Quick answer

A Philippine cyber libel case usually begins with a sworn complaint and supporting digital evidence filed with the proper City or Provincial Prosecutor’s Office. The prosecutor conducts a preliminary investigation and decides whether the evidence justifies filing an Information in a designated Regional Trial Court acting as a cybercrime court.

A complainant must prove more than an offensive or damaging post. The evidence must support every element of libel, publication through a computer system, the respondent’s identity as the author, and the proper venue. A respondent should not ignore a prosecutor’s subpoena: the counter-affidavit is the main opportunity to present defenses and evidence before charges reach court.

Time is critical. The Supreme Court has ruled—and reaffirmed in April 2026—that cyber libel generally prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Filing the proper complaint or Information interrupts prescription. A platform report, demand letter, barangay blotter, or informal police inquiry should not be assumed to do so.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 covers libel under Articles 353 and 355 of the Revised Penal Code when committed through a computer system or a similar technological means.

The prosecution generally must establish:

A defamatory imputation. The material imputes a crime, vice, defect, act, omission, condition, status, or circumstance tending to cause dishonor, discredit, or contempt.
Identification. The offended person or juridical entity is named or is sufficiently identifiable to people who know the surrounding facts.
Publication. The imputation was communicated to at least one person other than the offended party.
Malice. Malice may be presumed in an unprivileged defamatory imputation, subject to constitutional and statutory defenses. In cases involving public officers, public figures, or privileged discussion of public matters, proof of actual malice may be required.
Use of a computer system. The publication occurred through social media, a website, email, an online forum, a messaging application, or another covered digital system.
Authorship or legal responsibility. The respondent must be shown to have authored or published the actionable material. Ownership of a name, profile photograph, or account label alone may not reliably establish who controlled the account when the post was made.

The full context matters. A statement does not become cyber libel merely because it is insulting, harsh, unpopular, embarrassing, or false. Conversely, calling something an “opinion,” joke, meme, question, blind item, or satire does not automatically protect it if the overall message communicates a defamatory assertion of fact.

A private message sent only to the person discussed ordinarily lacks publication to a third person. A group chat, copied email, forwarded message, or restricted social-media post may still satisfy publication if someone other than the offended person received it.

Who may be liable?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author of the online statement. It did not extend liability merely to people who receive a post and react by pressing “Like,” “Comment,” or “Share.”

That rule should not be overstated. A person who writes a new defamatory caption, adds an independently defamatory comment, creates a materially altered post, or publishes their own accusation may become the original author of that new material. Liability depends on what the person actually wrote or caused to be published, not simply on the platform button used.

The same online act should not be punished twice as both ordinary libel under Article 355 and cyber libel under Section 4(c)(4). Disini declared Section 7 of the Cybercrime Prevention Act unconstitutional insofar as it permits duplicate prosecution and punishment for libel and cyber libel based on the same act.

The one-year deadline

The controlling rule is now clear: cyber libel prescribes in one year, not 12 or 15 years.

Under Articles 90 and 91 of the Revised Penal Code, the period begins when the alleged cyber libel is discovered by the offended party, the authorities, or their agents. It is interrupted by the filing of the complaint or Information. The Supreme Court adopted this rule in Causing v. People and denied the motions for reconsideration in its April 8, 2026 Resolution.

The Court also ruled that an offended person is not automatically presumed to have discovered a social-media post on its publication date merely because the post was public or widely accessible. Discovery is factual and may be shown by messages, reactions, comments, threats to sue, reports to authorities, or other conduct demonstrating actual knowledge.

For complainants:

Record the exact date and circumstances of discovery.
File well before the anniversary date; do not plan around the final day.
Obtain a stamped receiving copy and docket number from the proper prosecution office.
Do not assume that sending a demand, reporting the post to a platform, or asking police for advice interrupts prescription.

For respondents:

Investigate when the complainant, authorities, lawyer, employee, relative, or authorized agent first learned of the material.
Preserve reactions, comments, correspondence, earlier screenshots, and public statements that may establish an earlier discovery date.
Raise prescription promptly, but recognize that a factual dispute over discovery may require evidence and cannot always be resolved from the post date alone.

