Quick answer

To file a Philippine cyber libel case, preserve the complete online publication and proof of authorship, identify facts establishing the proper venue, and file a sworn complaint with the appropriate city or provincial prosecution office—normally within one year from discovery of the allegedly defamatory post. Filing the complaint or information interrupts that period. A report to a social-media platform, police blotter, demand letter, or informal agency inquiry should not be assumed to stop the clock.

To defend a case, do not ignore a prosecutor’s subpoena. Obtain the complete complaint and attachments, preserve your account and device records, and file a sworn counter-affidavit by the date stated in the subpoena. Under the current DOJ preliminary-investigation rules, that date must ordinarily give the respondent at least 10 days from receipt of the subpoena and complaint-affidavit. Possible defenses include lack of authorship, publication, identifiability, defamatory meaning, or malice; privilege; prescription; improper venue; and the constitutional protections applicable to speech about public officers or public figures.

Cyber libel is criminal, not merely a claim for hurt feelings or reputational damage. Every required element must be supported by admissible evidence, and guilt must ultimately be proved beyond reasonable doubt.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 covers libel under Article 355 of the Revised Penal Code when committed through a computer system or similar means. It can apply to original material published through social media, websites, messaging platforms, email, or other information and communications technology.

A viable charge generally requires proof of all the following:

A defamatory imputation. The statement imputes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. Someone other than the person defamed received, read, heard, or saw the statement. A private message sent only to the person concerned ordinarily lacks this element, although forwarding or copying other people may supply it.
Identifiability. The offended person was named or could reasonably be identified from the words, images, surrounding facts, or context. It is not enough that the complainant personally believes the post referred to them.
Malice. As a general rule, a defamatory publication is presumed malicious unless it falls within a recognized privileged communication. Different constitutional standards apply when the statement concerns a public officer, public figure, or matter protected as public discussion.
Use of a computer system or similar technology.
Responsibility for the publication. The prosecution must connect the respondent to the account and the actual authorship or publication of the statement. A displayed profile name, by itself, may not resolve disputed authorship.

The publication must be assessed as a whole, in its language and real context. Satire, rhetorical exaggeration, criticism, opinion, and insults are not automatically cyber libel—but calling something “opinion” does not protect a statement that reasonably implies false, defamatory facts.

Original authors, shares, likes, and comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but declared it unconstitutional as applied to people who merely receive and react to a post. A bare “like,” simple reaction, or unadorned share should not automatically create cyber-libel liability.

That protection is not a license to add new defamatory material. A person who writes an independent defamatory caption, comment, accusation, edited image, or republication may become the original author of that new publication. Liability therefore depends on exactly what that person created and communicated—not simply which platform button was used.

The same online act should also not be punished twice as both traditional libel and cyber libel. Disini invalidated the Cybercrime Prevention Act’s cumulative-liability provision insofar as it would allow double punishment for the same defamatory act.

The one-year filing deadline

The controlling rule is now clear: cyber libel prescribes in one year from discovery of the alleged publication by the offended party, the authorities, or their agents.

The Supreme Court first adopted this rule in Causing v. People and affirmed it en banc in 2026. The period is governed by Articles 90 and 91 of the Revised Penal Code, not a 12-year or 15-year period. It is interrupted by filing the complaint or information. The Supreme Court’s 2026 resolution and official summary explain the current rule.

The discovery date is a factual matter. A complainant should document when and how the post was first found, who showed it, and whether the complainant had earlier knowledge of it. A respondent relying on prescription should gather evidence of an earlier discovery date rather than assuming the publication date and discovery date are identical.

Do not wait until the final days. Time may be lost resolving venue, identifying an anonymous account, obtaining records, correcting an affidavit, or satisfying receiving-office requirements. A civil action for defamation is also generally subject to a one-year period, although its cause of action and computation should be reviewed separately.

Evidence to preserve immediately

Whether filing or defending, preserve evidence before reporting, blocking, editing, deleting, or contacting the other side.

