Quick answer

You may demand removal, report the post to the platform, exercise your rights under the Data Privacy Act, complain to the National Privacy Commission (NPC), and—when the facts satisfy a specific offense—seek criminal investigation, civil damages, an injunction, a protection order, or a writ of habeas data.

However, posting personal information without consent is not automatically illegal in every case. Consent is only one lawful basis for processing ordinary personal information. A disclosure may also be authorized by law, necessary for a contract or legal obligation, justified by legitimate interests that outweigh the person’s rights, or covered by an exclusion such as qualifying journalistic, artistic, literary, or research activity. Sensitive personal information is more strictly protected.

The proper remedy depends on:

what information was posted;
how the poster obtained it;
who posted it and for what purpose;
whether the information was already public and in what context;
whether the post is false, defamatory, sexual, threatening, or intended to harass;
whether the poster is acting as a personal information controller rather than solely within personal, family, or household affairs; and
whether the disclosure creates immediate risks to safety, finances, employment, reputation, or a child.

Act quickly, but preserve evidence before requesting removal

Unless someone is in immediate danger, preserve reliable evidence before blocking the account or reporting the content. Online material can be edited or deleted within minutes.

Keep:

Screenshots showing the entire post, caption, comments, account name, profile link, date and time, and visible URL.
A screen recording showing how you reached the post from the account or page.
The exact post, image, video, file, or message link.
Copies of direct messages, emails, notifications, and any demand or threat connected with the disclosure.
The date and time you first discovered the post.
Evidence identifying the poster, if lawfully available, such as prior messages or admissions.
Evidence of harm: fraudulent transactions, threatening messages, calls from strangers, employment action, medical or counseling records, security expenses, and witnesses.
The original electronic files. Do not crop, annotate, compress, or overwrite your only copy.

Electronic evidence must eventually be authenticated. A screenshot is more useful when the person who captured it can explain when and how it was obtained and when surrounding details establish its integrity. The Rules on Electronic Evidence govern electronic documents in civil, administrative, and quasi-judicial proceedings.

Do not hack the poster’s account, impersonate another person, or secretly record a private spoken conversation merely to obtain evidence. Secret recording can violate the Anti-Wiretapping Act, subject to limited statutory exceptions.

For intimate images or material involving a child, avoid unnecessary downloading or forwarding. Preserve the URL, account details, timestamps, and surrounding context, report the material, and ask law enforcement how to provide evidence securely.

Send a focused removal and preservation demand

Write to the poster and, when applicable, the company, school, employer, government office, page administrator, or data protection officer responsible for the disclosure. Keep the communication factual and private.

Identify:

the exact post or URL;
the personal information involved;
why the use or disclosure is inaccurate, excessive, unauthorized, unlawfully obtained, or no longer necessary;
any consent previously given and why it did not cover this particular disclosure;
the harm or immediate risk;
the action requested; and
a reasonable response deadline.

Ask for appropriate relief, such as:

immediate removal or restricted access;
preservation of relevant account and access records for a lawful investigation;
correction of inaccurate information;
disclosure of the source, purpose, recipients, and lawful basis for processing;
blocking or destruction of unlawfully processed copies;
notice to persons who previously received inaccurate information; and
written confirmation of the action taken.

Under Section 16 of the Data Privacy Act of 2012, a data subject may seek access and correction and, upon discovery and substantial proof of specified circumstances, the blocking, removal, or destruction of information that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary.

Withdrawal of consent does not invariably require deletion if another lawful basis or a legal retention duty applies. Conversely, the fact that information is true or appears in a public source does not automatically permit every republication or use. Purpose, context, necessity, proportionality, and other applicable laws still matter.

Report the post through the platform

Use the platform’s reporting channel for privacy violations, doxxing, impersonation, harassment, intimate images, threats, or child-safety violations. Save the report number and confirmation email.

If copies appear in search results, request removal or de-indexing from the search engine as well. Platform removal is often the fastest practical step, but it is not a legal ruling and may not remove copies stored or reposted elsewhere.

Do not organize mass harassment, publish the other person’s private information in retaliation, or make unsupported accusations. Those actions can create a separate complaint against you.