A civil action for defamation also generally has a one-year limitation under Article 1147 of the Civil Code. Different causes of action can involve different rules, so the documents and requested relief should be reviewed before relying on any deadline.

Evidence to preserve immediately

Digital material can be deleted, edited, renamed, restricted, or detached from its original account. Preserve it before demanding removal or engaging with the author.

Keep:

Full-page screenshots showing the post, account name, profile details, date, time, reactions, comments, and surrounding conversation
The complete URL or permanent link, not only a cropped image
Screen recordings showing how the content was accessed
Original downloaded images, videos, audio, emails, or message exports
The original device on which the post or message was received
Notification emails and platform-generated alerts
Account identifiers, usernames, profile URLs, user IDs, and visible contact details
Earlier and later versions of edited content
Messages showing admissions, threats, motives, corrections, or apologies
Names and contact details of people who personally saw the publication
Evidence connecting the account to its alleged operator
Records showing when the offended party or authorities first discovered the post
Documents proving or disproving the accusation
Evidence of actual reputational harm, such as cancelled contracts or messages from clients, while protecting unrelated private information

Do not crop away context, alter file names unnecessarily, annotate the only copy, or rely exclusively on a forwarded screenshot. Maintain an untouched copy and note who collected each item, when it was collected, and from what device or account.

The Rules on Electronic Evidence require electronic evidence to be authenticated. A screenshot is useful, but the person offering it must still be able to explain its source, accuracy, and connection to the relevant account. The NBI Cybercrime Division or another qualified investigator may be needed when authorship is disputed, the account is anonymous, or platform records must be obtained lawfully.

Under the Cybercrime Prevention Act, certain traffic data and subscriber information are subject to preservation periods, and law-enforcement authorities may require further preservation. Disclosure, interception, search, seizure, and examination of protected computer data ordinarily require the procedures in the Supreme Court’s Rule on Cybercrime Warrants. A private complainant should not attempt to hack an account, impersonate another person, install spyware, or obtain private communications unlawfully.

How to file a complaint

1. Assess the words and their context

Identify the exact words, image, audio, or video claimed to be defamatory. Explain:

What factual imputation it communicates
Why it refers to the complainant
Who received or saw it
Why it is defamatory in context
How and when it was published online
Why the named respondent is believed to be the author
When and how the complainant discovered it
Where the legally relevant acts, computer system, or damage occurred

Do not substitute a long narrative of the parties’ entire dispute for proof of each element.

2. Determine the proper venue

Venue in a criminal case is jurisdictional. Section 2.1 of the Rule on Cybercrime Warrants provides that actions for Section 4 cybercrime offenses are filed before the designated cybercrime court of the province or city:

Where the offense or any element was committed
Where any part of the computer system used was situated
Where any of the damage to a natural or juridical person occurred

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of the others.

Written-defamation venue rules under Article 360 and the Supreme Court’s anti-harassment decisions may also affect the analysis. Merely alleging that an internet article was first accessed in a particular city is not necessarily the same as proving that it was printed and first published there. Because an incorrect venue may defeat the case, the proper prosecution office and designated cybercrime court should be confirmed before filing.

3. Prepare the complaint-affidavit

The complaint-affidavit should be sworn before a prosecutor, an authorized government officer, or, when permitted, a notary public. It should clearly identify the parties, material dates, place, method of publication, discovery date, exact defamatory material, witnesses, and supporting evidence.

Under the 2024 DOJ–National Prosecution Service Rules, the filing generally includes:

The original complaint-affidavit
Two duplicate copies
An additional copy for each respondent
The completed NPS Investigation Data Form
Witness affidavits
Documentary and electronic evidence
Available real or physical evidence
The respondent’s complete last-known address and proof supporting it

Confirm the current receiving requirements of the particular prosecution office. An online report to the NBI or another agency is not necessarily the formal complaint-affidavit required to commence the prosecutor’s case.

