Quick answer

To file a criminal cyber libel case in the Philippines, preserve the online material and proof of authorship, prepare a sworn complaint-affidavit with supporting evidence, and file it with the city or provincial prosecutor’s office that has territorial jurisdiction. An investigation by the PNP, NBI, or DOJ Office of Cybercrime is especially useful when the account is anonymous or platform records must be preserved.

To defend a case, do not ignore the prosecutor’s subpoena. Obtain the complete complaint, preserve your own account and source records, and submit a detailed counter-affidavit addressing every element, including authorship, identification, publication, defamatory meaning, malice, privilege, truth, venue, and prescription.

Act quickly. The Supreme Court has ruled with finality that criminal cyber libel prescribes in one year from its discovery by the offended party, the authorities, or their agents. Filing the complaint or information interrupts that period. A demand letter, platform report, barangay complaint, or private negotiation should not be assumed to stop prescription. Causing v. People, G.R. No. 258524, April 8, 2026.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the material is published through a computer system or a similar information and communications technology.

The prosecution generally must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Identification. The complainant is named or can reasonably be identified from the words, images, context, or surrounding circumstances. A person need not always be expressly named, but speculation that the post “must have referred” to the complainant is not enough.
Publication. At least one person other than the person defamed received, read, saw, or heard the material. A private message sent only to the subject ordinarily lacks this element, although a group chat, copied message, public post, or message shown to another person may satisfy it.
Malice. The applicable form of malice depends on the nature of the statement, the privilege claimed, and whether the complainant is a private person, public officer, public figure, or participant in a matter of public concern.
Use of a computer system or ICT. This includes social-media posts, website articles, emails, online videos, digital images, and comparable electronic publications.
Authorship or responsibility. The evidence must connect the respondent—not merely a profile name or photograph—to the account and the particular publication.

Context matters. Courts examine the entire communication, including its ordinary meaning, tone, audience, images, captions, surrounding discussion, and the circumstances in which it was published. Criticism, satire, rhetorical exaggeration, or opinion is not automatically libelous, but a false factual accusation does not become protected merely because it is introduced with “I think” or “in my opinion.”

Who may be held responsible?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but declared it unconstitutional as applied to people who merely receive the post and react to it. The Court also invalidated the application of “aiding or abetting” liability to cyber libel.

Accordingly, merely liking or reacting to someone else’s post is not, by itself, cyber libel. Liability becomes more fact-dependent when a person:

writes a new defamatory caption or comment;
materially alters the allegation;
presents another person’s accusation as their own; or
independently creates and publishes defamatory content.

A person who adds new defamatory words may be treated as the author of that new material even if the original content came from someone else.

Malice, public figures, and privileged communications

Private-person cases

Article 354 of the Revised Penal Code generally presumes malice from a defamatory imputation unless a recognized privilege or other defense applies. That presumption does not relieve the prosecution of proving the offense beyond reasonable doubt at trial.

Public officers, public figures, and matters of public interest

When the accusation concerns a public officer, public figure, or qualifying matter of public concern, the prosecution may have to prove actual malice: knowledge that the allegation was false or reckless disregard of whether it was true.

Mere carelessness, inaccuracy, or failure to conduct an ideal investigation is not automatically actual malice. The relevant question is whether the publisher actually knew the statement was false or seriously doubted its truth. The prosecution bears this burden in a criminal libel case involving a public figure. Supreme Court discussion of actual malice and fair comment.

Public status is not a blanket license to make accusations. A knowingly false factual claim or an accusation published despite serious doubts may still be actionable.

Statutory privileges

Article 354 recognizes, among others:

a private communication made in performing a legal, moral, or social duty; and
a fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or other official proceeding, an official statement delivered in that proceeding, or an act performed by a public officer in the exercise of official functions.

These are qualified privileges, not automatic immunity. The audience, purpose, accuracy, scope, good faith, and presence of actual malice remain important. Posting an accusation publicly to thousands of people is not necessarily protected simply because sending it privately to an official with a corresponding duty might have been privileged.

