Cyberstalking and online harassment can escalate from unwanted messages to threats, impersonation, doxxing, account intrusion, or intimate-image abuse. In the Philippines, there is no single criminal charge called “online harassment” that covers every incident. The applicable law depends on what the person did, the content and frequency of the messages, your relationship with the offender, who saw the material, and whether the conduct involved threats, sexual or gender-based abuse, personal data, or unauthorized access. Your immediate priorities are to protect your safety, preserve the original digital evidence, and report the facts to the proper agency before important account data disappears.

Is Cyberstalking Illegal in the Philippines?

Cyberstalking is expressly recognized in the implementing rules of the Safe Spaces Act, but not every persistent, rude, or unwanted message automatically becomes a Safe Spaces Act offense.

Under Republic Act No. 11313, or the Safe Spaces Act of 2019, gender-based online sexual harassment may include:

Physical, psychological, or emotional threats;
Unwanted sexual, misogynistic, sexist, homophobic, or transphobic remarks;
Cyberstalking and incessant messaging;
Uploading or sharing sexual photos, videos, or recordings without consent;
Unauthorized recording or sharing of a victim’s information or media;
Impersonating the victim online;
Posting lies intended to damage the victim’s reputation; and
Filing false abuse reports to silence the victim on an online platform.

The conduct must fit the law’s gender-based or sexual-harassment framework. A commercial dispute, ordinary quarrel, debt-collection issue, or non-gender-related insult may fall under another law—or may not be criminal at all—depending on the facts. The Safe Spaces Act applies regardless of whether the victim is male, female, or a member of the LGBTQ+ community. (Supreme Court E-Library)

Which Philippine law may apply?

What happened	Possible legal basis	Important qualification
Sexual or gender-based threats, repeated messages, cyberstalking, impersonation, or reputation attacks	Safe Spaces Act, RA 11313	The surrounding facts must establish gender-based online sexual harassment. The penalty may include imprisonment, a fine of ₱100,000 to ₱500,000, or both. (Supreme Court E-Library)
Threats to harm you, your family, honor, or property	Articles 282 and related provisions of the Revised Penal Code, potentially in relation to Section 6 of RA 10175	The exact words, seriousness, conditions imposed, and surrounding circumstances matter. A crime committed through information and communications technology may receive the higher penalty provided by RA 10175. (Lawphil)
Intimidation intended to force you to do or stop doing something	Article 286 on grave coercion, potentially in relation to RA 10175	There must be facts showing violence, threats, or intimidation used to compel or prevent an act against your will. (Lawphil)
Persistent conduct causing serious annoyance, torment, or distress that does not fit a more specific offense	Article 287 on unjust vexation, possibly in relation to RA 10175	Unjust vexation is fact-specific. Mere irritation or an unpopular opinion is not automatically criminal. (Lawphil)
Defamatory Facebook posts, videos, comments, blogs, or group-chat messages seen by other people	Cyberlibel under Article 355 of the Revised Penal Code and Section 4(c)(4) of RA 10175	Libel requires, among other elements, publication to at least one person other than the person defamed. A purely private message seen only by the victim may lack this element. (Supreme Court E-Library)
Hacking, unauthorized entry into an account, or misuse of another person’s identifying information	Illegal access or computer-related identity theft under RA 10175	A fake account by itself is not automatically identity theft. Investigators must establish unauthorized acquisition, use, misuse, transfer, possession, or alteration of identifying information. (Supreme Court E-Library)
Harassment by a spouse, former spouse, dating partner, former dating partner, sexual partner, or person with whom the victim has a child	Anti-Violence Against Women and Their Children Act, RA 9262	RA 9262 protects women and their children. Psychological violence may include stalking, intimidation, repeated verbal abuse, humiliation, and harassment. (Supreme Court E-Library)
Nonconsensual recording or distribution of sexual or intimate images	Anti-Photo and Video Voyeurism Act, RA 9995	Distribution may be unlawful even when the victim originally consented to the recording. Consent to record is not necessarily consent to share. (Lawphil)
Online sexual exploitation or sexual images involving a child	RA 11930, the Anti-OSAEC and Anti-CSAEM Act of 2022	Do not forward, repost, or unnecessarily duplicate child sexual abuse or exploitation material, even for evidence. Preserve the source and report it urgently. (Lawphil)
Posting or misusing addresses, identification records, contact details, or other personal data	Data Privacy Act, RA 10173	“Doxxing” is not automatically a Data Privacy Act violation. The facts must show unlawful processing, use, or disclosure of personal data without a lawful basis or applicable exemption.