When the Data Privacy Act may apply

Personal information includes information from which an individual is apparent or can reasonably be identified, alone or together with other information. A recognizable photograph, home address, contact details, workplace, account information, or document linked to a named person may qualify.

Sensitive personal information includes, among other matters:

age, marital status, race, ethnic origin, religion, and political affiliation;
health, education, genetic information, or sexual life;
alleged or actual offenses, proceedings, and sentences;
government-issued identifiers peculiar to an individual, such as social-security information, licenses, and tax returns; and
information classified by law or executive order.

Sharing, uploading, storing, copying, or republishing personal information can constitute “processing.” The NPC has specifically reminded the public that sharing photos and videos containing personal data requires a lawful basis and compliance with transparency, legitimate purpose, and proportionality.

Consent is not the only issue

Ordinary personal information may be processed on a lawful basis other than consent, including specified contractual, legal, vital-interest, public-authority, and legitimate-interest grounds. A claimed “legitimate interest” is not unlimited: it must be necessary, lawful, and not overridden by the data subject’s fundamental rights and freedoms.

Sensitive personal information is generally prohibited from being processed unless a narrower statutory exception applies, such as specific prior consent, an express legal authorization with safeguards, protection of life and health, medical treatment, or necessity for legal claims or proceedings.

Important coverage limits

The Data Privacy Act excludes an individual who handles information solely in connection with personal, family, or household affairs from the definition of a personal information controller. It also contains exclusions for certain government-related information and information processed for journalistic, artistic, literary, or research purposes.

These limits do not grant a blanket license to harass, threaten, defame, exploit intimate material, or intrude into private life. Civil-law and special statutory remedies may remain available even when a Data Privacy Act complaint is uncertain.

Filing a complaint with the National Privacy Commission

First give written notice

Under the 2021 NPC Rules of Procedure, as amended in 2024, an NPC complaint ordinarily will not be given due course unless the complainant has:

informed the personal information controller, processor, or concerned entity in writing; and
received no timely or appropriate action, or no response within 15 calendar days after receipt of that written notice.

The NPC may waive these requirements for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of a plain and adequate remedy, or patently illegal action. Explain and document the urgency rather than simply skipping the written-notice requirement.

The current amended rules no longer state the former six-month/30-day administrative filing condition found in older NPC materials. This does not extend any separate prescriptive period governing criminal or civil claims. Prompt action remains important.

What the complaint must contain

A formal NPC complaint should be written, signed, verified, and supported by:

the complainant’s identity and service contact details;
the respondent’s identity and service details, or facts that may lead to identification;
a chronological statement of material facts;
the specific acts or omissions complained of;
documents, screenshots, affidavits, and other evidence;
copies of the written notice and all responses;
all relief requested;
any required proof of representation, such as a special power of attorney; and
a sworn certification against forum shopping.

The NPC’s current public instructions require the complaint form to be completed and notarized. It may be submitted personally, by courier, or as a scanned copy through complaints@privacy.gov.ph. Use the NPC’s complaint page for the current form, office details, and payment instructions.

The published base filing fee is ₱500, plus the applicable legal-research fee and possible additional fees when damages are claimed. Indigent complainants may seek exemption upon satisfying the documentary requirements. Confirm the amount through the current NPC schedule of fees before paying.

The NPC may investigate, facilitate settlement, order compliance, impose administrative sanctions, award appropriate indemnity, or recommend criminal prosecution when warranted. A favorable result is not automatic; the complainant must establish the factual and legal basis of the claimed violation.

Seeking an urgent NPC cease-and-desist order

If continued posting will cause grave and irreparable injury, consider asking the NPC for a cease-and-desist order. The application may accompany the complaint or be filed independently.

Under NPC Circular No. 2020-02, substantial evidence must establish that:

the adverse party is committing, threatening, or about to commit an act violating data-privacy law;
restraint is necessary to protect data-subject rights, national security, or public interest; and
continued conduct will cause grave and irreparable injury.

A private applicant ordinarily pays the applicable fee and files a bond. The NPC may issue an ex parte order without a prior hearing when the requirements are met, but filing an application does not itself stop the post or guarantee that an order will issue.