Is truth a complete defense?

Not by itself in every case.

Under Article 361 of the Revised Penal Code, acquittal follows when the matter is proven true and it was published with good motives and for justifiable ends. The article also restricts proof of the truth of an imputation that does not constitute a crime, except when the imputation concerns a government employee and facts related to official duties.

A defendant relying on truth should therefore preserve:

official records and certified documents;
the complete source material, not selected excerpts;
communications with sources;
notes showing what was known before publication;
efforts to verify the allegation;
requests for the subject’s response;
corrections or clarifications; and
evidence showing the legitimate reason for publication.

The deadline: one year from discovery

The current controlling rule is that criminal cyber libel prescribes in one year, counted from the day the alleged offense was discovered by the offended party, the authorities, or their agents.

Discovery is a factual issue. Relevant evidence may include:

the date the complainant first opened or received the post;
messages forwarding the material;
the complainant’s reaction or comment;
an earlier demand for deletion or apology;
a threat to file a case;
a platform report;
communications with police, a lawyer, employer, or publicist; and
testimony from the person who first showed the post to the complainant.

There is no automatic legal presumption that a person discovered a public Facebook post on its publication date. However, conduct showing earlier actual knowledge may defeat a later claimed discovery date.

The period is interrupted by filing the complaint or information. It may run again if proceedings end without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused. Article 91 also provides that prescription does not run while the offender is absent from the Philippines.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code, but its accrual, interruption, and relationship to the criminal case require separate analysis. Do not assume that the criminal discovery rule automatically answers the civil deadline.

Evidence to preserve immediately

Online evidence can disappear quickly. Preserve it before demanding deletion or reporting the account.

Preserve the publication

Keep:

full-page screenshots showing the account name, post, date, time, URL, captions, images, comments, and visible audience;
a screen recording that begins at the profile or channel and navigates to the post;
the original link and post or message identifier;
downloaded photos, videos, audio, and attachments in their original formats;
email or application notifications;
the platform’s downloadable account or message data, when available;
copies showing edits, reposts, audience settings, reactions, and comments; and
the device on which the material was received.

Do not crop away identifying details from the only preserved copy. You may create redacted working copies, but retain the unaltered originals.

Preserve proof of publication and discovery

Record:

who first saw the material;
who sent it to the complainant;
when and where each person accessed it;
whether anyone understood whom it referred to; and
the exact date and circumstances of discovery.

Ask important witnesses to prepare affidavits while their recollection is fresh.

Preserve proof of authorship

A profile bearing someone’s name or photograph does not conclusively prove that the person controlled it or wrote the post. Relevant evidence may include:

an admission of ownership, access, or authorship;
a witness who saw the person use the account or compose the message;
information in the post known only to the alleged author or a small group;
distinctive wording, language, or writing style;
earlier authenticated messages from the same account;
conduct consistent with the post;
security alerts, login history, IP or subscriber records;
geolocation or device information; and
forensic examination results.

The Supreme Court has confirmed that account control and authorship may be established through a combination of direct and circumstantial evidence; technical evidence is useful but not always indispensable. XXX v. People, G.R. No. 274842, October 22, 2025.

Preserve proof of harm

Keep records of measurable consequences, such as:

lost clients, contracts, or employment opportunities;
disciplinary notices;
business records showing losses;
messages from customers, relatives, colleagues, or employers;
medical or psychological records, when relevant; and
reasonable expenses incurred in responding to the publication.

Do not exaggerate harm. Unsupported or inconsistent damage claims may weaken otherwise credible evidence.

How to file a criminal complaint

1. Confirm that the material fits cyber libel

Identify the exact words, image, audio, or video alleged to be defamatory. Do not simply attach an entire social-media thread and ask the prosecutor to find the offense.

For each publication, identify:

its author;
the account and platform;
the precise defamatory imputation;
why it refers to the complainant;
who received or saw it;
how the author is connected to the account;
when the complainant discovered it; and
where the legally relevant acts, computer system, or damage occurred.