Several offenses can arise from the same incident. For example, an ex-partner who hacks an account, threatens the victim, and publishes intimate images may potentially face separate allegations under RA 9262, RA 10175, RA 9995, and the Revised Penal Code. Victims do not need to identify the perfect legal label before reporting. A clear factual account is usually more useful than insisting on one particular charge.

What to Do Immediately After Online Harassment

1. Address any immediate physical danger

Treat the situation as urgent when the offender:

Says they are outside your home, office, or school;
Reveals your live location or daily schedule;
Mentions a weapon;
Threatens immediate harm;
Has previously assaulted or followed you;
Contacts your children, employer, or family to locate you; or
Attempts to lure you into an in-person meeting.

Call 911, contact the nearest police station, or move to a secure location. The Unified 911 service is a free, 24-hour emergency line that can connect callers to police, medical, fire, and rescue services. Do not wait for an online cybercrime report to be acknowledged when danger is immediate. (Philippine Information Agency)

2. Preserve evidence before blocking or reporting the account

Blocking the offender may be necessary for safety, but first capture whatever can safely be preserved. Online content can be deleted, edited, made private, or removed by the platform.

Save:

Full screenshots showing the username, profile photo, date, time, and surrounding conversation;
The account’s profile page, profile link, user ID, handle, and display name;
Direct links to posts, comments, videos, accounts, and shared files;
A screen recording showing how you opened the profile and navigated to the disputed content;
Complete chat exports, not only selected messages;
Emails in their original format, including full email headers;
Original photographs, videos, voice recordings, and attachments;
Notifications showing deleted or unsent messages;
Call logs and voicemail;
Payment demands, bank details, cryptocurrency addresses, or e-wallet numbers;
Names of people who saw or received the posts; and
Prior police, barangay, school, workplace, or platform reports.

Keep an untouched copy of each original file. Do not crop, annotate, enhance, or add arrows to your only copy. Make a duplicate if you need to highlight something for an investigator.

Screenshots are admissible only when properly authenticated. In practice, authenticity may be established through the victim or another witness who personally saw the messages, the original device, account access, metadata, platform records, or forensic examination. A notarized affidavit does not automatically prove that a screenshot is genuine; notarization confirms the oath and signature, while electronic evidence must still be connected reliably to its source. (Lawphil)

3. Secure your accounts

After preserving the evidence:

Change passwords from a device you believe is secure.
Use a unique password for each important account.
Enable two-factor authentication.
Review active sessions and sign out unknown devices.
Check account-recovery emails and mobile numbers.
Remove unknown connected applications.
Preserve security alerts before deleting them.
Ask friends not to tag your current location or publicly discuss your movements.

Do not “hack back,” install spyware on the offender’s device, access their account without permission, or impersonate them to obtain evidence. Those actions can create separate legal and evidentiary problems.

4. Record the effect on you

Keep a dated incident log stating:

What happened;
Where you were;
Which account or number was used;
Who else saw it;
What action you took; and
How the incident affected your safety, work, studies, sleep, health, or family.

Preserve medical certificates, psychological reports, leave records, security expenses, school reports, or proof that you changed your residence or telephone number. These may help establish fear, emotional anguish, psychological harm, or damages where those are elements of the case.