4. Consider investigative assistance

A complainant may go directly to the proper prosecution office when the evidence is complete. Assistance from the NBI Cybercrime Division or the PNP Anti-Cybercrime Group may be important when:

The account is anonymous or impersonating someone
Subscriber or traffic information is needed
A device requires forensic examination
The post may disappear before formal process can be obtained
Authorship, metadata, or account control is genuinely disputed
Other offenses—such as threats, unlawful access, identity theft, stalking, or non-consensual intimate-image distribution—may also be involved

An investigator’s report can assist the case, but the prosecutor independently evaluates whether the evidence meets the applicable standard.

5. Preliminary investigation

Cyber libel carries a possible maximum imprisonment exceeding six years, so it falls under the regular preliminary-investigation process of the 2024 DOJ-NPS Rules.

Before docketing, the prosecution office evaluates whether the complaint is sufficient in form and whether its evidence is complete. It may require further case build-up. If the case proceeds, the investigating prosecutor issues a subpoena with the complaint and attachments.

The DOJ standard is prima facie evidence with reasonable certainty of conviction. The evidence should be admissible, credible, capable of preservation and presentation at trial, and sufficient—if left uncontradicted—to establish every element and the respondent’s identity. The Supreme Court upheld the validity of this standard in Meking v. Remulla.

The respondent is given a filing date at least 10 days after receipt of the subpoena and complaint papers to submit a counter-affidavit. The prosecutor may then resolve the case, conduct a physical or virtual clarificatory hearing, or require further affidavits when necessary.

If sufficient evidence exists, the prosecutor prepares an Information for filing in the designated RTC. The trial judge must independently determine judicial probable cause before issuing an arrest warrant.

How to defend after receiving a subpoena

1. Record the date of receipt

Keep the envelope, registry return card, receiving stamp, email headers, or process server’s documents. The period to respond is tied to receipt. Check whether all complaint affidavits and attachments listed in the subpoena were actually supplied.

2. Obtain counsel immediately

A prosecutor’s subpoena is not a conviction or, by itself, an arrest warrant. It is nevertheless a formal proceeding that can lead to an Information in court.

Do not ignore it. If the respondent fails to submit a counter-affidavit without adequate justification after proper service at the last-known address, the prosecutor may resolve the case using the complainant’s evidence alone.

An extension is not automatic. The 2024 DOJ-NPS Rules allow one only when the interest of justice requires additional time, such as to obtain counsel or examine and verify important evidence. Any request should be filed before the deadline.

3. Preserve the account and device

Do not wipe, reset, sell, replace, or manipulate a relevant device. Preserve account-security records, login alerts, access history, recovery emails, and evidence of hacking or shared account access. Deleting a post after receiving the complaint may remove helpful context and create an appearance of concealment.

4. Prepare a fact-specific counter-affidavit

The defense should address each element rather than rely on a blanket denial. Depending on the evidence, issues may include:

The respondent did not author or control the account
The complainant was not identifiable
No third person received the communication
The words do not make a defamatory factual imputation in context
The exhibit is incomplete, altered, unauthenticated, or disconnected from its claimed source
The publication occurred before the Cybercrime Prevention Act could lawfully apply
The communication was privileged
The subject was a public officer, public figure, or matter of public concern and actual malice is absent
The imputation was true and made with good motives and justifiable ends, where Article 361 permits that defense
The action prescribed before the complaint was filed
Venue is improper
The respondent merely received or reacted to another person’s post
The same act is being impermissibly charged as both ordinary and cyber libel

Attach witness affidavits and the underlying records. A motion to dismiss filed instead of a counter-affidavit is generally not allowed unless verified and sufficiently setting out the respondent’s defenses, in which case it may be treated as the counter-affidavit.

5. Avoid trying the case on social media

Do not retaliate, threaten the complainant, coach witnesses, publish private evidence, or begin a new accusation campaign. Public posts may become admissions, prove authorship or malice, undermine settlement, or generate separate charges.

Important defenses and exceptions

No defamatory imputation

Courts consider ordinary meaning, local language, context, audience, accompanying images, and the entire conversation. Mere annoyance, criticism, ridicule, vulgarity, or an angry exchange is not automatically the statutory imputation required for libel.

