Quick answer

Cyber libel is libel committed through a computer system—such as a social-media post, website article, email, group chat, video caption, or other online publication. Filing a case requires more than showing that a post was insulting or damaging. The complainant must present evidence supporting every element of libel, connect the accused to the original publication, establish proper venue, and file within the prescriptive period.

The Supreme Court’s current controlling rule is that cyber libel prescribes one year from discovery by the offended party, the authorities, or their agents. Do not assume that an old post remains actionable simply because it is still online, or that deleting or editing a post automatically changes the deadline. Questions involving reposting, substantial updates, or a later publication require examination of the exact online activity and evidence. See Causing v. People, G.R. No. 258524, April 8, 2026, and the Supreme Court’s official explanation of the ruling.

A complainant ordinarily begins by filing a sworn complaint and supporting evidence with the appropriate prosecutor’s office, often after seeking technical assistance from the National Bureau of Investigation or Philippine National Police cybercrime unit. A respondent who receives a prosecutor’s subpoena should not ignore it: under Rule 112, the counter-affidavit and supporting evidence are generally due within 10 days from receipt.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 punishes the unlawful acts of libel defined under Article 355 of the Revised Penal Code when committed through a computer system or similar means.

A prosecution generally must establish:

A defamatory imputation. The communication attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Publication. Someone other than the person defamed received or understood the statement. A public Facebook post plainly may qualify, but a message sent only to the person discussed ordinarily lacks publication unless another person also saw or received it.
Identification. The offended person must be identifiable, even if not named. Context, photographs, job descriptions, initials, tags, or surrounding posts may make identification possible.
Malice. Article 354 generally presumes malice from a defamatory publication unless it falls within a legally privileged category. The presumption may be overcome, and constitutional protections impose a higher burden in some cases involving public officials, public figures, or matters of public concern.
Use of a computer system. The defamatory material was published through information and communications technology.
Authorship or legally attributable publication. Evidence must connect the respondent—not merely a display name or profile photograph—to the original post or other actionable statement.

Whether words are defamatory is judged from the entire communication and its ordinary meaning in context. Harsh criticism, satire, rhetorical exaggeration, opinion, or profanity is not automatically libel. Calling a person a criminal as an asserted fact, however, is materially different from criticizing that person’s decision or expressing a clearly recognizable opinion.

Who may be charged?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author of the online statement. It declared the provision unconstitutional as applied to people who merely receive and react to a post, and invalidated aiding-or-abetting liability in relation to cyber libel.

Accordingly:

Merely clicking “like” or using an ordinary reaction is not cyber libel.
Merely sharing another person’s post is not automatically criminal cyber libel under the aiding-or-abetting provision invalidated in Disini.
A comment that creates a new defamatory accusation may itself be treated as an original publication.
Copying another statement into a new post, adding accusations, or independently republishing defamatory content presents a different issue from merely using a platform’s reaction function.
Page administrators, editors, business officers, account owners, and employees are not automatically liable solely because of their title or relationship to the page. The prosecution must establish their own legally relevant participation and the required mental element.
A fake or hacked account does not prove authorship. Account attribution must be supported by competent evidence.

The same act should not be prosecuted as both traditional libel and cyber libel merely because the identical material appeared online; Disini recognized the resulting double-jeopardy problem.

Statements that may be privileged or constitutionally protected

Private communications made in the performance of a duty

Article 354 recognizes qualified privilege for a private communication made to another person in the performance of a legal, moral, or social duty. Examples may include a properly directed workplace complaint, report to authorities, or good-faith warning to a person with a legitimate interest.

Privilege is not automatic. Excessive distribution, irrelevant personal attacks, knowledge of falsity, or use of the report as a pretext for public humiliation may support a finding of actual malice.

Fair and true reports

A fair and true report, made in good faith and without comments or circumstances beyond what is necessary, concerning official proceedings or acts of public officers may be privileged under Article 354. The protection is fact-sensitive. A misleading headline, material omission, distorted summary, or added accusation may take the publication outside the privilege.

Public officials, public figures, and matters of public concern

Speech about official conduct and matters of public concern receives strong constitutional protection. Where the applicable constitutional standard requires actual malice, the prosecution must prove that the defamatory factual statement was made with knowledge that it was false or with reckless disregard of whether it was false.

“Actual malice” in this context is not simply anger, hostility, or bad manners. It concerns the publisher’s state of mind regarding truth or falsity. The status of the offended person and the nature of the issue must be determined from the evidence; being discussed online does not by itself make someone a public figure.

