Quick answer

Cyber libel is committed when a person publishes a defamatory statement through a computer system—such as social media, a website, email, or an online messaging platform—with the required identity, publication, and malice. It is punishable under Section 4(c)(4), in relation to Section 6, of the Cybercrime Prevention Act of 2012 and Articles 353 and 355 of the Revised Penal Code.

A complainant should preserve the complete electronic evidence and file a sworn complaint with the prosecutor’s office having territorial authority over the offense. A respondent should never ignore a subpoena: the counter-affidavit is the first major opportunity to challenge authorship, publication, identification, defamatory meaning, malice, venue, prescription, and the authenticity of the evidence.

The most urgent deadline is prescription. The Supreme Court has definitively ruled that cyber libel prescribes in one year from discovery of the defamatory material by the offended party, the authorities, or their agents—not automatically from the date it was posted. The discovery date is a factual matter that may require evidence. A takedown request, demand letter, or informal platform report should not be treated as a substitute for filing the proper criminal complaint. See Causing v. People, G.R. No. 258524, April 8, 2026.

Because venue, discovery, and authorship can be disputed, both sides should obtain Philippine criminal-law counsel as early as possible.

What the prosecution must prove

Cyber libel incorporates the elements of ordinary libel and adds the deliberate use of information and communications technology. The prosecution must establish beyond reasonable doubt:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. The statement was communicated to at least one person other than the person defamed. A post need not be visible to the entire internet. Publication in a group chat, private online group, email thread, or restricted account may suffice if a third person received it. A message seen only by its sender and the offended person ordinarily lacks this element, although another offense may apply.
Identification. The complainant was named or was reasonably identifiable from the words, photographs, surrounding circumstances, or information known to readers. Naming the person is not indispensable, but a vague statement about a large or undefined group may be insufficient.
Malice. Under Article 354, a defamatory imputation is generally presumed malicious even if true, unless it falls within a recognized privileged communication. Different constitutional standards apply when the statement concerns a public official, public figure, or matter of legitimate public interest.
Use of a computer system or similar technology. The defamatory material was published through information and communications technology.
Identity of the accused as the author or responsible publisher. It is not enough to show that a post existed. The prosecution must prove who created or published it.

Words are evaluated as a whole, in context, and according to how an ordinary reader would understand them. Hurt feelings, harsh criticism, sarcasm, profanity, or general abuse do not automatically constitute libel. The question is whether the communication makes or reasonably implies a discreditable factual imputation.

Authorship cannot be assumed from a profile name

A screenshot showing the respondent’s name or photograph is relevant but may not, by itself, prove account ownership or authorship. Accounts can be fabricated, impersonated, hacked, shared, or accessed by several people.

In XXX v. People, G.R. No. 274842, October 22, 2025, the Supreme Court explained that ownership, access, and authorship may be proved through direct or circumstantial evidence, including:

an admission of ownership, access, or authorship;
a witness who saw the person use the account or compose the communication;
information in the post known only to the alleged author or a small group;
distinctive language, writing habits, or other identifying characteristics;
platform, telecommunications, ISP, device, geolocation, or forensic records;
conduct consistent with the communication; and
the totality of other circumstances connecting the person to the account and post.

Technical platform or device evidence is useful but is not indispensable in every case. Conversely, a bare denial is not automatically sufficient if the surrounding evidence convincingly establishes authorship.

Malice, truth, public figures, and privileged communications

The general rule

Article 354 generally presumes malice from a defamatory publication. That presumption may be rebutted by evidence of good faith, proper purpose, reasonable verification, and the circumstances in which the statement was made.

Truth is not automatically a complete defense

“Pero totoo naman” is not, by itself, a complete answer. Under Article 361, truth must generally be accompanied by good motives and justifiable ends to produce an acquittal. The admissibility and effect of proving truth also depend on whether the statement imputed a crime, concerned a public officer’s official duties, or involved a private matter.