How to Report Cyberstalking and Online Harassment

Step 1: Prepare a short factual chronology

A useful chronology is usually one to three pages. List the incidents in date order and identify:

The suspected offender;
Your relationship with that person;
The first and most recent incidents;
The exact threats or harassing acts;
The platforms, account names, numbers, or email addresses used;
Whether other people saw the content;
Whether the person knows your location;
Any previous physical abuse, stalking, or confrontation; and
What evidence corresponds to each event.

Avoid filling the statement with speculation. Distinguish what you personally observed from what another person told you.

Step 2: Report to the PNP Anti-Cybercrime Group or NBI

The PNP Anti-Cybercrime Group and National Bureau of Investigation are the principal law-enforcement agencies responsible for cybercrime investigations under RA 10175. For gender-based online sexual harassment, the Safe Spaces Act specifically assigns the PNP Anti-Cybercrime Group to receive complaints and investigate offenders. (Supreme Court E-Library)

You may approach:

The PNP Anti-Cybercrime Group;
The cybercrime unit or Women and Children Protection Desk at a nearby police station;
The NBI Cybercrime Division’s investigative-assistance service; or
A local or regional NBI office, which may receive or refer the complaint.

Bring the original device when practical, but do not surrender it without an inventory, acknowledgment, or proper documentation. Bring at least one working copy of your evidence and retain a backup.

The NBI’s published citizen’s charter lists no fee for initial cybercrime investigative assistance. It budgets approximately one hour and ten minutes for the complaint sheet, preliminary interview, preparation of sworn statements, initial device examination, and internal approval. That estimate concerns intake, not the completion of the investigation. (National Bureau of Investigation)

Step 3: Use CICC for reporting and referral

The Cybercrime Investigation and Coordinating Center operates the national 1326 cybercrime hotline and coordinates referrals to agencies such as the PNP ACG and NBI. Reports may also be submitted through the eGovPH eReport portal. The 1326 service operates 24 hours a day. (Philippine Information Agency)

A CICC report is useful for initial triage, incident coordination, and referral. However, an online report or hotline call is not always the same as executing the sworn complaint-affidavit needed for a criminal case. Follow the referral instructions and obtain the report or reference number.

Step 4: Ask about urgent data preservation

Tell the investigator immediately if the account is being deleted, the messages are disappearing, or the platform is based abroad.

Under RA 10175, service providers must preserve certain traffic and subscriber data for at least six months. Content data may be preserved for six months after a lawful preservation order, with a possible extension. Disclosure of subscriber or content data generally requires lawful process, including a court warrant and a properly docketed complaint. Prompt reporting therefore matters even when you already have screenshots. (Supreme Court E-Library)

A victim normally cannot compel a platform or telecommunications company to disclose another user’s confidential subscriber records. Investigators and prosecutors must use the appropriate legal process.

Step 5: Execute a complaint-affidavit

A complaint-affidavit is a sworn, first-person account describing the offense and identifying the supporting evidence. It should explain:

Who you are;
How you know the respondent;
What the respondent did;
When and where each incident occurred;
Why you attribute the account, number, or device to the respondent;
Who else witnessed or received the communication;
What harm, fear, or distress resulted; and
Which attachments support each allegation.

Label attachments consistently, such as “Annex A,” “Annex B,” and so on. Refer to those labels in the affidavit.

Current DOJ preliminary-investigation rules require prima facie evidence with reasonable certainty of conviction. In practical terms, the evidence should be credible, admissible or capable of becoming admissible, preservable for trial, and sufficient to establish both the elements of the offense and the offender’s identity. (Supreme Court E-Library)

The respondent is ordinarily given an opportunity to submit a counter-affidavit. The prosecutor then determines whether the evidence justifies filing an Information—the formal criminal charge—in court.

Step 6: Report the content to the platform

After preserving the evidence, use the platform’s reporting tools for:

Harassment or stalking;
Credible threats;
Impersonation;
Nonconsensual intimate imagery;
Disclosure of private information;
Hacked accounts; or
Child sexual exploitation.

