If the threat involves an intimate partner or former partner, ask about remedies under RA 9262, including a Barangay Protection Order or court protection order when applicable.

A cybercrime complaint is important, but immediate safety comes first.

2. Preserve Evidence Before Reporting or Blocking

Many victims block the offender, delete the conversation, or report the post immediately. That is understandable, but it can make the case harder to prove.

Before deleting or blocking, preserve:

Full screenshots showing the account name, profile photo, URL, date, and time
Screen recordings scrolling through the conversation or post
Profile links and usernames
Message links, post links, comment links, group links, or channel links
The exact phone number, email address, or account used
Payment demands, QR codes, bank details, GCash/Maya numbers, or crypto wallet addresses
The original device where the message was received
Names of witnesses who saw the post before it was deleted

For email threats, save the full email with headers if possible. For websites or forums, save the URL and the page as PDF. For Facebook or Instagram, capture the profile URL, not only the display name, because names can be changed.

3. Make a Clear Timeline

Prepare a simple chronology before going to PNP, NBI, or the prosecutor. Investigators handle many complaints. A clear timeline helps them quickly understand the case.

Example format:

Date and time	What happened	Evidence
10 June 2026, 8:15 PM	Respondent sent Messenger threat: “I will post your address.”	Screenshot A, screen recording 1
10 June 2026, 8:30 PM	Respondent posted complainant’s address in a public Facebook group	Screenshot B, group link
11 June 2026, 9:00 AM	Unknown numbers began calling complainant	Call log screenshot
11 June 2026, 2:00 PM	Respondent demanded ₱20,000 to delete the post	Screenshot C

Avoid vague statements like “He has been harassing me for months.” Instead, list the specific dates, platforms, accounts, words used, and harm caused.

4. Prepare a Complaint-Affidavit

A complaint-affidavit is your sworn written statement. It should be factual, organized, and based on what you personally know.

Include:

Your full name, age, address, nationality, and contact details.
The respondent’s real name if known. If unknown, identify the account, username, phone number, email, or profile link.
Your relationship to the respondent, if any.
The platform used.
The exact threatening words or doxxing post.
How you discovered the post or message.
Why the post identifies you.
What personal information was exposed.
What harm occurred: fear, calls from strangers, lost work, family danger, reputational harm, emotional distress, or financial demand.
A list of attached evidence.

For prosecutor filings and many agency filings, the affidavit should be notarized. If you execute the affidavit abroad, it may need to be acknowledged before a Philippine Embassy or Consulate, or notarized locally and apostilled, depending on where it will be used.

5. File With PNP-ACG, NBI-CCD, or the Prosecutor

For most victims, the practical route is:

Start with PNP-ACG or NBI-CCD for investigation and preservation of cyber evidence.
Submit your affidavit, ID, and evidence.
Ask for a complaint reference number or docket number.
Cooperate if investigators ask to inspect your device, receive screenshots, or clarify technical details.
If the evidence is sufficient, the case may be referred to the prosecutor for preliminary investigation.

You may also file directly with the City or Provincial Prosecutor’s Office, especially when you already know the offender and have complete evidence. However, if the offender is anonymous or the platform data is needed, law enforcement assistance is usually necessary.

6. Understand Cybercrime Warrants and Platform Data

Victims often ask, “Can the police just ask Facebook who owns the account?” In practice, it is not that simple.

The Supreme Court’s Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, governs warrants and related orders involving preservation, disclosure, interception, search, seizure, and examination of computer data.

Important points:

Investigators may need a warrant or proper legal process to obtain subscriber information, traffic data, or content data.
Service providers may be located outside the Philippines.
Foreign platforms may require requests through legal channels.
Deleted content may still be unavailable if not preserved in time.
Logs and subscriber information are time-sensitive.

This is why early reporting matters. A screenshot proves that a post existed, but platform records may help connect the post to a device, number, email, IP address, or account holder.

7. Follow the Preliminary Investigation Process

If the complaint proceeds to the prosecutor, the usual process is:

The complaint is filed and docketed.
The prosecutor reviews whether the complaint is sufficient in form and substance.
The respondent may be subpoenaed to submit a counter-affidavit.
You may be allowed to submit a reply-affidavit.
The prosecutor issues a resolution finding probable cause or dismissing the complaint.
If probable cause exists, an Information is filed in court.