Documents, reliable sources, verification efforts, and the reason for publication therefore matter. Repeating a rumor without checking it may support a finding of reckless disregard.

Public officials, public figures, and matters of public interest

When a statement concerns a public official or public figure and relates to official conduct or a legitimate matter of public concern, the prosecution may have to prove actual malice—that the accused knew the statement was false or acted with reckless disregard for whether it was false.

Strong criticism, fair comment, and reasonable opinion on public affairs receive substantial constitutional protection. That protection does not extend to a knowingly false factual accusation or a reckless fabrication. Calling a statement “opinion” also does not end the inquiry if it implies undisclosed, provably false facts.

Qualifiedly privileged communications

Article 354 recognizes, among others:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without added remarks, of official proceedings or acts of public officers.

Qualified privilege is fact-dependent and can be defeated by actual malice. Unnecessary publication to people who had no legitimate interest, exaggerated accusations, personal hostility, or lack of any reasonable basis may undermine the defense.

Likes, shares, comments, and repeated posts

In Disini v. Secretary of Justice, G.R. No. 203335, February 18, 2014, the Supreme Court upheld cyber libel as applied to the original author but rejected its application to people who merely receive and react to a post. A bare “like” or similar reaction is therefore not automatically cyber libel.

That protection does not give a person immunity for writing a new defamatory caption, comment, quote-post, or separate accusation. Liability then depends on that person’s own words and publication.

The same act should not be punished simultaneously as both ordinary libel and cyber libel. Disini invalidated Section 7 of Republic Act No. 10175 insofar as it permitted double prosecution for the same online-libel act.

A defamatory social-media post is chargeable under the Cybercrime Prevention Act, not simply as ordinary libel under Article 355. Conduct before the law took effect cannot be punished retroactively. See Peñalosa v. Ocampo, Jr., G.R. No. 230299, April 26, 2023.

The one-year filing period

Cyber libel prescribes one year from the date the offense was discovered by:

the offended party;
the authorities; or
their agents.

The date of discovery may differ from the date of posting. Preserve evidence showing when the complainant or an authorized representative first learned of the post—such as messages forwarding it, emails, affidavits, access records, or the earliest saved copy.

Prescription is a defense. If it is not apparent from the Information, the accused may have to present evidence proving the relevant discovery date. The court cannot simply presume that discovery occurred on the posting date.

Filing the proper complaint for criminal investigation interrupts prescription under the Revised Penal Code. Do not wait until the final days or rely on a demand letter, barangay appearance, platform complaint, or private negotiation to stop the period.

Evidence to preserve immediately

Whether filing or defending, preserve evidence before accounts, posts, logs, or devices change.

Preserve the publication

Save:

full-page screenshots showing the exact words, images, account name, account URL or ID, date, time, and visible privacy setting;
the direct URL of the post, comment, video, or profile;
a screen recording showing navigation from the account profile to the publication;
the complete thread, preceding posts, replies, captions, linked material, and surrounding context;
visible reactions, shares, audience information, and comments;
downloaded copies of photographs, audio, video, and attachments;
platform notices, takedown responses, and data-download files; and
the original device on which the material was received or viewed.

Do not rely only on a cropped screenshot. Do not add annotations to the only copy or convert everything into a retyped transcript. Keep an untouched original and create separate working copies.

Preserve proof of publication and harm

Identify people who personally saw the material. Obtain sworn statements when appropriate. Preserve business cancellations, employment communications, medical or counseling records, and other documents offered to prove reputational or emotional harm. Damages still require competent proof.

Preserve evidence of authorship—or lack of it

Relevant material can include prior messages from the same account, admissions, recovery email or phone links, device records, login alerts, account-compromise notices, work or travel records, witnesses with access to the account, and communications showing impersonation or hacking.

A respondent alleging unauthorized access should promptly preserve security alerts, password-reset records, account-recovery requests, device inventories, and reports made to the platform or authorities. Do not fabricate a hacking claim or alter devices after learning of a case.

