Quick answer

Cyber libel is committed when the author maliciously publishes a defamatory statement through a computer system—such as a social-media post, online article, email, message, video, or digital image—and the statement identifies another person and is communicated to at least one third party.

A complainant ordinarily starts by filing a sworn complaint and supporting evidence with the appropriate city or provincial prosecutor’s office. The NBI Cybercrime Division or the PNP Anti-Cybercrime Group may first investigate, especially when account attribution, subscriber information, or preservation of platform data is needed, but an investigative referral is not always required before approaching the prosecutor.

A respondent who receives a subpoena should immediately obtain counsel, preserve the complete post and surrounding conversation, and submit a properly sworn counter-affidavit within the deadline stated in the subpoena. Ignoring the subpoena may allow the prosecutor to resolve the complaint using only the complainant’s evidence.

Time is critical. Under the Supreme Court’s controlling ruling in Causing v. People, cyber libel generally prescribes in one year from discovery by the offended party, the authorities, or their agents. Publication and discovery may occur on the same day, but that cannot simply be assumed. Filing, interruption of prescription, republication, authorship, venue, and the precise discovery date can all depend on evidence and should be assessed promptly.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or a similar digital means. It does not make every insulting or offensive online statement criminal.

The prosecution must establish the essential elements of libel:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, or circumstance that tends to dishonor, discredit, or expose a person to contempt or ridicule.
Publication. Someone other than the person defamed received, read, heard, or viewed the statement.
Identification. The offended person was named or was otherwise reasonably identifiable from the words and surrounding circumstances.
Malice. The applicable form of malice must be established, taking account of any privilege and whether the complainant is a public official or public figure.
Use of a computer system. The publication occurred through information and communications technology.
Responsibility for the publication. The evidence must connect the accused to the creation and publication of the actionable statement.

The statement is evaluated as a whole and in context. Courts may consider its ordinary meaning, accompanying photographs or video, the audience, the broader exchange, and whether it asserts a verifiable fact or merely uses loose, figurative, satirical, or rhetorical language.

A private message can still satisfy publication if it was sent to a third person. Conversely, an insult sent only to the person concerned ordinarily lacks the third-party publication required for libel, although other laws may apply.

Who may be held responsible?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author but declared it unconstitutional as applied to people who merely received and reacted to a post. A bare “like,” ordinary reaction, or simple sharing of another person’s post should therefore not automatically be treated as aiding or abetting cyber libel.

The protection is not unlimited. A person who adds a new defamatory accusation in a caption, comment, edited image, video, or repost may become the author of a separate publication. Administrators, editors, corporate officers, employees, and account owners are not automatically liable merely because of their position or access; the evidence must establish their legally relevant participation.

Account ownership alone may not conclusively establish authorship. Relevant issues include who controlled the account or device, whether it was compromised, who prepared or approved the material, and whether electronic records reliably connect the respondent to the publication.

General defenses and important exceptions

The statement was not defamatory

Criticism, disagreement, poor reviews, political opposition, and harsh language are not automatically libel. The question is whether the communication, read fairly and in context, makes an actionable defamatory imputation.

An accusation presented as “opinion” is not automatically protected if it implies undisclosed defamatory facts. On the other hand, obvious exaggeration, rhetorical abuse, or an opinion based on disclosed facts may be treated differently from a factual accusation.

The complainant was not identifiable

The prosecution must show that readers could reasonably understand the statement to refer to the complainant. Failure to name the person is not decisive if photographs, job titles, relationships, events, or other details identify that person. Statements about a large, undefined group do not necessarily identify each member.

There was no publication to a third person

A communication seen only by its author and the person criticized generally lacks publication. But sending it to even one additional person may be enough. Privacy settings do not necessarily prevent publication if group members, followers, coworkers, or other recipients could view it.

The respondent did not author or publish it

Possible evidence includes login records, device history, account-recovery notices, security alerts, metadata, employment records, editorial workflows, witnesses, and proof that an account was hacked, impersonated, or operated by someone else. A denial unsupported by evidence may carry little weight.

Privileged communication

Article 354 of the Revised Penal Code recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of specified official proceedings or acts of public officers.

Privilege is fact-sensitive. The communication must remain connected to the duty, proper recipient, or official matter that creates the privilege. Unnecessary circulation, inflammatory additions, or lack of good faith can defeat it.