Save the platform’s confirmation email, ticket number, and decision. A takedown can reduce harm, but it does not replace a police or prosecutor’s complaint. Conversely, a platform’s refusal to remove content does not necessarily mean the conduct is lawful.

Step 7: Obtain proof that your complaint was received

Before leaving an office, request:

A receiving copy or acknowledgment;
The complaint, blotter, or reference number;
The investigator’s name and contact details;
A written list of additional requirements;
Instructions on submitting further incidents; and
An inventory or receipt for any device or original document taken into custody.

Continue updating your chronology when new accounts, messages, or threats appear.

Where Should You File?

Office or channel	Best used for
911 or nearest police station	Immediate danger, credible physical threats, an offender nearby, attempted entry, or active following
PNP Anti-Cybercrime Group	Account tracing, online threats, cyberstalking under the Safe Spaces Act, hacking, identity misuse, cyberlibel, and other ICT-related offenses
PNP Women and Children Protection Desk	Gender-based harassment, intimate-partner abuse, cases involving women or children, and assistance with RA 9262 protection measures
NBI Cybercrime Division	Cybercrime case build-up, digital evidence, account investigation, and cases involving multiple regions or technical issues
CICC 1326 or eGovPH eReport	Initial reporting, referral, cyber-incident coordination, and guidance on the responsible law-enforcement agency
Barangay or Barangay VAW Desk	Immediate community assistance, documentation, safety referrals, and certain protection-order matters—not forensic tracing of anonymous accounts
National Privacy Commission	Personal-data processing or disclosure that may violate the Data Privacy Act
Employer or school CODI	Harassment occurring in a workplace or educational setting, including conduct through messages, email, social media, or other technology

A barangay blotter can document an incident, but it is not a substitute for a cybercrime investigation. Barangay conciliation is also not automatically required. Offenses punishable by more than one year of imprisonment or a fine above ₱5,000 are outside the ordinary Katarungang Pambarangay conciliation requirement, and urgent protective action may proceed without waiting for settlement efforts. (Lawphil)

Evidence and Documents to Bring

Prepare the following where available:

Government-issued identification;
Printed chronology of events;
Evidence index listing every screenshot, file, URL, and recording;
Digital copies stored on a clean USB drive or other medium;
Original phone, computer, or storage device;
Account-ownership records;
Full profile and post links;
Chat exports and complete email headers;
Witness names and contact information;
Affidavits from people who personally saw or received the content;
Medical, psychological, school, or employment records showing the effect of the harassment;
Police or barangay blotter entries;
Platform report confirmations;
Birth certificates or proof of relationship where RA 9262 or a child-related law may apply; and
Passport and immigration records where a foreign complainant or cross-border incident is involved.

Do not forward explicit images more widely than necessary. For intimate images, preserve the source discreetly and provide access only to authorized investigators. For sexual material involving a minor, avoid downloading, copying, or forwarding the material unless specifically directed through a lawful evidence-handling procedure.

Filing a Data Privacy Complaint for Doxxing or Data Misuse

The National Privacy Commission is appropriate when the complaint concerns unlawful collection, use, disclosure, or other processing of personal data. It is not the general police agency for every insulting, threatening, or harassing message.

The NPC complaint procedure ordinarily requires:

A completed complaint form;
A notarized complaint;
A valid government-issued ID;
Copies of supporting evidence; and
Proof that the complainant first contacted the person or organization responsible, or an explanation of why prior contact was unsafe, impossible, or inappropriate.

The complaint may be submitted personally, by courier, or through the NPC’s designated complaint email using scanned documents. The NPC’s current posted schedule lists a ₱500 complaint filing fee, subject to applicable exemptions and updated fee schedules. (National Privacy Commission)

NPC proceedings have their own filing periods. A complainant should not wait for an NPC case before reporting threats, stalking, hacking, or physical danger to the police.