Other criminal laws that may apply

A criminal case requires proof of every element beyond reasonable doubt. “Posted without consent” alone is not a substitute for those elements.

Intimate photos or videos

The Anti-Photo and Video Voyeurism Act applies to specified images of sexual activity or a person’s private area under circumstances involving a reasonable expectation of privacy. It prohibits unauthorized recording and also specified copying, distribution, publication, broadcasting, showing, or exhibition.

Consent to the original recording does not by itself authorize later copying, distribution, or online publication. A violation is punishable by imprisonment of three to seven years, a fine of ₱100,000 to ₱500,000, or both, subject to proof of the statutory elements.

Gender-based online sexual harassment

Section 12 of the Safe Spaces Act covers gender-based online conduct that includes sexual threats or remarks, cyberstalking, unauthorized sharing of sexual media, unauthorized recording and sharing of photos or information, identity impersonation, and posting lies to harm a victim’s reputation.

The law assigns the PNP Anti-Cybercrime Group primary responsibility for receiving these complaints. The statutory penalty for gender-based online sexual harassment is prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both.

Material involving a child

If the post depicts or facilitates sexual abuse or exploitation of anyone below 18, immediately report it to law enforcement and the platform. The Anti-OSAEC and Anti-CSAEM Act criminalizes numerous acts involving the production, publication, transmission, distribution, possession, or access of child sexual abuse or exploitation material, regardless of apparent consent by the child.

Do not repost the material to “warn” others. Record where it was found and seek instructions from investigators on secure handling.

Cyberlibel

A false or damaging online statement is not automatically cyberlibel. The prosecution must prove the elements of libel, including a public and malicious defamatory imputation referring to an identifiable person, plus publication through a computer system.

In its April 8, 2026 ruling in Causing v. People, the Supreme Court held that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents. Because prescription and discovery can become fact-intensive, obtain legal advice promptly rather than waiting until the end of the period.

Intimate-partner abuse

If the disclosure is part of harassment, stalking, public humiliation, coercion, or psychological abuse by a husband, former husband, dating or former dating partner, sexual partner, or person with whom a woman has a common child, the Anti-VAWC Act may apply.

A qualified victim may seek a temporary or permanent court protection order. A barangay protection order has narrower statutory coverage and should not be assumed to cover every form of online abuse.

Where to report possible crimes

Possible cybercrime may be reported to the PNP Anti-Cybercrime Group, an appropriate police unit, or the NBI Cybercrime Division. The NBI publishes an online complaint page and a procedure for investigative assistance to victims of computer crimes.

Bring:

a valid ID;
a concise timeline;
original devices when requested;
preserved URLs and electronic files;
screenshots and printouts;
account and contact details;
proof connecting the account to the suspected person;
copies of takedown demands and platform reports; and
evidence of threats, financial loss, or other harm.

Investigators or prosecutors—not the complainant—should use lawful process to obtain subscriber, traffic, or platform records. Do not attempt to identify an anonymous poster through hacking or deception.

Civil action for damages or an injunction

Articles 19, 20, 21, and 26 of the Civil Code require people to act with justice, honesty, and good faith and to respect the dignity, personality, privacy, and peace of mind of others. Article 26 expressly allows damages, prevention, and other relief for specified and similar invasions of private or family life, even when the act does not constitute a crime.

Depending on the evidence, a court action may seek:

an injunction against continued disclosure;
removal, suppression, correction, or destruction of information;
actual, moral, or exemplary damages when legally supported;
attorney’s fees where allowed; and
other appropriate relief.

A court will consider the specific right violated, the defendant’s conduct, available defenses, causation, and proof of damage. Prescription periods differ by cause of action; civil actions for defamation have an especially short period. A lawyer should identify the correct claim before filing.

Writ of habeas data: powerful but limited

A writ of habeas data may be available when an unlawful act or omission involving the gathering, collection, or storage of information violates or threatens privacy in relation to life, liberty, or security.

The writ is not granted merely because someone accessed or posted information without permission. The Supreme Court stressed in Vivares v. St. Theresa’s College that the required connection to life, liberty, or security must be shown by substantial evidence. Privacy settings and the circumstances in which social-media content was shared can affect the analysis.