Some communications in official proceedings may receive stronger protection under other laws or doctrines. A lawyer should examine the exact setting rather than assuming that every complaint, testimony, demand letter, workplace report, or government filing is immune.

Truth, good motives, and justifiable ends

Truth is not always a complete defense by itself. Article 361 generally requires both the truth of the imputation and proof that it was published with good motives and for justifiable ends. The article also restricts proof of the truth of imputations that do not involve a crime, subject to its rule concerning government employees and facts related to their official duties.

Preserve the primary documents and sources supporting the statement, together with evidence of the investigation performed before publication. A later attempt to find support is not equivalent to proof of what the author knew and did at the time.

Public officials, public figures, and matters of public concern

Where the challenged statement concerns a public official or public figure in the relevant legal sense, the prosecution may have to prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Reckless disregard requires more than ordinary or even gross negligence; it concerns a high awareness of probable falsity or serious doubts about truth.

Public interest does not create a license to invent facts. The classification of the complainant, the subject of the statement, the sources consulted, and the author’s state of mind remain factual questions. Disini explains the distinction between presumed malice and actual malice in this setting.

Prescription

The Supreme Court held in Causing v. People that cyber libel prescribes in one year, abandoning the earlier 15-year approach. The period begins when the alleged cyber libel is discovered by the offended party, the authorities, or their agents. It begins on the publication date only when publication and discovery coincide.

Prescription is often a factual defense. Unless it is apparent from the face of the Information or record, the accused normally must prove the relevant dates. Preserve evidence showing:

The first publication date;
When the complainant or authorities first knew of the post;
Earlier replies, reports, demands, screenshots, or public references showing awareness;
The date and place the complaint was filed;
Any later edit, new caption, repost, or other alleged republication; and
Any event asserted to have interrupted prescription.

Do not assume that a post remaining accessible online restarts the one-year period every day. At the same time, a materially altered or independently republished statement may raise a separate issue. Obtain advice before editing, reposting, or republishing disputed material.

How to file a cyber-libel complaint

1. Preserve the online material immediately

Capture more than a cropped screenshot. Whenever possible, retain:

The complete post, article, comment, caption, image, audio, or video;
The full URL and profile or account URL;
Username, account identifier, page name, and visible profile details;
Date and time displayed, including the time zone;
The surrounding thread and prior messages needed for context;
Reactions, comments, shares, audience or privacy setting, and visible reach;
Screen recordings showing how the material was accessed;
Original downloaded files and their metadata;
Notifications, emails, direct messages, and platform reports;
Names and affidavits of people who saw the publication; and
Proof of the date you first discovered it.

Keep original files unchanged. Make working copies and record who collected each item, when it was collected, and from what device or account. Printed screenshots can help, but authenticated electronic evidence is stronger than an isolated printout whose source and integrity cannot be established.

2. Identify the precise actionable statements

Quote or reproduce the specific words, images, or portions complained of. Explain what they mean in context, how they identify you, who received them, and why the imputation is defamatory.

Avoid treating an entire account, long video, or lengthy article as libel without isolating the alleged imputation. Also separate each distinct publication and record its date.

3. Secure proof of authorship and publication

Gather lawful evidence linking the respondent to the account and showing that a third person saw the content. If subscriber information, traffic data, or private platform records are necessary, prompt investigation may be important because providers do not retain every category of data indefinitely.

The Cybercrime Prevention Act authorizes the NBI and PNP to investigate cybercrime. It also provides procedures for preservation and court-authorized disclosure of computer data. Private parties should not hack an account, secretly obtain passwords, impersonate another user, or unlawfully intercept communications to build a case.

4. Prepare a sworn complaint-affidavit

The complaint should ordinarily state:

The identities and addresses of the parties, as far as known;
The exact defamatory publication;
When and how it was published and discovered;
Why the complainant was identifiable;
Who else received or viewed it;
Facts linking the respondent to authorship;
The computer system or online service used;
Facts supporting malice and answering any apparent privilege;
The basis for filing in the selected prosecution office; and
A chronological list of supporting exhibits and witnesses.

The affidavit and witness affidavits must be properly subscribed and sworn. Requirements concerning copies, identification, certification, electronic filing, and documentary format can vary by prosecution office and current DOJ rules, so confirm them directly before filing.