2. Determine the correct venue

Cyber libel cases fall within the jurisdiction of the Regional Trial Court, specifically the designated cybercrime court.

Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 may be filed in the designated cybercrime court of the province or city:

where the offense or any element was committed;
where any part of the computer system used is situated; or
where any damage to a natural or juridical person took place.

The court where the criminal action is first filed acquires jurisdiction to the exclusion of other courts. Venue allegations must be supported by facts; the mere nationwide accessibility of a post should not be treated as a substitute for establishing a legally proper location. The corresponding prosecution office should be selected consistently with the intended court venue.

3. Consider a law-enforcement investigation

A complainant may approach the PNP, NBI, or DOJ Office of Cybercrime when:

the respondent uses a dummy or anonymous account;
subscriber or traffic data may be needed;
the account may be deleted;
device examination is material; or
the case involves hacking, impersonation, threats, extortion, sexual images, or another offense in addition to cyber libel.

Under Sections 13 and 14 of Republic Act No. 10175, law-enforcement authorities can order preservation of specified computer data and seek a court warrant for disclosure. A private preservation request is not the same as the statutory law-enforcement order.

Traffic data and subscriber information must generally be preserved by service providers for at least six months from the transaction. Content data is preserved for six months from receipt of a lawful preservation order, with a possible one-time six-month extension. Because platform retention practices and cross-border processes vary, request investigative assistance promptly.

4. Prepare the complaint-affidavit

Under the 2024 DOJ–National Prosecution Service Rules, the filing should include:

the original complaint-affidavit;
two duplicate copies for the official file;
an additional copy for each respondent;
a completed NPS Investigation Data Form;
witness affidavits; and
documentary, electronic, and other supporting evidence.

The affidavit should state the parties’ names and addresses, the date and place of the alleged offense, and a clear narrative showing how every element was committed. It must be properly subscribed and sworn before a prosecutor, an authorized government officer, or, when they are unavailable, a notary public.

Check the receiving prosecution office’s current administrative requirements before filing. Incomplete evidence may delay docketing.

5. File before prescription expires

File with the proper city or provincial prosecutor’s office within the one-year criminal prescriptive period. Obtain a stamped receiving copy, docket number, official receipt if any fee is charged, and proof of the complete set of attachments filed.

A demand for apology, barangay proceeding, mediation, or continuing conversation with the respondent is not a safe substitute for filing on time.

6. Participate in the preliminary investigation

The prosecutor applies the current DOJ standard of prima facie evidence with reasonable certainty of conviction. The evidence should be admissible, credible, preservable, and capable—if left uncontroverted—of establishing all elements and the responsible person.

If the complaint proceeds, the respondent receives a subpoena with the complaint and attachments. The scheduled hearing must give the respondent at least 10 days from receipt to prepare the counter-affidavit. A clarificatory hearing may be conducted when necessary.

The investigating prosecutor ordinarily has 60 calendar days from assignment to resolve the complaint, subject to a permitted maximum 30-day extension in specified cases. These are administrative resolution periods; delay does not automatically dismiss a case.

An aggrieved party may file a motion for reconsideration of the prosecutor’s resolution within 15 days from receipt. A petition for review may also be available under applicable DOJ rules, but it does not automatically stop court proceedings. Observe the resolution’s actual service date and seek immediate advice about the correct remedy.

How to defend against a complaint

1. Do not ignore the subpoena

The subpoena controls the response date. If the respondent

Quick answer

A cyber libel case in the Philippines ordinarily begins with a sworn complaint-affidavit filed with the proper city or provincial prosecutor. The complainant must present evidence showing a defamatory online statement, publication to another person, identification of the person defamed, malice, use of a computer system, and the respondent’s authorship or responsibility. If the prosecutor finds prima facie evidence with reasonable certainty of conviction, an Information may be filed in a designated Regional Trial Court cybercrime court.