Keep:

Full-page screenshots showing the exact words, images, profile name, date and time, audience or privacy setting, comments, and surrounding conversation.
The direct URL or permanent link to the post and the URL of the account or page.
A screen recording showing how the post is reached from the profile or page.
The complete thread, not only the most damaging sentence.
Original downloaded files, messages, emails, photographs, videos, voice recordings, and attachments.
Platform notifications, message headers, account-export data, and available metadata.
The device on which the content was received or created, without resetting or overwriting it.
Proof of the discovery date.
Names and sworn statements of people who personally saw the publication.
Evidence connecting the account to its alleged operator, such as prior admissions, linked contact details, consistent account activity, or authenticated communications.
For a defense, login alerts, device histories, account-recovery notices, compromise reports, travel records, work records, drafts, sources, research notes, and communications showing the basis and purpose of the publication.
Proof of actual harm, if damages are claimed: lost clients, cancelled contracts, disciplinary action, medical treatment, or other documented consequences.

Screenshots are useful but are not automatically conclusive. Electronic evidence must still be authenticated and shown to be reliable. Preserve original files and devices, and consider having a lawyer or competent digital-forensics professional document file hashes, metadata, and chain of custody.

Service providers retain different categories of data for limited periods. Under the Cybercrime Prevention Act, law-enforcement authorities—not private complainants acting alone—may issue lawful preservation orders and seek disclosure or cybercrime warrants. If the account is anonymous, deleted, or likely to disappear, approach the NBI Cybercrime Division or another authorized cybercrime unit promptly. Identification is not guaranteed, particularly when records are unavailable, overseas, or technically inconclusive.

How to file a criminal complaint

1. Test the facts against every element

Quote the exact publication and explain:

What fact or accusation it communicates.
Why it is defamatory in context.
How the complainant was identified.
Who other than the complainant saw it.
Why the respondent is believed to be the author.
How a computer system was used.
What facts support malice or defeat an expected claim of privilege.
When and how the publication was discovered.
What facts establish venue.

A complaint should not merely attach screenshots and state that the post was “libelous.” The affidavit must connect the evidence to the legal elements.

2. Establish the proper venue

Criminal actions under Sections 4 and 5 of the Cybercrime Prevention Act must be filed before a designated cybercrime court in the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where any damage to a natural or juridical person occurred.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others.

At the complaint stage, file with the prosecution office corresponding to a legally supportable venue. Do not rely only on the claim that an internet post could be accessed everywhere. State concrete facts: where the author allegedly operated the device, where a recipient viewed the publication, where a relevant computer system was located, or where actual reputational damage occurred. Separate civil actions may have additional venue rules.

3. Obtain investigative assistance when necessary

A complainant may first seek technical assistance from the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DOJ Office of Cybercrime, especially when:

The account is anonymous or impersonating someone;
Provider records or forensic examination may be needed;
The publication has been deleted;
The device or account was allegedly compromised; or
Other offenses—such as threats, unlawful access, identity theft, stalking, or non-consensual intimate-image publication—may also be involved.

An investigative report can support the complaint, but do not assume that an agency inquiry, platform report, or police blotter interrupts prescription. Confirm that a formal complaint has been filed in the proper proceeding within the one-year period.

4. Prepare the complaint-affidavit and attachments

The complaint-affidavit should be sworn before an authorized officer and should ordinarily include:

The parties’ identifying and contact information;
A chronological statement based on personal knowledge;
The exact allegedly defamatory material;
The publication, discovery, and venue facts;
An explanation of authorship and identifiability;
A numbered list of supporting exhibits;
Witness affidavits where available; and
A certification regarding the truth and authenticity of the submission.

The DOJ’s current filing checklist calls for an Investigation Data Form, sworn affidavits, and supporting documents, with multiple copies. Confirm the exact copy, electronic-filing, oath, identification, and fee requirements with the receiving prosecution office because implementation may differ by office and filing method.

Keep the receiving copy, official receipt, docket number, and proof of the filing date.

5. Preliminary investigation

Cyber libel carries a sufficiently serious prescribed penalty to require preliminary investigation. Under DOJ Department Circular No. 15, series of 2024, the prosecutor initially evaluates the complaint and may recommend dismissal if the evidence is plainly insufficient.

If the case proceeds, the respondent receives a subpoena with the complaint and attachments and is directed to submit a counter-affidavit. The current prosecutorial standard is prima facie evidence with reasonable certainty of conviction, a standard the Supreme Court upheld in 2026.

If the prosecutor finds sufficient basis, an information is filed in the proper Regional Trial Court designated as a cybercrime court. The judge independently evaluates whether probable cause exists for a warrant of arrest. A prosecutor’s finding is not a conviction; the prosecution must still prove guilt beyond reasonable doubt at trial.