Truth and good motives

Truth can be a defense, but it should not be treated as a complete answer in every situation. Article 361 requires proof of the truth of the imputation and, where applicable, that the publication was made with good motives and for justifiable ends. The defense must therefore preserve the reliable source documents and witnesses supporting both accuracy and legitimate purpose.

The one-year filing deadline

Under Causing v. People, cyber libel prescribes in one year from discovery of the offense by the offended party, the authorities, or their agents, applying Articles 90 and 91 of the Revised Penal Code.

This makes the discovery date critical. Preserve evidence showing:

when the offended person first saw or received the publication;
who sent or showed it to that person;
when any report was made to police, the NBI, an employer, or another authority;
the original publication date and time;
whether a later item was merely the same accessible post or a genuinely separate publication; and
when a complaint was filed and what official action followed.

Do not wait for negotiations, an apology, platform action, or a demand letter to finish. A takedown request or settlement discussion does not necessarily interrupt prescription. Because the legal effect of a complaint filed with a prosecutor or investigative body may depend on the governing law and the precise filing, obtain case-specific advice well before the anniversary of discovery.

Where should the case be filed?

Cyber libel cases fall within the jurisdiction of the Regional Trial Court, with designated cybercrime courts handling covered cases. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed before the designated cybercrime court of the province or city:

where the offense or any element occurred;
where any part of the computer system used is situated; or
where any damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others.

The Information must allege facts establishing venue; saying only that a post could be accessed in a particular city may be insufficient. Residence, the place of publication, account use, server or device location, and the place of actual reputational damage should be supported by facts rather than selected for convenience. Venue disputes are technical and should be evaluated before filing.

How to file a cyber libel complaint

1. Preserve the publication immediately

Before requesting deletion or blocking the account, preserve:

full-page screenshots showing the post, account name, URL, date, time, reactions, comments, and surrounding context;
a screen recording showing navigation from the account or page to the post;
the exact text, image, audio, or video in its original quality;
direct links and platform-specific post or message identifiers;
emails in their original electronic format, including available headers;
chat exports rather than cropped screenshots alone;
copies of relevant profile information and earlier or later related posts;
names and contact details of people who received or saw the publication;
messages indicating authorship, motive, knowledge of falsity, correction, or admission;
proof of the date of discovery; and
evidence of actual harm, such as lost clients, cancelled contracts, employment action, or messages showing changed treatment.

Keep the original device and files. Do not annotate, crop, enhance, or repeatedly resave the only copy. Create working copies and document who collected each item, when, and how.

Screenshots are useful but may not establish authenticity or account ownership by themselves. Electronic evidence must be authenticated under the applicable rules. Investigators may seek subscriber, traffic, or content data through lawful preservation and court-authorized disclosure procedures.

2. Identify the exact actionable statements

Quote the material accurately and explain:

what factual accusation it makes;
why it refers to the complainant;
who received it;
why it is false or unlawfully defamatory;
what evidence connects the respondent to the publication;
why no privilege applies, or why actual malice defeats a qualified privilege; and
where and when the offense, discovery, and damage occurred.

Do not rely on general allegations that an entire page, video, or conversation was “malicious.”

3. Consider a preservation or takedown request

A carefully drafted request may ask the platform or account holder to preserve data, stop further publication, correct the statement, or remove it. This can reduce harm but is not a substitute for filing on time.

Avoid threats, public retaliation, account intrusion, impersonation, mass reporting based on false grounds, or demands for payment that could create separate legal issues.

4. Prepare the complaint-affidavit

A complaint submitted for preliminary investigation should ordinarily include:

the complainant’s identity and address;
the respondent’s known identity and address;
a chronological statement based on personal knowledge;
the exact publication and its context;
the discovery date;
facts supporting every element of the offense;
facts supporting venue;
witness affidavits where available;
properly marked supporting documents and electronic evidence; and
the required number of copies.

Affidavits should be sworn before an authorized officer and comply with the prosecutor’s current filing requirements. Local offices may have intake forms, documentary checklists, or electronic-filing arrangements; confirm these directly with the office where filing is contemplated.

5. File with the proper prosecutor or seek investigative assistance

The complaint may be filed with the appropriate city or provincial prosecutor’s office. Where authorship is concealed or technical records are needed, assistance may be sought from:

The NBI and PNP investigate; prosecutors determine whether the evidence warrants filing an Information in court. Private parties generally cannot compel platforms to disclose protected subscriber or content data merely by sending a request. The Cybercrime Prevention Act and the Rule on Cybercrime Warrants govern preservation, disclosure, search, seizure, and examination of computer data.