Timelines vary widely. A simple case where the respondent is known may move faster. Cases involving anonymous accounts, foreign platforms, multiple respondents, or technical warrants can take months or longer. Court proceedings can take years.

Required Documents and Evidence Checklist

Bring both printed and digital copies when possible.

Requirement	Why it matters
Valid government ID	Confirms your identity as complainant
Complaint-affidavit	Main sworn statement of facts
Screenshots	Shows the threatening message, doxxing post, profile, date, and time
Screen recordings	Helpful for proving context and avoiding claims that screenshots were edited
URLs and profile links	Helps investigators locate the account or post
Original device	May be needed for authentication or forensic review
Witness affidavits	Useful if others saw the post, received messages, or can identify the offender
Proof that the information is yours	Shows that the exposed address, number, photo, or ID belongs to you
Proof of harm	Call logs, messages from strangers, employer notice, school report, medical or counseling records, security incident reports
Respondent details	Real name, aliases, phone numbers, addresses, workplaces, mutual contacts, payment accounts
For foreigners	Passport, ACR I-Card if applicable, local address, visa details if relevant
If filing through a representative	Special Power of Attorney, and for NPC complaints, proof of authority required by NPC rules

For NPC complaints, the NPC states that a formal complaint must be in the required format, printed and filled out, notarized, and submitted in person, by courier, or by email. NPC complaint mechanics also require supporting evidence and, in many cases, proof that the respondent was first informed in writing of the privacy violation and given a chance to address it, unless an exception applies.

Common Mistakes That Weaken Cybercrime Complaints

Deleting the Conversation Too Early

Do not delete the chat, post, email, or call logs before preserving them. Keep the original device when possible.

Submitting Cropped Screenshots Only

Cropped images may hide important details. Investigators need the account name, URL, timestamp, and surrounding conversation.

Relying Only on “Everyone Knows It Was Him”

Suspicion is not enough. Include facts showing why you believe the respondent controls the account: writing style, admissions, linked number, payment demand, same photos, mutual contacts, prior threats, or other identifying details.

Posting the Evidence Publicly

Many victims post screenshots to warn others. Be careful. Publicly reposting private information, intimate content, or defamatory accusations may create new legal problems. Submit evidence to authorities instead.

Threatening to Doxx Back

Retaliatory doxxing can expose you to your own complaint under privacy, harassment, or cybercrime laws. Do not answer an illegal act with another illegal act.

Waiting Too Long

Some platform data is retained only for limited periods. Threats, fake accounts, and posts can disappear. Report as early as possible.

Special Situations

If the Offender Is Anonymous

File anyway. Use “John Doe,” “Jane Doe,” or the username/account identifier in your complaint. Provide every technical clue you have: profile links, phone numbers, email addresses, payment accounts, group names, IP logs if lawfully available, and screenshots of account changes.

If the Offender Is Abroad

A Philippine complaint may still be possible if the victim is in the Philippines, the damage occurred in the Philippines, the offender used Philippine systems, or other jurisdictional facts exist. However, identification and evidence gathering may be slower because foreign platforms and foreign persons may require international legal cooperation.

The DOJ Office of Cybercrime acts as a central authority for certain cybercrime-related international cooperation. In practice, cross-border cases often take longer than cases where the offender and evidence are local.

If You Are a Filipino Abroad

You may still report online threats or doxxing affecting you or your family in the Philippines. If you need to execute documents abroad, prepare for consular acknowledgment or apostille requirements. A trusted representative in the Philippines may need a Special Power of Attorney to file or follow up documents for you.

If You Are a Foreigner in the Philippines

Foreigners can file cybercrime complaints in the Philippines. Bring your passport, local address, visa or ACR I-Card if applicable, and evidence. If evidence is in another language, provide an English translation. If you are abroad and the case is in the Philippines, documents executed outside the Philippines may need authentication or apostille.

If Intimate Photos or Videos Are Involved

Treat the matter as urgent. Preserve the threats, do not negotiate endlessly, and report promptly. Possible laws include RA 9995, RA 11313, RA 10175, and, depending on the relationship, RA 9262. If the victim is a child, RA 11930 and child protection laws may apply.