Protection Orders and Restraining Measures

When the offender is a current or former partner

RA 9262 may apply when the victim is a woman and the offender is her:

Spouse or former spouse;
Current or former dating partner;
Current or former sexual partner; or
Person with whom she has a common child.

Protection orders may prohibit the offender from harassing, annoying, telephoning, contacting, or otherwise communicating with the victim, directly or indirectly. They may also require the offender to stay away from the victim’s home, workplace, school, or other specified places. (Supreme Court E-Library)

A Barangay Protection Order is issued ex parte—without first hearing the respondent—on the date of filing and is valid for 15 days, but its statutory coverage is limited to acts involving physical harm or threats of physical harm under Sections 5(a) and 5(b) of RA 9262.

A Temporary Protection Order may be issued by a court on the date of filing and is effective for 30 days. A Permanent Protection Order may be issued after notice and hearing and remains effective until revoked by the court. Purely online psychological violence without a physical-harm threat may therefore require a court-issued TPO or PPO rather than reliance on a BPO alone. (Supreme Court E-Library)

The Supreme Court has emphasized in Acharon v. People that, for psychological violence under Section 5(i), the prosecution must prove both the prohibited conduct and the mental or emotional anguish suffered by the victim. Evidence of the victim’s actual experience remains important. (Supreme Court E-Library)

Restraining relief under the Safe Spaces Act

In a Safe Spaces Act case, the court may issue an order directing the offender to stay away from the complainant before final judgment. The law and its implementing rules also require confidentiality and appropriate protection of the complainant’s privacy and security. (Supreme Court E-Library)

How Long Does the Process Take?

There is no single timetable for a cyberstalking or online-harassment case.

Initial police or NBI intake may be completed on the same day, but investigation can take weeks or months. Common bottlenecks include:

Identifying the person behind a fake account;
Obtaining a court warrant;
Waiting for a telecommunications company or platform;
Preserving content before deletion;
Examining multiple devices;
Locating witnesses;
Translating foreign-language evidence; and
Requesting records from another country.

Preliminary investigation before the prosecutor can also take several months, especially when the parties request extensions, the evidence is technically complex, or the prosecutor’s office has a heavy docket.

Do not assume that all online offenses have the same deadline. In its April 8, 2026 resolution in Causing v. People, G.R. No. 258524, the Supreme Court affirmed that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. A victim considering cyberlibel should therefore file promptly rather than wait for the post to circulate further. (Supreme Court of the Philippines)

Reporting from Abroad or When the Offender Is Overseas

Philippine cybercrime jurisdiction may exist when:

The offender is a Filipino, even if the act was committed abroad;
An essential part of the offense occurred in the Philippines;
The computer system involved was located wholly or partly in the Philippines; or
The offense caused damage to a person in the Philippines.

The DOJ Office of Cybercrime serves as the central authority for international assistance and cross-border cybercrime coordination. Foreign platform records and overseas subscriber information may take longer because they can require international cooperation. (Supreme Court E-Library)

A foreign victim may report when there is a sufficient Philippine connection. Bring a passport or other identification, evidence of the Philippine nexus, and certified translations for material not in English or Filipino.

A complaint-affidavit executed abroad may need to be:

Sworn before a Philippine embassy or consulate; or
Notarized locally and apostilled, when the country is covered by the Apostille Convention.