Electronic evidence must ultimately be authenticated. Philippine courts may admit electronic documents, photographs, video, and ephemeral communications when their accuracy and source are established by a competent witness or other admissible evidence. The Rules on Electronic Evidence apply.

How to file a criminal complaint

1. Assess whether every element is supported

Before filing, identify:

the exact defamatory words or material;
why they would dishonor or discredit the complainant;
how the complainant is identifiable;
who other than the complainant received or saw them;
why the respondent is the author or publisher;
the computer system or online platform used;
the discovery date;
the facts supporting the chosen venue; and
why privilege, fair comment, or another defense does not apply.

A complaint should not merely label a post “malicious” or “fake.” It should state material facts and attach the supporting evidence.

2. Determine the correct prosecutor’s office

A criminal complaint is ordinarily filed with the Office of the City or Provincial Prosecutor having territorial authority over the offense. A complainant may also seek case-building assistance from the NBI or the PNP cybercrime unit. The DOJ Office of Cybercrime may act on cybercrime complaints and referrals.

Online venue is technical. Nationwide accessibility does not automatically mean that a complaint may be filed anywhere. Counsel must examine Article 360 of the Revised Penal Code, Rule 110 of the Rules of Criminal Procedure, Republic Act No. 10175, and the facts showing where the offense or an essential element occurred. The Information must allege facts establishing venue. The Supreme Court discusses the special venue concerns surrounding electronic publication in Tieng v. Alaras, G.R. No. 164845, July 13, 2021.

Republic Act No. 10175 gives Regional Trial Courts jurisdiction over cybercrime violations. The case is normally assigned to an RTC branch designated to handle cybercrime cases.

3. Prepare the sworn complaint

Under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, a directly filed complaint ordinarily includes:

the original complaint-affidavit;
two duplicate copies for the prosecution office;
one copy for each respondent;
the NPS Investigation Data Form;
witness affidavits; and
indexed and properly identified supporting documents.

Local offices may require additional administrative copies, particular file formats, or proof of payment. Confirm the current checklist with the receiving office. The DOJ’s general filing checklist and fee schedule should be checked before filing.

The affidavit must be sworn before a prosecutor or another officer authorized to administer oaths. False statements can create separate criminal liability.

4. Participate in preliminary investigation

Cyber libel is subject to regular preliminary investigation because its prescribed imprisonment extends to eight years. The prosecutor evaluates whether there is prima facie evidence with reasonable certainty of conviction.

If the complaint is sufficient, the prosecutor issues a subpoena attaching the complaint and evidence. The hearing date must allow the respondent at least 10 days from receipt to submit a counter-affidavit. Clarificatory hearings may be held when necessary. Reply and rejoinder affidavits may be required, generally within the periods fixed by the 2024 rules.

The investigating prosecutor ordinarily has 60 calendar days from assignment to resolve the complaint, subject to a possible 30-day extension in specified situations. These are administrative disposition periods; delay does not automatically dismiss the complaint.

If probable cause and the DOJ evidentiary standard are met, the prosecutor prepares an Information for filing in the RTC. Otherwise, the complaint is dismissed.

5. Act promptly on an adverse resolution

An aggrieved party may generally file a verified motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. Further review follows the route prescribed by DOJ rules and depends on which prosecutor issued the decision.

If an Information has already been filed in court, a DOJ motion or petition does not automatically stop the criminal proceedings. The appropriate motion to suspend must be filed with, and granted by, the court.

How to defend during preliminary investigation

Record every deadline

Keep the subpoena, envelope, email, service record, and proof of the date received. The counter-affidavit deadline is short. Request an extension only when permitted and supported by a genuine reason; never assume it has been granted.

Failure to submit a counter-affidavit despite proper service may cause the prosecutor to resolve the case solely from the complainant’s evidence.