How to defend at the prosecutor stage

Act immediately on the subpoena

Record the exact date, time, and manner of receipt. Check whether the complaint-affidavit and every referenced attachment were included. The subpoena’s submission date must ordinarily be at least 10 days from receipt of the subpoena and complaint, but the stated date controls unless officially extended.

If records are missing or unusually voluminous, make a written request for access and appropriate time immediately. Do not simply miss the deadline. Failure to respond after proper service may cause the prosecutor to resolve the complaint using only the complainant’s evidence.

A motion to dismiss should not be used as a substitute for a proper sworn counter-affidavit. Put factual and legal defenses, supporting documents, and witness affidavits into the authorized pleading.

Answer element by element

A useful counter-affidavit addresses, with evidence:

Authorship: Did the respondent create or publish the material? Was the account shared, spoofed, hacked, or falsely attributed?
Exact content: Is the complainant quoting selectively or changing the meaning by removing context?
Defamatory meaning: Does the material assert a defamatory fact, or is it protected criticism, rhetorical expression, satire, or an opinion not implying undisclosed false facts?
Identifiability: Would a reasonable reader actually recognize the complainant?
Publication: Did any third person receive the statement?
Computer use: Was the alleged publication actually made through a covered system?
Malice and privilege: What duty, occasion, sources, verification, good faith, or public interest explains the communication?
Truth and basis: What admissible records or firsthand sources support the statement?
Prescription: When did the complainant, authorities, or their agents first discover the material?
Venue: What acts or damage genuinely connect the case to the selected city or province?
Procedural fairness: Were the complete complaint and evidence served, and was an adequate opportunity to respond provided?

Avoid blanket denials. Attach the records that make each denial credible.

Preserve rather than delete

Deleting a post after receiving notice does not erase copies, platform records, or prior publication. It may also destroy material needed to show context, account compromise, editing history, or lack of malice. Preserve first and obtain advice before changing content or devices.

Do not contact witnesses to influence their accounts, publicly attack the complainant, or create new posts about the dispute. New statements may become separate evidence or separate causes of action.

Respond quickly to an adverse resolution

If the prosecutor recommends filing an information, obtain the complete resolution immediately. Possible remedies may include reconsideration, a DOJ petition for review, or judicial relief for grave abuse of discretion. Their availability, destination, and deadlines depend on the issuing office, the procedural stage, and applicable DOJ rules.

Once an information is filed, coordinate with counsel about the court record, any warrant, bail, arraignment, and pre-trial deadlines. Cyber libel is ordinarily bailable before conviction, but the amount and conditions must be resolved through the proper court. Do not evade service or attempt an informal arrangement with court personnel.

Important defenses and exceptions

Privileged communications

Article 354 of the Revised Penal Code recognizes qualified privileges that include:

A private communication made to another person in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments, of non-confidential official proceedings or acts of public officers.

The occasion, audience, wording, necessity, and good faith all matter. A qualified privilege may be defeated by proof of actual malice. Statements made in judicial or legislative proceedings may have broader protection when relevant to the proceeding, but the exact privilege should be assessed by counsel.

Public officers and public figures

When the complainant is a public officer or public figure and the publication concerns official conduct or a matter within the protected public discussion, malice cannot simply be presumed. The prosecution must prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false.

Harsh criticism and even factual error are not automatically criminal. But the rule does not protect knowingly false accusations or reckless fabrication. A publisher should preserve research, sources, requests for comment, corrections, and other records showing how the statement was verified.

Whether someone is a public figure, and whether the statement relates to public conduct, are fact-specific questions.

Truth, good motives, and justifiable ends

“Truth is a complete defense” is an unsafe oversimplification. Article 361 contains specific rules on when proof of truth is admissible, including imputations of crime and statements relating to a public officer’s official duties. Acquittal under the statutory defense also requires proof of good motives and justifiable ends.

A respondent should therefore show not only why the statement was accurate, but also the reliable sources, legitimate purpose, intended audience, and reasonable steps taken before publication.

Lack of authorship or account compromise

The prosecution must prove responsibility for the publication. If an account was compromised, preserve:

Security alerts and password-reset emails;
Login histories, IP or device records available from the platform;
Reports made to the platform or authorities;
Evidence of when access was lost and recovered; and
Forensic findings from the relevant device.

A bare assertion that “my account was hacked” is rarely persuasive without supporting records.

Prescription and improper venue

Both defenses can dispose of a case, but both depend on evidence. A respondent claiming prescription should prove the discovery date. A venue objection should identify the absence of facts connecting the alleged offense, computer system, or damage to the chosen location.