If the Threat Comes From an Ex-Partner

If the victim is a woman and the offender is a spouse, former spouse, person with whom she has or had a sexual or dating relationship, or person with whom she has a child, the conduct may also fall under the Anti-Violence Against Women and Their Children Act, RA 9262, especially if it causes psychological harm, intimidation, harassment, or control.

Frequently Asked Questions

Is doxxing illegal in the Philippines?

Doxxing can be illegal depending on the facts. It may violate the Data Privacy Act if personal information was maliciously or unlawfully disclosed. It may also involve threats, unjust vexation, gender-based online sexual harassment, cyberlibel, identity theft, voyeurism, or civil liability for invasion of privacy and damages.

Should I file with the NBI or PNP Anti-Cybercrime Group?

Either may receive cybercrime complaints. PNP-ACG has regional anti-cybercrime units and an eComplaint portal. NBI-CCD also handles computer crime investigation and forensic assistance. The better choice often depends on location, urgency, and which office can act faster. For serious or urgent threats, filing with the nearest available competent office is better than waiting for the “perfect” office.

Can I file a cybercrime complaint online?

You may start certain reports online, such as through the PNP-ACG eComplaint portal or official agency channels. However, formal investigation often still requires a sworn statement, identity verification, submission of evidence, and sometimes personal appearance.

Are screenshots enough evidence?

Screenshots are useful, but they are often not enough by themselves. Stronger evidence includes screenshots plus screen recordings, URLs, original device access, witness affidavits, profile links, email headers, payment details, and a clear timeline. The more complete the evidence, the easier it is to authenticate and investigate.

What if I only know the username?

You can still file. Identify the respondent by username, profile URL, phone number, email, channel name, or account link. Investigators may use proper legal processes to seek subscriber or traffic data, but success depends on available records, platform cooperation, and timing.

Can the barangay handle online threats and doxxing?

Barangay blotter or assistance may help for immediate local safety, especially if the offender is nearby. But serious online threats, cybercrime, privacy violations, intimate image threats, and anonymous accounts usually require PNP-ACG, NBI-CCD, the prosecutor, NPC, or specialized authorities. Barangay conciliation is not a substitute for urgent cybercrime investigation.

How long does a cybercrime complaint take?

Initial reporting may happen the same day. NBI’s Citizens Charter for computer crime assistance lists initial complaint steps that can be completed quickly at the intake level, but full investigation takes longer. Prosecutor preliminary investigation may take months, especially if the respondent is unknown or platform data is needed. Court cases can take years.

Can I ask Facebook, Telegram, or Google to reveal the offender?

A private person generally cannot force a platform to reveal subscriber information. Law enforcement or the court may need to use the proper warrant, disclosure, or international cooperation process. You can still report the content to the platform for takedown or account action.

What if the offender deleted the post?

A deleted post can still be part of a complaint if you preserved screenshots, recordings, links, notifications, witness statements, or archived copies. But deleted content is harder to verify, so report early and keep the original device.

Can I claim damages for doxxing or online threats?

Yes, damages may be possible in a criminal case with civil liability, a separate civil action, or proceedings involving privacy violations. Civil Code Articles 19, 20, 21, and 26 may be relevant when the conduct violates rights, privacy, dignity, or peace of mind.

Key Takeaways

Online threats and doxxing in the Philippines may involve several laws at once, including RA 10175, the Revised Penal Code, the Data Privacy Act, the Safe Spaces Act, RA 9995, RA 9262, and civil damages rules.
Preserve evidence before deleting, blocking, or reporting the post. Save screenshots, screen recordings, URLs, account details, timestamps, and the original device.
File with the right office. PNP-ACG and NBI-CCD handle cybercrime investigation; the prosecutor handles criminal complaints; the NPC handles privacy violations.
You can file even if you only know the username. Provide all available identifiers and let investigators determine what legal process is needed.
Doxxing is time-sensitive. Platform logs, subscriber information, and content may disappear or become harder to obtain.
Do not retaliate by doxxing back, hacking, or publicly spreading private information. It can create legal problems for you.
Foreigners and Filipinos abroad can still pursue Philippine remedies, but documents signed abroad may need consular acknowledgment, apostille, translation, or a Special Power of Attorney.
For threats involving intimate images, children, sexual harassment, or domestic abuse, treat the matter as urgent and consider both cybercrime and protection-related remedies.