5. File in the legally proper place

The complaint is filed with the prosecution office that has territorial authority over the alleged offense. Venue in online-libel cases can be contested because several provisions may be relevant, including Article 360 of the Revised Penal Code, Section 21 of Republic Act No. 10175, and the criminal-procedure rule that an action is generally instituted where the offense or an essential element occurred.

Do not select a city merely because the post could be viewed there. The complaint should allege and support concrete venue facts, such as the legally relevant place of publication, residence or office of the offended party, location of an essential element, or location and use of a computer system. Article 360 contains special distinctions for private persons and public officers. A lawyer should resolve venue before filing because an incorrect choice can delay or defeat the case.

6. Participate in the preliminary investigation

Cyber libel carries potential imprisonment exceeding six years because Section 6 of Republic Act No. 10175 raises the applicable libel penalty by one degree. It therefore ordinarily undergoes preliminary investigation under the 2024 DOJ–National Prosecution Service Rules.

The prosecutor evaluates whether the admissible and preservable evidence establishes a prima facie case with reasonable certainty of conviction. The respondent is ordinarily subpoenaed and allowed to submit a counter-affidavit. The prosecutor may require additional evidence or conduct a clarificatory hearing.

Follow every deadline in the prosecutor’s notices. Do not rely on an assumed extension or on older procedural summaries; request any permitted extension before the existing deadline expires.

How to defend a cyber-libel complaint

1. Treat the subpoena as urgent

Record the actual date and method of service. Send the complete subpoena, complaint, annexes, and envelope or electronic notice to counsel immediately. Calendar the stated deadline and any hearing.

Do not contact or threaten the complainant, witnesses, prosecutor, or investigators. Do not solicit false recantations or coordinate fabricated accounts of what happened.

2. Preserve before deleting or changing anything

Do not destroy devices, wipe messages, change metadata, manufacture screenshots, or ask others to delete relevant records. Preservation does not require leaving a harmful post publicly visible forever, but obtain legal advice and make a reliable forensic or documentary copy before any takedown or correction.

Also preserve exculpatory context: earlier messages, the source material, drafts, editorial notes, research, account-security records, and communications showing the purpose and intended recipients of the statement.

3. Audit every element

A counter-affidavit should address the prosecution’s evidence element by element:

What exact statement is alleged to be defamatory?
Is the complainant actually identifiable?
Was the statement communicated to a third party?
Does it assert fact, or is it protected opinion, rhetoric, or satire?
Who authored and published it?
Is the electronic evidence authentic and complete?
Was the communication privileged?
If actual malice is required, what evidence shows—or fails to show—knowledge of falsity or serious doubts?
Are truth, good motives, and justifiable ends supported by admissible evidence?
Was the case filed in the proper place?
Had the one-year prescriptive period expired?

General denials are rarely enough. Attach the documents and affidavits that support each defense, subject to counsel’s assessment of privilege and strategy.

4. Examine how digital evidence was obtained

Electronic evidence must be authenticated, relevant, and lawfully obtained. Check whether screenshots are complete, whether the account and publication were reliably attributed, whether dates and URLs match, and whether alterations are possible.

Government access to subscriber information, content, devices, or stored data may require the applicable cybercrime warrant. The Supreme Court’s Rule on Cybercrime Warrants governs warrants for disclosure, interception, search, seizure, examination, preservation, and related handling of computer data. The Cybercrime Prevention Act also excludes evidence procured without a valid warrant or beyond its authority where a warrant is required.

Do not consent casually to a device search or disclose passwords without legal advice. If officers present a warrant, do not obstruct them, but request a copy and contact counsel immediately.

5. Preserve constitutional and procedural objections

Possible issues include prescription, lack of venue or jurisdiction, defective allegations, double jeopardy, unlawful search, inadmissible electronic evidence, absence of probable cause, and violation of the right to counsel or due process.

Disini also holds that the same online publication cannot be charged as two separate offenses—ordinary libel and cyber libel—when they are one and the same offense. Whether and when to raise a particular objection is strategic; some matters require evidence and may not be resolved through an early motion to quash.

Possible penalties and civil liability

Article 355 ordinarily punishes libel by imprisonment, fine, or both. For cyber libel, Section 6 of Republic Act No. 10175 raises the penalty by one degree; the imprisonment range commonly identified by the Supreme Court is prisión correccional in its maximum period to prisión mayor in its minimum period, or four years, two months and one day to eight years, subject to the Indeterminate Sentence Law and the facts of the case.