A respondent should not ignore a subpoena. The response should be an evidence-backed counter-affidavit addressing every element and any applicable defense, including lack of authorship, failure to identify the complainant, absence of publication or defamatory meaning, privilege, truth with good motives and justifiable ends, fair comment, absence of actual malice where a public official or public figure is involved, improper venue, or prescription.

The most urgent deadline is prescription. The Supreme Court has ruled with finality that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Filing the complaint or Information interrupts the period. A demand letter, platform report, takedown request, or private negotiation should not be assumed to stop it. The discovery date is therefore a critical factual issue. See the Supreme Court’s final April 8, 2026 resolution in Causing v. People, G.R. No. 258524.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or similar technology. It may cover, depending on the evidence, posts, comments, articles, captions, images, videos, emails, online group messages, and other digital publications.

The prosecution generally must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, viewed, or heard the material. A private message seen only by its subject ordinarily lacks publication, but a group chat, copied email, public post, or message shown to another person may satisfy it.
Identification. The complainant was named or was sufficiently identifiable from the words, images, surrounding circumstances, or information known to readers. Naming no one is not necessarily a defense if the audience could determine who was being discussed.
Malice. Article 354 generally presumes malice from a defamatory imputation unless a recognized privilege or other rule applies. Different constitutional standards apply when the speech concerns a public official, public figure, or matter of legitimate public interest.
Use of a computer system or information and communications technology.
Authorship or legal responsibility. The prosecution must connect the respondent—not merely an account bearing the respondent’s name or photograph—to the post or communication.

Context matters. Courts examine the complete publication, not just an isolated word. Satire, rhetorical exaggeration, opinion, criticism, and statements of fact are treated differently. Calling a statement an “opinion” does not automatically protect a false factual accusation disguised as opinion.

Who can be held responsible?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author but declared it unconstitutional as applied to people who merely receive the post and react to it. The law on aiding or abetting was also invalidated insofar as it applied to cyber libel.

A simple “like,” reaction, or passive receipt is therefore not the same as authoring cyber libel. But a person who writes a new defamatory caption, adds an independent accusation, creates a separate defamatory post, or otherwise becomes the author of new material cannot rely automatically on the protection for mere recipients or reactors.

Responsibility for institutional or media publications may involve additional facts concerning authorship, editing, management, or causing publication. It should not be determined from job title alone.

Criminal exposure and possible civil liability

The statutory imprisonment for cyber libel is one degree higher than for traditional written libel: prisión correccional in its maximum period to prisión mayor in its minimum period, approximately four years, two months and one day to eight years.

The court may instead impose a fine, or impose both imprisonment and a fine. After the amendment of Article 355 by Republic Act No. 10951, the Supreme Court fixed the fine for online libel at ₱40,000 to ₱1,500,000. A fine-only sentence is legally possible; imprisonment is not automatic. The choice and amount depend on the case’s circumstances. See People v. Soliman, G.R. No. 256700.

Civil liability may accompany the criminal case. A separate civil action for defamation may also be available under Article 33 of the Civil Code and requires proof by preponderance of evidence, rather than proof beyond reasonable doubt. Rule 111 prohibits double recovery for the same act. Civil defamation actions are generally subject to a one-year period, but accrual, interruption, the legal basis of the claim, and interaction with a criminal case require case-specific analysis.

The one-year criminal prescriptive period

Cyber libel prescribes in one year under Articles 90 and 91 of the Revised Penal Code. The governing points are:

The period begins when the alleged crime is discovered by the offended party, the authorities, or their agents—not automatically on the date the post was uploaded.
Public availability on social media does not by itself create a presumption that the complainant discovered the post immediately.
Discovery may be proved through reactions, comments, messages, threats to sue, reports, correspondence, or other conduct showing knowledge.
Filing the complaint or Information interrupts prescription.
The period may run again if the proceedings terminate without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused.
Under Article 91, prescription does not run while the offender is absent from the Philippines.