File a complete, evidence-supported counter-affidavit

The response should address each element and every material annex. Depending on the facts, defenses may include:

the words are not defamatory when read in full context;
they are rhetorical criticism, satire, or non-actionable abuse rather than a factual imputation;
no third person received the communication;
the complainant was not identifiable;
the respondent did not own, access, or control the account;
someone else authored or published the material;
the electronic evidence is incomplete, altered, misleading, or unauthenticated;
the statement was true and made with good motives and justifiable ends;
the communication was privileged;
it was fair comment on a matter of public interest;
actual malice has not been shown where constitutionally required;
the offense has prescribed;
the prosecutor or eventual court lacks territorial authority;
the alleged act occurred before the cybercrime law took effect; or
the same act is being impermissibly charged as both ordinary and cyber libel.

Attach supporting documents and witness affidavits instead of relying on a bare denial. A verified motion raising substantive defenses may be treated as the counter-affidavit under the DOJ rules, so the document should be prepared with care.

Protect devices and accounts lawfully

Do not delete posts, wipe devices, destroy messages, coach witnesses, or fabricate account-compromise evidence. Preserve the material even if it is unfavorable.

Before voluntarily surrendering a device, disclosing passwords, or signing a consent form, obtain legal advice about the scope of the request. Investigators can seek preservation, disclosure, interception, or search authority under Republic Act No. 10175 and the Supreme Court’s Rule on Cybercrime Warrants. A respondent must not obstruct a lawful warrant.

What happens after the Information is filed

The court independently determines whether probable cause exists for issuing a warrant of arrest. If a warrant is issued, arrange a lawful surrender and bail through counsel. Because cyber libel is not punishable by reclusion perpetua, life imprisonment, or death, bail is generally a matter of right before conviction, although the court sets the amount and conditions.

Before entering a plea, counsel should examine whether a motion to quash is available. Certain objections can be waived if not raised before arraignment. Possible grounds include lack of jurisdiction, improper allegations, extinction of criminal liability by prescription, or double jeopardy. When prescription depends on a discovery date not shown in the Information, evidence and a hearing may be necessary.

The case then proceeds through arraignment, pretrial, trial, and judgment. The prosecution must prove both the offense and the accused’s identity beyond reasonable doubt. Probable cause at preliminary investigation is not proof of guilt.

A criminal appeal ordinarily must be initiated within 15 days from promulgation of the judgment or notice of the appealable final order. A timely motion for new trial or reconsideration affects the running of that period under Rule 122. A convicted accused should obtain appellate advice immediately rather than wait for the deadline.

Possible penalties and civil liability

Ordinary libel under Article 355 carries prisión correccional in its minimum and medium periods or a fine of ₱40,000 to ₱1,200,000, or both, as adjusted by Republic Act No. 10951.

For cyber libel, Section 6 of Republic Act No. 10175 raises the penalty by one degree. The imprisonment range is therefore prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months, and one day to eight years, subject to the rules governing the actual sentence.

The Supreme Court has ruled that a court may impose a fine instead of imprisonment. For online libel, the fine may range from ₱40,000 to ₱1,500,000. The exact penalty depends on the judgment and applicable circumstances. See People v. Soliman, G.R. No. 256700, April 25, 2023.

A conviction may also include civil damages. Separately, Article 33 of the Civil Code permits an independent civil action for defamation, subject to the rules against double recovery. The burden of proof, parties, available damages, and prescription of a civil action are not necessarily identical to those in the criminal case.

Retraction, apology, settlement, and desistance

A prompt correction, takedown, or sincere apology may reduce harm and may become relevant to motive, damages, or settlement. It does not automatically erase a completed offense.

Cyber libel is prosecuted in the name of the People of the Philippines. An affidavit of desistance or private settlement does not compel the prosecutor or court to dismiss the case, particularly when sufficient independent evidence remains. Any settlement should be voluntary, documented, and reviewed by counsel. Demands for money tied to threats of exposure or prosecution can create separate legal problems.