Supreme Court guidance encourages courts, when legally appropriate, to consider a fine rather than imprisonment in libel cases, but this is not an automatic entitlement and does not erase the possibility of imprisonment.

A complainant may also pursue civil damages arising from the offense or under applicable Civil Code provisions. Criminal acquittal does not invariably resolve every possible civil claim; the effect depends on the ground for acquittal, the pleadings, and whether civil liability was reserved, waived, extinguished, or separately pursued.

Common mistakes to avoid

Waiting because an old article says cyber libel prescribes in 12 or 15 years;
Saving only a cropped screenshot without the URL, date, account, or context;
Assuming that deleting a post erases liability or evidence;
Editing or reposting disputed material without first obtaining advice;
Filing wherever the complainant happens to be when the post is viewed;
Treating every “share” or “like” as criminal authorship;
Assuming truth alone always guarantees acquittal;
Assuming “opinion,” “allegedly,” or a question mark neutralizes a factual accusation;
Naming an account owner without evidence of who actually authored the post;
Ignoring a subpoena or filing an unsworn narrative instead of a supported counter-affidavit;
Accessing another person’s account or device without authority;
Publicly arguing the case in ways that create new publications or admissions; and
Using edited, incomplete, or fabricated digital evidence.

When legal help is urgent

Consult a Philippine criminal lawyer immediately if:

The one-year period may expire soon;
You received a prosecutor’s subpoena, an Information, a warrant, or an arrest notice;
Police or NBI officers seek access to an account, phone, computer, or cloud storage;
The author uses an anonymous, fake, hacked, or foreign-hosted account;
The material is being repeatedly edited or deleted;
The complainant is a public officer or public figure;
The publication concerns journalism, whistleblowing, workplace reporting, or an official proceeding;
Several posts, respondents, locations, or platforms are involved;
A demand includes an admission, retraction, payment, or waiver; or
The same facts may involve privacy, threats, harassment, identity theft, contempt, election law, or another criminal offense.

Frequently asked questions

Is every false Facebook post cyber libel?

No. The prosecution must prove all the elements, including a defamatory imputation, third-party publication, identification, the applicable malice, online publication, and the respondent’s responsibility for it. Some statements are privileged, non-defamatory, nonfactual, or constitutionally protected.

Can I file directly with the NBI or PNP?

You may request investigation from the NBI Cybercrime Division or PNP Anti-Cybercrime Group, particularly when technical investigation is required. The criminal complaint ultimately undergoes prosecutorial evaluation before an Information may be filed in court.

Is a screenshot enough?

It may help, but a screenshot alone can leave authorship, authenticity, completeness, publication, and timing unresolved. Preserve the URL, account details, full context, original files, discovery evidence, and witnesses. Platform or subscriber data may require lawful preservation and court-authorized disclosure.

Can the person who shared the post be charged?

A person who merely received and reacted to or simply shared another author’s post is protected by the Disini ruling from liability under the cyber-libel provision on that basis alone. A new caption, accusation, edited image, or independent defamatory narrative may itself constitute an original publication.

Does deleting or apologizing end the case?

Not automatically. Deletion may limit continuing harm, and a prompt, sincere correction or apology may affect the parties’ decisions or the assessment of damages and intent, but it does not by itself extinguish a completed offense. Preserve evidence and obtain advice before changing the post or making admissions.

Can a complainant file more than one case for the same post?

The State may not punish the same online publication once as ordinary libel and again as cyber libel when they are one and the same offense. Separate, independently authored or republished statements require their own factual analysis.

How long does a complainant have to file?

The controlling general rule is one year from discovery by the offended party, authorities, or their agents. The actual discovery date, interruption of prescription, and any alleged republication must be established from the record.

Will the respondent be arrested as soon as the complaint is filed?

Ordinarily, no. A complaint-affidavit begins the prosecutorial process; it is not itself an arrest warrant. If an Information is later filed, the court independently determines probable cause and whether to issue a warrant or take another authorized course. Never ignore a court notice or warrant.

Are online statements about government officials protected?

They may receive greater constitutional protection when they concern official conduct or a public issue, and actual malice may have to be proved. Knowingly false or recklessly published defamatory factual accusations are not protected merely because the target holds public office.

Official legal sources

This article provides general legal information, not advice for a particular case and not a substitute for reviewing the actual post, evidence, subpoena, and filing records with a Philippine lawyer. Law and procedure checked against official sources as of September 11, 2026.