6. Participate in the preliminary investigation

Under Rule 112 of the Rules of Criminal Procedure, the prosecutor initially reviews the complaint. If there is ground to proceed, the prosecutor issues a subpoena to the respondent with the complaint and supporting materials. The respondent generally has 10 days from receipt to submit counter-affidavits and supporting evidence.

A preliminary investigation is not a full trial. Its purpose is to determine whether probable cause exists to hold the respondent for trial. Cross-examination is not ordinarily conducted, although the prosecutor may call a clarificatory hearing.

If probable cause is found and the resolution is approved, an Information is filed in the proper Regional Trial Court. The judge independently evaluates probable cause for purposes of issuing a warrant of arrest.

How to defend against a complaint

Act immediately upon receiving a subpoena

Record the exact date, time, and manner of service. Obtain the entire complaint and every attachment. The usual 10-day period is short, and Rule 112 does not allow a respondent simply to file a motion to dismiss instead of a counter-affidavit.

If documents are missing, promptly request access or copies from the prosecutor and document the request. Do not assume that incomplete service permits the deadline to be ignored.

Preserve your own evidence

Keep:

the original device and account records;
drafts and complete conversation threads;
source documents used before publication;
research notes, recordings, interview messages, and requests for comment;
proof of corrections or updates;
access logs or security alerts suggesting hacking or impersonation;
records showing who controlled the account;
evidence of limited recipients or privacy settings;
the complete context of allegedly defamatory excerpts; and
proof supporting truth, good faith, privilege, fair comment, or lack of actual malice.

Do not delete accounts, wipe devices, edit logs, coach witnesses, or manufacture a later explanation. Deletion may destroy exculpatory evidence and may be portrayed as consciousness of wrongdoing.

Address every element and procedural defect

Depending on the record, a defense may include:

the statement is not defamatory when read as a whole;
it is protected opinion, criticism, satire, or rhetorical exaggeration rather than a provably false factual accusation;
the offended person is not identifiable;
there was no publication to a third person;
the respondent did not author, control, or publish the material;
the account was spoofed, impersonated, or compromised;
the statement is true and was made with good motives and for justifiable ends;
the communication was privileged;
actual malice has not been shown where constitutionally required;
the evidence is unauthenticated, incomplete, altered, or does not reliably attribute the account;
the complaint was filed after the one-year prescriptive period;
venue is not properly alleged or supported;
the allegedly criminal act occurred before the Cybercrime Prevention Act became effective;
the respondent merely reacted to or received another person’s post; or
the same act is being impermissibly charged as both ordinary and cyber libel.

A denial unsupported by documents is usually weaker than a specific, evidence-based explanation.

After the prosecutor’s resolution

The available remedy and deadline depend on who issued or approved the resolution, when notice was received, whether an Information has already been filed, and the current DOJ rules. A motion for reconsideration or petition for review does not automatically suspend court proceedings or cancel a warrant. Counsel should review the resolution and docket immediately.

If an Information has already been filed, possible remedies may include a motion to quash on grounds recognized by Rule 117, a challenge to probable cause, arraignment defenses, bail, and trial. Not every defense can be raised through a motion to quash; factual defenses are commonly resolved at trial.

Arrest, bail, and court proceedings

A prosecutor’s subpoena is not an arrest warrant. If an Information is filed, the RTC judge must independently determine whether probable cause exists for an arrest warrant.

Cyber libel is generally bailable as a matter of right before conviction. Bail is not an admission of guilt. The amount and conditions are set by the court under the Rules of Criminal Procedure and the applicable bail guidelines.

Seek urgent legal assistance if:

a warrant has been issued or police are attempting an arrest;
an arraignment or bail hearing is scheduled;
the subpoena deadline is approaching;
the one-year filing period is close;
the accused is abroad or may be subject to immigration or travel consequences;
a device is being searched or seized;
a platform or service provider is about to delete relevant data;
the publication involves a journalist, public official, whistleblower, confidential source, or pending proceeding; or
the case includes threats, stalking, doxxing, intimate material, identity theft, or harm to a child.

During custodial investigation, a person has the constitutional right to remain silent and to competent and independent counsel. Do not consent casually to account access, device examination, or questioning without understanding the request and its legal basis.

Possible penalties and civil liability

Article 355 of the Revised Penal Code, as amended by Republic Act No. 10951, provides for ordinary libel a fine of ₱40,000 to ₱1,200,000, imprisonment, or both. Section 6 of the Cybercrime Prevention Act makes use of information and communications technology a qualifying circumstance and provides a penalty one degree higher than that imposed for the corresponding offense.