No identification

The complainant need not always be named. Identification may arise from initials, photographs, office, relationships, prior posts, or facts known to readers. The question is whether third persons could reasonably understand that the material referred to the complainant.

No publication to a third person

A communication known only to its writer and the offended party ordinarily does not satisfy publication. Evidence that other recipients saw, heard, or received it is therefore important.

Privileged communication

Article 354 recognizes qualifiedly privileged communications, including:

A private communication made in the performance of a legal, moral, or social duty
A fair and true report, made in good faith and without comments or remarks, of non-confidential judicial, legislative, or other official proceedings, or of acts performed by public officers in their functions

Fair commentary on matters of public interest may also be privileged. The privilege can be lost through actual malice, unnecessary publication, irrelevant personal attacks, material distortion, or reckless assertions unsupported by the facts.

Public officers, public figures, and public concerns

In criminal libel cases involving public officers or public figures and matters relevant to their public role, constitutional protection generally requires proof of actual malice—knowledge that the imputation was false or reckless disregard of whether it was false. Actual malice is not established merely by anger, hostility, sharp language, or failure to conduct a perfect investigation.

Classification as a public figure and the connection between the statement and a public issue are fact-dependent. A public official does not lose all protection for purely private matters.

Truth, good motives, and justifiable ends

Truth is not an automatic defense to every Philippine libel charge.

Under Article 361, proof of truth is admissible when the imputation concerns a crime allegedly committed by the offended party or an act or omission of a government employee, officer, or functionary relating to official duties. Acquittal also requires a showing that publication served good motives and justifiable ends.

This means that “but it is true” should not be used casually as a complete defense without examining Article 361, the nature of the imputation, and the purpose and manner of publication.

Opinion and fair comment

Pure opinion based on disclosed or established facts may receive protection, particularly on public matters. A statement framed as opinion can still be actionable if it implies undisclosed defamatory facts, falsely presents speculation as verified fact, or is merely a factual accusation introduced with “I think.”

Prescription and non-retroactivity

Cyber libel cannot be applied retroactively to publication before the law became effective. A respondent should also check the discovery date, filing date, any interruption of prescription, and whether proceedings later terminated or were unjustifiably stopped.

Possible penalties and civil liability

Under Article 355 as amended by Republic Act No. 10951, ordinary libel is punishable by imprisonment, a fine, or both. Section 6 of the Cybercrime Prevention Act raises the applicable penalty by one degree when information and communications technology is used.

For cyber libel, the possible imprisonment range is generally prisión correccional in its maximum period to prisión mayor in its minimum period, or four years, two months and one day to eight years.

The Supreme Court has held that a court may instead impose a fine within the cyber-libel range of ₱40,000 to ₱1,500,000, or impose both imprisonment and a fine, depending on the circumstances. It also confirmed that the judicial guidance favoring a fine where appropriate applies to online libel. A fine-only sentence is discretionary, not guaranteed. See Montierro v. Rickmers Marine Agency Phils., Inc..

Civil damages may be pursued with the criminal case or, subject to procedural rules, separately. The choice affects venue, filing fees, evidence, and control of the litigation and should be made before pleadings are filed.

Before conviction in the RTC, bail is generally a matter of right for an accused in custody on a cyber-libel charge, although the court sets the conditions and amount. A person who learns of an arrest warrant should have counsel verify the warrant and arrange lawful surrender and bail instead of evading service.

If the prosecutor issues an unfavorable resolution

An aggrieved party may generally file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution under the 2024 DOJ-NPS Rules.

A petition for review may also be available, depending on which prosecution office issued the resolution and which court would hear the case. Filing a petition for review does not automatically halt court proceedings; the governing rules require attention to a motion to suspend proceedings when an Information has already been filed.

If an Information reaches court, the accused’s lawyer should review it before arraignment. Venue, prescription, duplicate charging, lack of jurisdiction, and legally insufficient allegations may support a motion to quash, but fact-heavy defenses ordinarily require evidence at trial. Entering a plea can waive certain objections, so pre-arraignment review is essential.