Record the discovery date precisely. “I learned about it sometime last year” invites a prescription dispute. Save the message through which the post was first reported, the date it was opened, and the identity of the person who found it.

A separate civil defamation claim should not be assumed to follow the criminal discovery rule. Seek advice well before either possible one-year deadline.

Before filing: preserve the evidence properly

Online material can be edited, deleted, restricted, or attributed to a dummy account. Preserve it before asking for a takedown or warning the author.

Save, where available:

Full-page screenshots showing the account name, profile information, complete text or media, date, time, reactions, comments, share information, and visible URL.
A screen recording that begins at the profile or channel and navigates to the publication.
The direct link, post ID, message headers, email headers, and platform-generated download or account archive.
The original image, video, audio, or document rather than only a compressed screenshot.
Notifications, forwarded copies, and messages through which the complainant discovered the material.
Names and sworn statements of people who personally saw the material.
Evidence connecting the account and publication to the suspected author.
Documents showing falsity, malice, prior warnings, motive, or refusal to correct a known falsehood.
Evidence of harm, such as lost work or clients, cancelled contracts, professional complaints, medical records, and messages from people who changed their conduct because of the publication.
A simple evidence log stating who collected each item, when, from what device or account, and whether it was copied or transferred.

Keep unedited originals in secure storage. Work from copies. Do not crop away identifying information, overwrite metadata, fabricate engagement figures, or access another person’s account or device without authority.

A screenshot may help prove content, but it is not automatically conclusive proof of authenticity, authorship, publication, or identity.

Proving who controlled the account

A profile name or photograph can be copied. The prosecution must prove the identity of the perpetrator beyond reasonable doubt at trial.

In XXX v. People, G.R. No. 274842, the Supreme Court explained that ownership, access, or authorship may be shown by direct or circumstantial evidence, including:

An admission of ownership, access, or authorship.
A witness seeing the person use the account or compose or send the material.
Information in the communication known only to the alleged author or a small group.
Distinctive language, writing style, or identifying characteristics.
Platform, internet-service-provider, telecommunications, geolocation, device-history, or forensic records.
Conduct consistent with earlier or contemporaneous communications.
Other circumstances that, taken together, establish control or authorship.

Technical evidence is useful but not indispensable. Conversely, a bare denial or unsupported claim that an account was hacked may not create reasonable doubt if the surrounding evidence strongly establishes authorship.

A respondent who genuinely lost control of an account should preserve security alerts, password-reset messages, login histories, incident reports, device records, communications with the platform, and proof of where the respondent was and who had access.

When law-enforcement assistance is important

Go promptly to a cybercrime-capable law-enforcement office when:

The author is anonymous or using a dummy account.
Platform or subscriber records are needed.
There is suspected hacking, impersonation, or identity theft.
The material was deleted or made private.
Device examination may be necessary.
The publication is accompanied by threats, extortion, doxxing, stalking, sexual images, or harm involving a child.

Under Sections 13 and 14 of Republic Act No. 10175, law-enforcement authorities may order preservation of specified computer data and, after obtaining the required court warrant, seek disclosure of relevant subscriber or traffic data. The law provides a six-month preservation framework and permits a one-time extension in appropriate cases. A victim’s informal email to a platform is not a substitute for a statutory preservation order.

The DOJ Office of Cybercrime may act on cybercrime complaints or referrals and coordinate investigation and prosecution. Reporting to law enforcement can assist evidence gathering, but the complainant must still ensure that the proper criminal complaint is filed within the prescriptive period.

Where to file

A complaint may be filed with the city or provincial prosecution office having territorial authority over the proper venue. If technical investigation is needed, the complainant may first seek assistance from a cybercrime law-enforcement unit, but that is not always a prerequisite to filing with the prosecutor.

Cyber libel cases fall within the jurisdiction of the Regional Trial Court. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the designated cybercrime court of the province or city:

where the offense or any element occurred;
where any part of the computer system used was situated; or
where damage to the natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Venue must be supported by specific facts; the mere assertion that online content was accessible everywhere is not a safe substitute for proper venue allegations.