Common mistakes

Mistakes by complainants

Filing because a statement is insulting without identifying a defamatory factual imputation.
Saving only a cropped screenshot.
Failing to preserve the URL, account ID, complete thread, date, and original device.
Assuming the account name proves the author’s identity.
Omitting the discovery date or evidence showing when discovery occurred.
Filing wherever convenient without establishing venue.
Waiting for platform action while the one-year period runs.
Exaggerating reputational harm without documents or witnesses.
Treating truth as irrelevant when the respondent may have reliable supporting records.

Mistakes by respondents

Ignoring the subpoena or relying on an informal explanation.
Posting new attacks against the complainant or discussing evidence publicly.
Deleting accounts, messages, or device contents.
Submitting only a bare denial of authorship.
Claiming “opinion” when the post clearly implies specific facts.
Assuming truth alone ends the case.
Raising prescription without evidence of the discovery date.
Entering a plea before counsel evaluates a motion to quash.
Assuming a DOJ review automatically suspends the RTC case.

When legal help is urgent

Seek counsel immediately when:

the one-year prescriptive period may be close;
a subpoena, prosecutor’s resolution, Information, warrant, or court order has been received;
the respondent or account owner is unidentified;
platform or telecommunications records may soon be lost;
the post concerns a public official, journalist, activist, or matter of public interest;
several posts, respondents, jurisdictions, or countries are involved;
a device search, data-disclosure request, or cybercrime warrant is anticipated;
the publication includes threats, stalking, doxxing, intimate images, sexual harassment, or personal-data exposure; or
arrest, immediate physical danger, or retaliation is threatened.

Threats, intimate-image abuse, gender-based online sexual harassment, identity theft, or unauthorized disclosure of personal information may fall under laws other than cyber libel. Report immediate danger to law enforcement without waiting for the defamation case.

Frequently asked questions

Can a case proceed after the post is deleted?

Yes. Deletion does not erase a completed publication if admissible evidence proves the post, its contents, publication, authorship, and other elements. Deletion may, however, make authentication and attribution harder.

Is one screenshot enough?

It can be evidence, but its weight depends on authentication and context. A complete, unedited capture supported by a witness, URL, device, account history, or platform records is much stronger than a cropped image forwarded through several people.

Can I file against a dummy or anonymous account?

Investigation may begin, but the prosecution must ultimately identify the responsible person. Law enforcement may seek preservation and disclosure orders or cybercrime warrants. Contact investigators promptly because private parties cannot compel a platform or telecommunications provider to disclose protected subscriber data on their own.

Is every false Facebook post cyber libel?

No. The post must satisfy every element of libel, identify the complainant, be published to a third person, be attributable to the accused, involve the required malice, and use a computer system. Other laws may apply to false statements that do not constitute libel.

Is truth always a defense?

No. Philippine criminal libel law generally requires truth together with good motives and justifiable ends, and special evidentiary rules apply depending on the subject of the accusation.

Can a private message be cyber libel?

It may be if it reaches a third person. A one-to-one message seen only by the complainant ordinarily lacks publication, although threats, harassment, or another offense may still be present.

Can someone be charged merely for liking or sharing a post?

A mere receiver or reactor is not automatically liable for cyber libel under Disini. A person who adds a new defamatory caption, comment, or accusation may be liable for that person’s own publication.

Can the complainant withdraw the case?

The complainant may execute a desistance or enter a lawful settlement, but dismissal is not automatic. Once a criminal case is filed, the public prosecutor represents the People and the court controls the proceedings.

How long do I have to file?

One year from discovery by the offended party, authorities, or their agents. Because discovery and interruption can be disputed, have counsel calculate the deadline from the documents and file well before it.

Does conviction always mean imprisonment?

No. The Supreme Court has confirmed that courts may impose a fine instead of imprisonment in online-libel cases. The lawful fine range and any civil damages still depend on the judgment.

Official sources

This article provides general Philippine legal information, not advice for a specific case. Outcomes depend on the exact words, complete context, dates, documents, parties, evidence, and proper venue. Procedural rules and agency practices can change. Sources and current law were checked as of July 23, 2026.