A full-spectrum practitioner’s guide: criminal, civil, administrative, and urgent protective tools—plus evidence playbooks and strategy maps

I. What counts as “online harassment”

“Online harassment” is an umbrella term. In Philippine law, there isn’t a single omnibus statute; instead, a matrix of laws applies depending on conduct, victim, relationship, and platform:

Cyber libel and defamation, false accusations, reputation attacks
Threats, extortion, blackmail, coercion
Doxxing (exposing private information), impersonation, identity theft
Non-consensual intimate image (NCII) sharing, voyeurism, deepfake porn
Gender-based online sexual harassment (GBOSH) such as lewd messages, stalking, unwanted sexual advances, misogynistic or LGBTQ+-targeted abuse
Cyberstalking, persistent unwanted contact and surveillance
Child-related offenses: grooming, sexual exploitation and abuse materials, cyberbullying
Unauthorized processing/leakage of personal data
Hate speech and incitement that crosses into penal offenses

Your legal theory depends on the facts. One incident can support multiple charges (e.g., NCII + GBOSH + data privacy breach).

II. Core legal bases (by conduct)

A. Defamation & falsehoods

Revised Penal Code (RPC) libel and cyber libel (under the Cybercrime Prevention framework): imputations that tend to dishonor a person, done online.
Civil damages for defamation and privacy invasion under the Civil Code (Arts. 19, 20, 21, 26): independent of, or alongside, criminal prosecution.
Strategy: Use civil injunctions to take down content fast, while criminal complaints run on a longer track.

B. Threats, extortion, and coercion

Grave threats, grave coercion, unjust vexation, alarms and scandals (RPC), when delivered through chats, posts, or emails.
If threats involve intimate images (“Pay or I post”), combine with voyeurism/NCII and gender-based sexual harassment charges.

C. Non-consensual intimate images & voyeurism

Anti-Photo and Video Voyeurism Act (RA 9995): prohibits taking, copying, distributing, or publishing images of a person’s private parts/acts without consent, even if consensually taken; distribution without consent is punishable.
Cyber provisions amplify penalties when committed through computer systems.
Remedies: criminal action, search and seizure of devices, and injunctions ordering platforms to remove content.

D. Gender-based online sexual harassment (GBOSH)

Safe Spaces Act (RA 11313): penalizes online acts such as lewd remarks, catcalling, stalking, repeated unwanted sexual advances, and sending of sexual content without consent.
Applies regardless of sex, sexual orientation, or gender identity of victim or perpetrator; workplace and school policies must also address online harassment.

E. Children and minors

Anti-Child Pornography Act (RA 9775) and Anti-OSAEC & Anti-CSAEM Act (RA 11930): criminalize producing, distributing, knowing access, advertising, or facilitating child sexual abuse or exploitation materials; includes grooming and live-streamed abuse.
Anti-Bullying Act (RA 10627): requires K-12 schools to adopt cyberbullying policies; parents can demand disciplinary action and safety plans from schools.
Special rules for evidence preservation and mandatory reporting apply to online child exploitation.

F. Identity theft, impersonation, system abuse

Computer-related identity theft, forgery, and fraud: criminalized when someone appropriates identifiers (names, photos, credentials) or manipulates data.
Illegal access, data interference, device misuse: cover hacking, credential theft, DDoS, spyware.

G. Data privacy and doxxing

Data Privacy Act (RA 10173): penalizes unauthorized processing, breach notification failures, and malicious disclosure of personal data; victims may file complaints with the National Privacy Commission (NPC) for cease-and-desist orders, compliance directives, and administrative fines; civil actions for damages may follow.
Doxxing that exposes addresses, phone numbers, or IDs can be framed as unauthorized processing and privacy invasion, plus harassment under other laws.

H. Violence against women and their children (VAWC) in intimate contexts

RA 9262 (VAWC): covers psychological violence including online—stalking, harassment, humiliating posts, monitoring devices, or threats by a spouse/partner/ex-partner against a woman or her child.
Immediate remedies: Barangay Protection Orders (BPOs), Temporary/ Permanent Protection Orders (TPO/PPO), exclusive custody, stay-away orders, and device surrender.

Note: The Philippines has no single nationwide anti-stalking statute for all relationships. Practitioners combine RPC offenses, RA 11313, RA 9262 (when applicable), and civil injunctions; several LGUs have anti-stalking/anti-harassment ordinances that can supplement national law.