Documents from countries outside the Apostille Convention may require Philippine consular authentication. The exact requirement should be confirmed with the receiving prosecutor or Philippine embassy because procedures vary by country and document type. (Philippine Embassy in New Delhi)

Common Mistakes That Weaken Online-Harassment Complaints

Deleting everything immediately. Preserve evidence before blocking or closing the account.
Submitting only cropped screenshots. Include the account, timestamps, links, and surrounding context.
Reposting intimate material to expose the offender. This increases the victim’s harm and can create legal complications.
Relying only on a platform report. Platform enforcement is separate from a criminal complaint.
Assuming a barangay blotter starts a cybercrime case. It records the incident but does not replace investigation or prosecution.
Waiting until the fake account is identified. Police and NBI investigators have tools and legal processes for identifying account users.
Responding with threats or hacking. Retaliation can expose the victim to a counter-complaint.
Paying a blackmailer without preserving evidence. Payment does not guarantee deletion and may encourage further demands.
Guessing at the offender’s identity in public. A mistaken accusation can create a separate defamation dispute.
Insisting on one legal label. Give investigators the complete facts so they can assess all potentially applicable laws.

Frequently Asked Questions

Can I report a fake or anonymous account?

Yes. Record the profile link, username, numeric user ID if visible, dates, messages, payment details, connected accounts, and any facts linking the account to a particular person. You do not need to prove the user’s identity before making the initial report. Investigators may seek subscriber, traffic, device, or platform information through lawful process.

Are screenshots enough to file a complaint?

Screenshots may be enough to begin an investigation, but they are not automatically conclusive. Their value improves when supported by the original device, complete conversation, links, account records, witnesses, screen recordings, metadata, or provider information. Be prepared to explain personally how and when you obtained them.

Should I block the harasser?

Preserve the evidence first unless continued contact creates immediate danger. After preservation, blocking, muting, restricting, or changing privacy settings may be appropriate. Do not keep communicating merely to collect more evidence when doing so puts you at risk.

Can one message be considered online harassment?

Yes, depending on its content. One credible death threat, extortion demand, intimate-image upload, or serious sexual threat can be criminal even without a long pattern. Repeated conduct is especially relevant to stalking and incessant messaging, but repetition is not required for every possible offense.

Can I file the complaint at the barangay?

You may ask the barangay or VAW Desk to document the incident and assist with safety referrals. However, anonymous-account tracing, preservation requests, forensic examination, and most cybercrime investigations should be handled by the PNP ACG or NBI. Many serious cybercrime offenses are outside mandatory barangay conciliation.

Is doxxing illegal in the Philippines?

It can be, but context matters. Publishing an address, contact number, identification record, or other personal data may violate the Data Privacy Act when it amounts to unauthorized processing or disclosure without a lawful basis. The same act may also support charges involving threats, stalking, coercion, or gender-based harassment. Not every mention of publicly available information automatically creates criminal liability.

Can I remain anonymous when reporting?

An anonymous tip may trigger initial assessment, but a formal criminal complaint normally requires an identified complainant or witness who can execute a sworn statement and authenticate the evidence. Safe Spaces Act authorities must protect confidentiality, but complete anonymity cannot always be maintained once a court case proceeds and the respondent’s due-process rights attach.

Can I obtain a restraining order against an online stalker?

Potentially. A woman harassed by a current or former intimate partner may seek protection under RA 9262. A court handling a Safe Spaces Act complaint may also issue a stay-away order before final judgment. The available remedy depends on the relationship, threats, and legal basis of the complaint.

What if the harasser deletes the account after I report it?

Deletion does not necessarily end the case. Your saved evidence, witness testimony, device records, platform preservation, subscriber information, and forensic findings may still establish what occurred. Prompt reporting gives investigators a better chance of preserving provider-held data.

Key Takeaways

Protect your physical safety first and call 911 for immediate danger.
Preserve full, original evidence before blocking or reporting the account.
Report cybercrime facts to the PNP Anti-Cybercrime Group or NBI; use CICC 1326 for referral and coordination.
Cyberstalking is not one catch-all offense—the applicable law depends on threats, gender or sexual content, relationship, publication, account access, personal data, and intimate images.
Screenshots are useful but should be supported by the original device, complete context, witnesses, links, and account information.
Ask investigators promptly about data preservation because platform and subscriber records may disappear.
Obtain a receiving copy, reference number, and written instructions whenever you file a report.