The actual sentence depends on the charge, applicable penalty rules, mitigating or aggravating circumstances, the Indeterminate Sentence Law where applicable, and the court’s judgment. Courts have discretion under law regarding whether imprisonment, a fine, or both should be imposed; no outcome should be assumed from the filing of a complaint alone.

Criminal liability may also carry civil liability. Under Rule 111, the civil action arising from the offense is generally deemed instituted with the criminal case unless it is waived, reserved, or previously filed. Article 33 of the Civil Code separately recognizes an independent civil action for defamation, subject to its own requirements and defenses. A takedown or apology may affect settlement or damages but does not automatically erase criminal liability.

Common mistakes to avoid

For complainants

Waiting for the post to go viral before preserving it or filing.
Computing prescription from the wrong date.
Submitting only cropped screenshots without URLs, dates, context, or authentication evidence.
Assuming the displayed profile name proves who operated the account.
Charging everyone who liked, shared, or reacted to a post.
Treating insult, criticism, or opinion as automatically criminal.
Ignoring privilege, public-interest protections, or the need to prove actual malice.
Filing in a convenient city without facts establishing venue.
Publicly repeating the accusation while announcing the case.
Assuming a police or platform report necessarily preserves every legal remedy.

For respondents

Ignoring a subpoena or missing the 10-day counter-affidavit period.
Filing only a bare denial.
Deleting posts, messages, devices, or account records.
Contacting or threatening the complainant or witnesses.
Publishing new accusations in response to the complaint.
Assuming “freedom of speech” protects knowingly or recklessly false factual accusations.
Assuming truth alone is always enough without proving legitimate purpose where required.
Treating an appeal to the DOJ as an automatic stay of court proceedings.
Ignoring a warrant because the respondent believes the complaint is weak.

Practical evidence checklist

Keep separate folders for:

the original publication;
proof of publication to third persons;
account-attribution evidence;
discovery-date evidence;
complete context and related communications;
truth or falsity evidence;
privilege, public-interest, and actual-malice evidence;
venue evidence;
reputational or financial harm;
subpoenas, affidavits, resolutions, and proofs of service; and
a dated case chronology.

Retain untouched originals and make verified backup copies. Record the source, collector, date, device, and method used for each electronic item. Where the authenticity or continued availability of data is important, consult counsel or investigators about forensic collection and lawful preservation before the platform’s retention period expires.

Frequently asked questions

Is a demand letter required before filing?

No general rule makes a demand letter, apology request, or takedown notice a prerequisite to a cyber libel complaint. It may help resolve the dispute or document continued publication, but it must not cause the complainant to miss prescription.

Can I file because someone insulted me online?

Not every insult is libel. The communication must satisfy all legal elements, including a defamatory imputation, identification, publication, malice where required, and attribution to the accused.

Can someone be charged for sharing or liking a post?

A mere reaction or ordinary share is not automatically cyber libel. Disini limited criminal liability to the original author and invalidated aiding-or-abetting liability for cyber libel. A person who adds a new defamatory accusation or independently creates a new defamatory publication may be treated differently.

Does deleting the post end the case?

No. Deletion does not erase an offense already completed or the evidence already preserved. It may limit further harm, but its effect on prescription, damages, or a claimed later publication depends on the facts.

Is an anonymous account immune?

No, but anonymity does not prove identity either. Investigators may seek account records through lawful preservation, disclosure, or search procedures. A complainant must still produce evidence reliably connecting the respondent to the publication.

Are screenshots enough?

Sometimes they help establish the content and context, but screenshots alone may be challenged as incomplete, altered, or unauthenticated. Preserve original files, URLs, message exports, devices, metadata where available, witnesses, and attribution evidence.

When does the one-year period begin?

Under Causing v. People, it begins when the cyber libel is discovered by the offended party, the authorities, or their agents. The discovery date must be established from evidence, not merely asserted.

Can a public official file cyber libel?

Yes, but criticism of official conduct and discussion of public issues receive heightened constitutional protection. Depending on the facts, the prosecution may need to prove actual malice—knowledge of falsity or reckless disregard for truth.

Can the parties settle?

They may discuss apology, correction, takedown, damages, or other terms. However, cyber libel is a public offense prosecuted in the name of the People, so private settlement does not automatically require the prosecutor or court to dismiss the criminal case.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case. Cyber libel disputes depend heavily on the exact words, context, evidence, discovery date, authorship, status of the parties, and procedural record. Official sources were checked as of September 15, 2026.