III. Jurisdiction, venue, and forum selection

Special cybercrime courts (RTC) have jurisdiction over cyber offenses; venue can be where any element occurred, where any computer system or data was accessed or stored, or where the victim resides, depending on the offense.
Extraterritorial reach exists for cyber offenses affecting persons or systems in the Philippines or committed by Filipinos abroad.
Parallel fora:
- Criminal complaints with NBI-CCD or PNP-ACG and the Prosecutor;
- Civil actions for damages/injunctions in RTC;
- Administrative complaints with the NPC (privacy), DOLE/CHED/DepEd (policy enforcement in work/school), and platform Trust & Safety channels (contractual/community standards).

IV. Evidence playbook (electronic evidence wins or loses the case)

Capture & preserve properly
- Full-screen screenshots (include URL, date/time), screen recordings, and print-to-PDF.
- Save raw files (images, videos, HTML, message exports) and headers/metadata where possible.
- Use hashing (SHA-256) for key files; keep an evidence log (who collected, when, how).
Corroborate identity & authorship
- Secure subscriber information, IP logs, and login histories via law enforcement or court subpoena duces tecum; gather correlated clues (handles, vanity URLs, phone/e-wallet numbers, delivery addresses).
Apply the Rules on Electronic Evidence
- Authenticate ephemeral content (stories, disappearing messages) with time-stamped capture and witness affidavits; preserve system-generated records (platform emails/SMS alerts).
Move fast for takedowns—but preserve first
- Before reporting posts, capture evidence; then use platform report/flag tools citing applicable violations; send preservation letters to platforms to hold logs pending legal process.
For minors/NCII/OSAEC
- Do not circulate the material further; hand it directly to law enforcement. Use specialized reporting channels; request hash-matching takedowns.

V. Urgent remedies you can get now

Temporary Restraining Order (TRO)/Preliminary Injunction in civil court to compel takedown, restrain harassment, and prohibit contact; include police assistance and platform-directed orders if reachable.
Protection Orders (VAWC): BPO/TPO/PPO with stay-away radii, no-contact, custody, device seizure, and firearms prohibition.
Safe Spaces Act complaints: administrative/criminal tracks; employers and schools must prevent and penalize GBOSH.
Habeas Data: to delete/block unlawfully obtained personal data and compel disclosure of what data is held and by whom—powerful against doxxing and stalkerware.
Amparo (in extreme cases): where life, liberty, or security is threatened (e.g., credible doxxing + death threats), to secure protection directives.

VI. Criminal, civil, and administrative tracks—how they interplay

Track	Goal	Speed	Proof Standard	What you can get
Criminal	Punish offender; deter	Slow–medium	Beyond reasonable doubt	Arrest, conviction, penalties; ancillary damages; confiscation of devices
Civil	Stop harm; compensate	Fast for injunctions; medium for damages	Preponderance	TRO/Prelim Injunction; permanent injunction; moral/exemplary damages; attorney’s fees
Administrative (NPC/Work/School)	Compliance; internal sanctions	Fast–medium	Substantial evidence	Cease-and-desist, fines, policy enforcement, suspensions/expulsions, employer discipline

Best practice: File civil (injunction) immediately, then pursue criminal and NPC complaints in parallel. Use platform processes as your fastest first-aid.

VII. Special contexts & tailored theories

A. Workplace harassment online

Employers must maintain safe workplaces, including digital spaces (messaging apps, email, official channels).
Use company policies and the Safe Spaces Act; seek administrative sanctions, no-contact directives, and digital-access restrictions; escalate to criminal counts if threats, voyeurism, or defamation are involved.

B. School and campus incidents

Anti-Bullying Act requires formal procedures; insist on written action plans, no-contact orders, seat/section changes, and digital monitoring of official platforms.
For GBOSH/NCII, invoke criminal remedies; for data misuse (leaked class lists, ID scans), file with NPC.

C. Intimate partner/ex-partner cases

RA 9262 gives the fastest shields (BPO within the day in many barangays); include device surrender, account/password turnover (if jointly controlled), and stay-away clauses; pursue voyeurism/NCII charges if images are involved.

D. Anonymous and offshore harassers

Use preservation letters + law-enforcement MLAT channels to obtain platform logs; seek John Doe civil suits for early discovery; anchor venue on victim’s residence/effects.
Ask courts for orders to platforms to take reasonable steps to disable URLs or block content within Philippine territory.