Under the Rule on the Writ of Habeas Data, relief may include an order enjoining the threatened act or directing the updating, rectification, suppression, deletion, or destruction of data. The verified petition must explain the violation, its effect on life, liberty, or security, prior efforts to secure the information, the location or controller of the data if known, and the relief sought.

Once a criminal action has commenced, a separate habeas-data petition may no longer be filed; the corresponding relief must be sought by motion in the criminal case.

Common mistakes to avoid

Assuming lack of consent automatically proves a Data Privacy Act violation.
Reporting first and losing the only evidence before taking reliable screenshots.
Saving only a cropped image that omits the URL, account, date, and context.
Publicly threatening or doxxing the suspected poster.
Forwarding intimate or child-related material to friends or group chats.
Secretly recording private conversations without checking the Anti-Wiretapping Act.
Naming a company as respondent without identifying the employee, page, account, or conduct involved.
Filing an NPC complaint without first sending the required written notice or explaining why waiver is justified.
Using an old NPC deadline or complaint form found on an unofficial website.
Waiting because the post has been deleted; copies, continuing harm, and legal deadlines may remain.
Demanding that police or the NPC decide a purely reputational dispute without evidence of a statutory privacy or criminal violation.

When legal help is urgent

Seek immediate police and legal assistance when the post includes:

a credible threat, stalking, or a real-time location;
a home address combined with an invitation to confront or harm someone;
passwords, banking credentials, one-time passwords, or identity documents being used for fraud;
intimate images, sexual extortion, or threats to publish them;
sexual material involving a child;
repeated harassment by an intimate partner;
medical information creating an imminent risk of discrimination or harm;
information identifying a protected witness, victim, or vulnerable child; or
conduct likely to cause grave and irreparable injury unless promptly restrained.

If account compromise is involved, secure the affected email and social-media accounts, change passwords from a trusted device, enable multi-factor authentication, terminate unfamiliar sessions, and notify affected banks, telecommunications providers, employers, or government agencies as appropriate.

Frequently asked questions

Can I force the platform to remove the post?

You may request removal under its policies, but a private report does not guarantee deletion. The NPC or a court may order appropriate relief when its legal requirements and jurisdiction are established.

Does a public Facebook post lose all privacy protection?

No. Public visibility can weaken a claimed expectation of privacy, particularly for habeas-data relief, but it does not automatically authorize every later use. The source, purpose, audience, sensitivity, and proportionality of the new processing remain relevant.

Is reposting already-public information harmless?

Not necessarily. Reposting is a new act of processing or publication. Liability depends on the applicable law, the republisher’s role and purpose, the content, and the surrounding circumstances.

What if the information is true?

Truth does not automatically defeat every privacy claim. A disclosure of true but private information may still be excessive, unlawfully obtained, unauthorized, harassing, or actionable under another law. For defamation, truth, good motives, privileged communication, and malice involve separate legal rules.

Can I complain if the account is anonymous?

Yes. Preserve the username, profile URL, post URL, timestamps, account identifiers, messages, and any evidence linking the account to a person. State in an NPC complaint the circumstances that may lead to the respondent’s identity. Law enforcement can seek account records through lawful process where justified.

Should I go to the NPC or the police?

The NPC handles data-privacy complaints and administrative remedies. Police, the NBI, and prosecutors investigate criminal offenses. A civil court can award judicial relief, and these avenues may coexist, subject to rules on forum shopping, consolidation, and the proper characterization of each claim.

Can the NPC award damages?

The Data Privacy Act authorizes the NPC to award indemnity in matters affecting personal information. The claimant must still prove entitlement, causation, and the amount or basis of the claim. A separate civil action may be appropriate in some cases.

What deadline should I remember?

For an NPC complaint, first send written notice and ordinarily allow 15 calendar days from receipt for a response or appropriate action. Different civil and criminal claims have their own prescriptive periods. Cyberlibel currently prescribes in one year from discovery. Obtain advice promptly because the correct starting date and interruption of prescription may be disputed.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the actual post, source documents, parties, evidence, purpose, and available defenses. Official sources and current procedures were checked as of August 3, 2026.