Because venue affects both the prosecutor’s territorial authority and the court in which the Information may be filed, obtain legal advice where the author, device, complainant, and alleged harm are in different cities, provinces, or countries.

How to file the complaint-affidavit

Under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, a regular preliminary investigation is required for an offense with the prescribed penalty applicable to cyber libel.

The complainant should:

Prepare a sworn complaint-affidavit. State the parties’ names and addresses, the exact online statements, when and where they were posted and discovered, who saw them, why they refer to the complainant, why they are defamatory, the facts supporting malice, and the facts establishing authorship, venue, and timely filing.
Attach the complete evidence. Include witness affidavits, screenshots, native files or records, links, proof of discovery, authorship evidence, source documents, and evidence of harm.
Complete the NPS Investigation Data Form.
Prepare the required copies. The current rule calls for the original complaint-affidavit, two duplicate copies for the official file, and as many additional copies as there are respondents.
File with the proper prosecution office. Obtain a stamped receiving copy or official proof showing the exact date and time of filing.
Keep the evidence available. The prosecutor may require missing evidence, clarification, or production of records.

A demand letter, retraction request, or request for an apology is not a statutory prerequisite. It may be useful in some cases, but evidence should be secured first and prescription should never be allowed to expire while waiting for a response.

Cyber libel’s prescribed punishment places it outside the criminal jurisdiction of the lupon under the Katarungang Pambarangay system. Barangay conciliation is therefore generally not a condition precedent to the criminal cyber libel complaint. A distinct civil dispute may require a separate analysis.

What happens during preliminary investigation?

Before docketing, the prosecution office checks the complaint’s form and the completeness of the evidence. Once the records are assigned:

Within five calendar days from receiving the complete records, the investigating prosecutor should recommend dismissal if there is no ground to continue or issue a subpoena.
The hearing date should not be more than 30 days from the prosecutor’s receipt of the complete records.
The respondent must receive at least 10 days from receipt of the subpoena and complaint to prepare the counter-affidavit.
A justified extension may be allowed in the interest of justice, but ordinarily may not exceed 10 days.
If the respondent received the subpoena at the last known address but fails without justification to file a counter-affidavit, the prosecutor may resolve the case on the complainant’s evidence.
A clarificatory hearing may be set when necessary. Attendance is mandatory when the prosecutor orders it.
Reply- and rejoinder-affidavits are filed only when required or allowed. The rejoinder is the last pleading.
The investigating prosecutor generally has 60 calendar days from assignment to resolve the complaint, subject to a maximum 30-day extension in specified cases.
A party aggrieved by the resolution may file a motion for reconsideration within 15 days from receipt.

Follow the date written in the subpoena or order. Do not rely on informal assurances that a deadline will be extended.

How to defend at preliminary investigation

Treat the subpoena as urgent

Record the date and method of service. Secure the complaint and every attachment. If anything is missing, request a complete copy promptly and in writing, without assuming that the deadline has stopped.

Preserve, rather than delete, your records

Save the complete publication, drafts, source material, research, messages, account access history, device records, correction or apology, and communications showing context. Deleting the post, wiping a device, or coordinating stories with witnesses may damage credibility and create other legal problems.

Answer every element with evidence

A useful counter-affidavit is not merely a denial. It should address:

Whether the respondent wrote, approved, or controlled the publication.
Whether anyone other than the complainant received it.
Whether the complainant was identifiable.
Whether the complete statement was defamatory in context.
Whether the statement was factual, opinion, satire, or rhetorical exaggeration.
Whether a privilege applies.
What records supported the statement when it was published.
Whether the complainant is a public official or public figure and whether the subject was a matter of public interest.
Whether actual malice can be proved.
Whether venue is proper.
When the complainant, authorities, or their agents actually discovered the publication.
Whether the one-year period had expired before the complaint was filed.