Common mistakes

Waiting until the one-year deadline is nearly over
Treating the publication date and discovery date as automatically identical
Filing in a convenient but legally improper venue
Submitting cropped screenshots without URLs, context, witnesses, or account-identification evidence
Assuming a profile name conclusively proves authorship
Treating every insult, bad review, or heated argument as cyber libel
Assuming truth alone always defeats the charge
Assuming “opinion” is a complete defense
Believing deletion or an apology automatically erases criminal liability
Ignoring a subpoena because it is not yet a court case
Filing only a bare denial instead of a supported counter-affidavit
Responding publicly and creating new defamatory material
Charging the same post as both ordinary libel and cyber libel
Assuming a platform report, demand letter, barangay proceeding, or police blotter necessarily interrupts prescription
Believing an affidavit of desistance automatically ends the prosecution; cyber libel is a public offense, and the prosecutor or court is not bound to dismiss solely because the complainant has changed position

Barangay conciliation is generally not a prerequisite for cyber libel because its prescribed penalty exceeds the Katarungang Pambarangay limits. Voluntary settlement, correction, or apology may still be relevant to damages, prosecutorial assessment, or sentencing, but none automatically extinguishes the offense.

When legal help is urgent

Seek a Philippine lawyer promptly if:

The one-year period may expire soon
A prosecutor’s subpoena or resolution has been received
An Information, arrest warrant, or hearing notice has been issued
The account is anonymous or platform data may disappear
The evidence involves private messages, workplace records, medical information, minors, or intimate images
The respondent is abroad, the server is overseas, or several possible venues exist
A public officer or public figure is involved
The post includes threats, doxxing, stalking, extortion, identity theft, unlawful access, or sexual material
Either side is considering a public apology, settlement, takedown demand, or affidavit of desistance
The complainant wants civil damages as well as criminal prosecution

People who cannot afford private counsel may approach the Public Attorney’s Office, subject to its qualification and conflict rules, or the Integrated Bar of the Philippines National Center for Legal Aid.

FAQ

Is a screenshot enough to win a cyber libel case?

Not necessarily. It may show the words and appearance of a post, but authorship, authenticity, completeness, publication, discovery date, and context may still require witnesses, account records, original files, or forensic evidence.

Can a case be filed against an anonymous account?

A complaint and investigation may be initiated, but the responsible person must ultimately be identified with admissible evidence. Law enforcement may seek preservation, disclosure, or examination orders under the Rule on Cybercrime Warrants.

Can someone be charged merely for sharing or liking a post?

Disini protects people who merely receive and react to another person’s post from cyber-libel liability as original authors. A person who adds a new defamatory caption or independently writes an actionable comment may be responsible for that new publication.

Does deleting the post prevent a case?

No. Deletion does not undo a completed publication or erase copies already preserved. It may limit continuing harm, but it can also remove context useful to either side.

Will an apology end the case?

Not automatically. An apology or retraction may support settlement, mitigation, or reduced damages, but the State controls the criminal prosecution after filing.

Is a bad online review cyber libel?

Not by itself. A genuine account of experience and fair opinion differs from a fabricated accusation of crime or misconduct. The exact words, factual basis, motive, audience, and context determine the risk.

How soon must a respondent answer a prosecutor’s subpoena?

The scheduled filing date must generally be at least 10 days after receipt of the subpoena and complaint papers. Follow the date stated in the subpoena. Any extension must be requested promptly and is not a matter of right.

Can cyber libel be punished with a fine instead of imprisonment?

Yes. The court may impose a fine instead of imprisonment when justified, but it may also impose imprisonment or both penalties. The result depends on the law, evidence, circumstances, and judicial discretion.

Can a person abroad face a Philippine cyber-libel case?

Potentially. The Cybercrime Prevention Act contains jurisdictional rules covering, among other situations, Filipino nationals, elements committed in the Philippines, computer systems situated wholly or partly here, and damage caused to a person in the Philippines. Jurisdiction, service, evidence gathering, and enforcement abroad remain fact-specific.

Official legal references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel liability and procedure depend on the exact words, documents, parties, dates, evidence, and venue. Laws and primary official sources were checked through July 23, 2026.