Criminal penalties and civil exposure

Section 6 of the Cybercrime Prevention Act raises the penalty by one degree when the offense is committed through information and communications technology. The prescribed imprisonment range for cyber libel is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years. A fine, or both imprisonment and a fine, may be imposed under the applicable statutes.

The Supreme Court’s rule expressing a preference for fines in appropriate libel cases does not decriminalize cyber libel and does not guarantee that imprisonment will be avoided. Sentencing depends on the law, circumstances, and court’s findings.

Civil liability may be pursued with the criminal case unless waived, reserved, or separately instituted as permitted by law. Article 33 of the Civil Code also recognizes an independent civil action for defamation, proved by a preponderance of evidence. Because Rule 111, Article 33, Article 360, and prescription can affect how criminal and civil remedies interact, obtain advice before filing parallel cases or making a reservation.

Common mistakes

Waiting for a retraction or platform response while the one-year period runs.
Assuming a police report, barangay complaint, demand letter, or platform report stops prescription.
Filing in the most convenient city without concrete venue facts.
Submitting cropped screenshots without URLs, dates, account details, or context.
Accusing the named account owner without evidence of actual authorship.
Treating every insult or negative review as a defamatory factual imputation.
Assuming truth alone always ends the case.
Ignoring the higher actual-malice requirement for speech about public officers or public figures.
Filing both ordinary libel and cyber libel charges for the same online act.
Deleting devices, messages, drafts, or account histories.
Ignoring a subpoena or filing an unsworn, unsupported denial.
Publishing retaliatory accusations while the complaint is pending.
Paying or signing a settlement without addressing criminal, civil, takedown, confidentiality, and release terms together.

When legal help is urgent

Seek a Philippine lawyer experienced in criminal and cybercrime procedure immediately if:

The one-year anniversary of discovery is approaching.
A prosecutor’s subpoena, court order, warrant, or summons has been received.
Police or investigators want to search, seize, or examine a phone, computer, or account.
The author is anonymous or the post has been deleted.
The account may have been hacked or impersonated.
The publication involves a journalist, public officer, public figure, election issue, or official proceeding.
The content also includes threats, stalking, doxxing, intimate images, a minor, identity theft, or unlawful access.
Several posts, authors, platforms, countries, or possible venues are involved.
A settlement, retraction, takedown, or public apology is being negotiated.

People who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility and conflict rules.

Frequently asked questions

Is a demand letter required before filing?

Generally, no. A demand, correction request, or request for retraction may be strategically useful, but it is not ordinarily a prerequisite to a criminal cyber-libel complaint and does not automatically stop prescription.

Is one screenshot enough?

Not necessarily. It may prove what appeared on a screen but not authorship, authenticity, complete context, publication to a third person, or the discovery date. Preserve the URL, profile, thread, original files, device, witnesses, and metadata.

Can I file against an anonymous account?

An investigation may begin using the available account and publication evidence, but lawful process may be needed to identify the operator. Provider data may be unavailable, held abroad, or insufficient. Seek investigative assistance early.

Can someone be charged merely for sharing or liking a post?

A person who merely receives and reacts to another’s post is not criminally liable for cyber libel under Disini. A person who adds an independent defamatory accusation or creates a new defamatory publication may be assessed as the author of that new content.

Does deleting the post prevent prosecution?

No. Publication may already have occurred, and copies or provider records may remain. Preserve evidence before deletion and obtain advice about takedown or correction.

Can an honest mistake still be cyber libel?

Possibly, depending on the complainant, subject, privilege, verification, and state of mind. For public officers and public figures, the prosecution must prove actual malice when the constitutional standard applies. Private-person cases may follow the statutory presumption of malice unless privilege or another defense is established.

Can the complainant pursue both criminal charges and damages?

Yes, but the civil claim may be deemed included in the criminal case or may proceed independently under Article 33, depending on how it is instituted or reserved. The one-year civil limitation and special venue rules require prompt, coordinated advice.

Where should the complaint be filed?

Begin with the city or provincial prosecution office corresponding to a venue supported by the Rule on Cybercrime Warrants—where an element occurred, a relevant part of the computer system was situated, or actual damage occurred. Venue should be established with facts, not merely nationwide internet accessibility.

Key primary and official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel liability depends on the exact publication, evidence, parties, venue, and procedural history. Sources and procedures checked as of July 23, 2026.