Attach the supporting documents and witness affidavits. Do not reserve essential evidence for later without a strategic reason discussed with counsel; the current DOJ standard requires prosecutors to evaluate whether the available evidence is admissible, credible, preservable, and capable of supporting a conviction.

A bare motion to dismiss is generally not permitted in place of a counter-affidavit. A verified filing containing the respondent’s defenses may be treated as the counter-affidavit, but relying on its title rather than satisfying the rule is risky.

Important defenses and limitations

No defamatory imputation

Harsh, offensive, or embarrassing language is not automatically libel. The publication must make the kind of discreditable imputation covered by Article 353, evaluated in its full context and ordinary meaning.

No publication

Communication only to the person allegedly defamed may lack the required third-party publication. Preserve the audience settings and recipient information.

The complainant was not identifiable

The prosecution must show that readers could reasonably connect the material to the complainant. A complainant’s personal belief that the post referred to them is not always enough.

Lack of authorship or control

The prosecution must connect the accused to the account and the specific publication. Account names, profile photographs, or device ownership should be examined together with access records and surrounding conduct.

Privileged communication

Article 354 recognizes, among other matters:

A private communication made in the performance of a legal, moral, or social duty to a person with a corresponding interest or duty.
A fair and true report, made in good faith and without added defamatory comments, of a non-confidential judicial, legislative, or other official proceeding or an act performed by a public officer in the exercise of official functions.

These are qualified privileges, not blanket permission to publish accusations to everyone. Excessive circulation, unrelated comments, bad faith, or actual malice may defeat the privilege.

Truth, good motives, and justifiable ends

Truth alone should not be treated as an automatic complete defense. Article 361 generally requires proof that the imputation was true and published with good motives and for justifiable ends. It also restricts proof of truth for an imputation of a noncriminal act or omission, except where it concerns a government employee and facts related to official duties.

Preserve the sources that existed when the statement was published. Evidence obtained only afterward may prove truth but may not fully answer an allegation that the author acted recklessly at the time.

Fair comment and public-interest speech

Fair comment based on established facts concerning a public person or matter of legitimate public interest may be protected. An opinion reasonably drawn from disclosed or established facts is different from an invented factual charge.

Where the complainant is a public official or public figure, the prosecution must prove actual malice beyond reasonable doubt: knowledge that the statement was false or reckless disregard of whether it was false. Negligence, mistake, inaccuracy, or failure to conduct perfect research is not automatically actual malice. Reckless disregard requires a fact-specific showing, such as serious doubts about truth or a high awareness of probable falsity. See the Supreme Court’s discussion in ABS-CBN Corporation v. Ampatuan, G.R. No. 227004.

Prescription

The defense should identify evidence of earlier discovery, including prior comments, reactions, private messages, threats to sue, platform reports, or statements by the complainant or an authorized agent. The upload date alone is not necessarily the discovery date.

Improper venue or deficient allegations

Venue is jurisdictional in criminal cases and must be alleged and proved. The location of the parties, device or computer system, relevant acts, and alleged damage should be checked against the Rule on Cybercrime Warrants.

If an Information is filed in court

The prosecutor’s resolution does not itself convict the respondent. Once an Information is filed, the RTC judge independently determines whether probable cause exists for issuing a warrant of arrest.

If a warrant is issued, contact counsel immediately to arrange a lawful response and address bail. Because cyber libel is not punishable by reclusion perpetua or life imprisonment, bail is generally a matter of right before conviction by the RTC, although the court determines the amount and conditions.

The case then proceeds through arraignment, pre-trial, trial, and judgment. The prosecution must prove guilt beyond reasonable doubt, including authorship and every element charged in the Information. Defenses that are apparent from the Information or records—such as prescription, lack of jurisdiction, or failure to allege an offense—may require action before plea. Missing the proper procedural stage can waive certain objections.

Avoid discussing the merits publicly while the case is pending. Online counterattacks may generate new evidence, new complaints, witness issues, or allegations of intimidation.