VIII. Litigation strategy: seven practical levers

Theory stacking: Plead two to three tight causes that match your evidence (e.g., GBOSH + NCII + civil injunction).
Speed over sprawl: Get TRO in days; don’t wait for criminal probable cause to stop the bleeding.
Quantify harm: Document sleep loss, therapy, lost income, and security expenses; these unlock moral/actual damages.
Digital hygiene orders: Ask for no-contact, no-mention clauses, geo-fencing (where available), and mutual deletion of content.
Contempt teeth: Draft orders with clear prohibited acts (re-uploads, sockpuppet accounts) and a self-executing contempt clause.
Victim safety plan: Change passwords, enable MFA, rotate handles, lock down privacy settings, and port numbers if needed.
Media discipline: If the case becomes public, prepare safe statements to avoid defamation cross-fire and witness intimidation.

IX. Barangay conciliation and prescriptive periods

Katarungang Pambarangay conciliation is not required for many cyber offenses (e.g., those cognizable by the RTC, with higher penalties, or where parties reside in different LGUs). VAWC cases are exempt.
Act fast: some offenses (like libel) have short prescriptive windows; file within months, not years. Use interruption rules via complaints or demand letters without missing penal deadlines.

X. Remedies checklist (by scenario)

1) NCII / revenge porn

Criminal: RA 9995 + cyber provisions; GBOSH; threats/coercion if extorted.
Civil: TRO/Prelim Injunction; damages; order directing platform takedown.
Privacy: NPC complaint for unlawful processing.
Immediate: Evidence capture → platform takedown → police report.

2) Doxxing + stalking

Criminal: threats/coercion/identity theft; GBOSH (if gender-based); VAWC if intimate partner.
Civil: Habeas Data + injunction; damages.
Administrative: NPC for unauthorized processing/disclosure.

3) Defamation campaign

Criminal: cyber libel.
Civil: injunction + damages (Arts. 19/20/21/26).
Platform: report for defamation/harassment; demand preservation of logs.

4) Child targeted online

Criminal: RA 9775 / RA 11930; grooming; access; possession.
School: Anti-Bullying measures; safety plan.
Civil: protective orders; injunctive relief.
Immediate: Law-enforcement referral; do not recirculate evidence.

5) Workplace GBOSH

Admin: employer’s Safe Spaces policies; disciplinary measures.
Criminal: GBOSH counts; threats/NCII if present.
Civil: injunction with workplace-specific no-contact + removal from shared channels.

XI. Template language you can adapt (snippets)

A. Preservation/Takedown Letter to Platform

We represent [Name]. Please preserve all logs, IP addresses, device identifiers, and account information associated with [URLs/handles] from [date/time] onward, pending legal process. The content violates [voyeurism/GBOSH/defamation/data privacy]. We request expedited removal and confirmation of preservation under your policies and applicable law.

B. Verified Petition (Injunction) – Prayer (extract)

(1) Issue a TRO/Preliminary Injunction restraining Respondent from creating, uploading, reposting, commenting on, or otherwise disseminating any content referring to Petitioner, including the specific URLs/handles listed; (2) Direct Respondent and any persons acting in concert to delete and cease processing any personal data of Petitioner obtained without lawful basis; (3) Order [Platform] to take reasonable steps to disable access to the identified URLs within Philippine territory; (4) Award moral, exemplary, and actual damages, plus attorney’s fees; (5) Grant further reliefs as equity and justice require.

C. Affidavit – Electronic Evidence (foundation bullets)

Device used, OS version, capture method (screenshot/recording), timestamp settings
Hash values for files; storage path; chain of custody
Explanation of platform features (public vs. private posts, message status)
Identification of the user (links between handle and respondent)

XII. Compliance & prevention for organizations

Policies: Clear anti-harassment and GBOSH rules covering official and unofficial digital spaces (messengers, forums, social).
Reporting channels: Anonymous hotlines; trauma-informed intake; non-retaliation clauses.
Rapid response: 24/7 escalation tree for takedowns, legal holds, and security steps.
Training: By-stander intervention, consent literacy, data privacy hygiene.
Data governance: Least-privilege access, breach playbooks, DPIAs for high-risk processing (e.g., biometrics, monitoring tools).
Vendor clauses: T&S cooperation, log retention, breach notification windows, and NCII/OSAEC zero-tolerance provisions.

XIII. Bottom line

Online harassment cases are won through precision (matching facts to the right statute), speed (injunctions and takedowns), and evidence discipline (rock-solid electronic proof). Stack criminal, civil, and administrative remedies; use protection orders where applicable; and don’t forget the Data Privacy lever when personal information is abused. Above all, architect orders with enforceable, contempt-ready language that stops re-uploads and sock-puppets before they start.