Common mistakes

Waiting for a takedown, apology, settlement, or barangay action while the one-year period runs.
Saving only a cropped screenshot with no URL, date, account context, or witness.
Assuming a profile name or photograph proves authorship.
Filing wherever the post can be viewed without establishing specific venue facts.
Quoting only selected words and omitting the context that changes their meaning.
Treating truth as sufficient without addressing motive and purpose.
Assuming every criticism of a public official is libel.
Assuming “opinion” protects a false factual accusation.
Ignoring a prosecutor’s subpoena or filing an unsworn denial.
Deleting posts, messages, login records, or devices after learning of a complaint.
Threatening the complainant, respondent, or witnesses online.
Believing an affidavit of desistance automatically ends the criminal case. Criminal prosecution is brought in the name of the People of the Philippines; desistance may be considered but does not by itself extinguish the offense.
Illegally accessing an account or device to obtain evidence.

When legal help is urgent

Consult a Philippine lawyer immediately if:

The one-year criminal or civil period may expire soon.
A prosecutor’s subpoena, resolution, summons, or warrant has been received.
The account is anonymous, deleted, hacked, or controlled from abroad.
Platform, telecommunications, or ISP data must be preserved.
The publication involves a public official, journalist, company, confidential proceeding, or multiple jurisdictions.
There are accompanying threats, stalking, extortion, identity theft, sexual images, or exposure of personal information.
A child or victim of intimate-partner violence is involved.
A correction, apology, settlement, or affidavit of desistance is being proposed.
The criminal case has reached court and arraignment has not yet occurred.

Frequently asked questions

Is a screenshot enough to file?

It can support a complaint, but it may not be enough by itself. The complainant must still establish authenticity, publication, identification, defamatory meaning, authorship, malice, venue, and timely filing. Save the underlying link, native files, account context, witnesses, and discovery evidence.

Can a deleted post still support a case?

Yes, if competent evidence proves what was published, who authored it, and who saw it. Deletion may make authentication harder, which is why prompt preservation is important.

Is cyber libel automatically punishable by imprisonment?

No. Imprisonment remains possible, but the court may impose a fine only when appropriate. The current fine range recognized by the Supreme Court is ₱40,000 to ₱1,500,000.

Can someone be charged merely for liking or reacting to a post?

Not for merely receiving and reacting to the post. Disini limited cyber libel liability to the original author. A person who adds new defamatory words or creates a separate publication may face a different analysis.

Is sharing a post always protected?

No categorical answer applies. A bare reaction is different from writing a new defamatory caption, adopting an accusation as one’s own, or independently publishing new material. The exact content and conduct matter.

Is a true statement immune from cyber libel?

Not automatically. Article 361 generally requires truth together with good motives and justifiable ends, subject to its limitations on the kinds of imputations for which proof of truth is admissible.

Can a public official file cyber libel?

Yes, but criticism of official conduct receives strong constitutional protection. For criminal liability involving a public official or public figure, the prosecution must prove actual malice beyond reasonable doubt.

Must the parties first go to the barangay?

Generally not for the criminal offense of cyber libel because its prescribed punishment exceeds the lupon’s authority. A separate civil claim or a different accompanying offense may require its own assessment.

Does removing the post end liability?

No. Removal may limit further harm and may be relevant to motive or penalty, but it does not erase a completed publication.

Can the parties settle?

They may resolve civil claims and submit relevant agreements or affidavits, but a private settlement or desistance does not automatically dismiss the criminal case. The prosecutor or court retains authority over the prosecution.

What if the account was hacked or impersonated?

Preserve security alerts, login records, password-reset messages, platform reports, device evidence, and proof of unauthorized access. The prosecution must still prove authorship or control beyond reasonable doubt; the court will examine the totality of direct and circumstantial evidence.

Key official and primary sources

This article provides general Philippine legal information, not advice for a particular case. Cyber libel outcomes depend heavily on the exact words, audience, authorship evidence, discovery date, venue, documents, and procedural history. Sources and current rules were checked as of July 30, 2026.