Quick answer

Cyber libel is committed when a person publishes a defamatory imputation through a computer system, such as a social-media post, blog, online article, email, or group chat, and the legal elements of libel are present. An offensive, embarrassing, or false statement is not automatically cyber libel; the prosecution must establish the defamatory imputation, publication, identification of the offended person, malice, authorship, and use of a computer system.

A complainant should preserve the complete online evidence and file a sworn complaint with the proper city or provincial prosecution office. Under the Supreme Court’s current ruling, cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to statutory interruption and suspension rules. Filing the complaint with the prosecution office interrupts prescription. A demand letter, platform report, barangay blotter, or informal police inquiry should not be assumed to stop the criminal deadline. Causing v. People, G.R. No. 258524, April 8, 2026

A respondent who receives a prosecutor’s subpoena should obtain counsel immediately, preserve the account and device evidence, examine every attachment, and file a sworn counter-affidavit on the stated hearing date. Under the current DOJ rules, the respondent must ordinarily be given at least ten days from receipt of the subpoena and complaint materials. Failure to respond may result in the complaint being resolved on the complainant’s evidence alone.

What must be proved

Section 4(c)(4) of the Cybercrime Prevention Act covers libel, as defined under the Revised Penal Code, when committed through a computer system or a similar future technology. The prosecution must establish:

A defamatory imputation. The statement must impute a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the offended person must have received or perceived the statement. A public Facebook post can satisfy publication, but so can a message sent to a group chat or to a single third person. A private message seen only by the person being criticized generally lacks this element.
Identification. The offended person must be named or sufficiently identifiable from the words, image, circumstances, or surrounding details. A person need not always be expressly named, but speculation that a post “might” refer to someone is not enough.
Malice. As a general rule, Article 354 presumes a defamatory imputation malicious unless good intention and justifiable motive are shown. Different rules apply to privileged communications and, in appropriate cases, speech about public officials or public figures.
Authorship or responsibility for publication. The evidence must connect the respondent—not merely a display name or screenshot—to the account and the particular publication.
Use of a computer system. The publication must have been made through a computer, phone, platform, network, or comparable information and communications technology.

The statutory foundation is found in Republic Act No. 10175 and Articles 353 to 362 of the Revised Penal Code.

Context matters. Courts consider the words as a whole, their ordinary meaning, the audience, accompanying images or links, and the circumstances of publication. Labels such as “opinion,” “allegedly,” or “for awareness” do not automatically protect a statement that communicates a defamatory factual accusation. Conversely, criticism, rhetorical exaggeration, satire, or an unpleasant opinion is not necessarily a provably false assertion of fact.

Who may be liable for a post, comment, reaction, or share

Liability principally concerns the person who authored, published, exhibited, or caused the publication of the defamatory material.

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but invalidated the Cybercrime Prevention Act’s provisions on aiding, abetting, or attempting cyber libel because of their vague and chilling application to people who merely receive and react to a post. A bare “like,” routine share, or knee-jerk reaction is therefore not automatically criminal cyber libel.

That ruling is not a license to add a new defamatory caption, repeat an accusation as one’s own, or create a fresh post. A person who independently authors defamatory words may be treated as an original publisher on the facts of that publication.

The one-year deadline

The present controlling rule is:

Cyber libel prescribes one year from the date the alleged crime is discovered by the offended party, the authorities, or their agents.
Publication and discovery may occur on the same date, but they are not legally identical in every case.
The complainant should document the actual discovery date and how discovery occurred.
Filing the criminal complaint with the prosecution office interrupts the period.
If proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may begin running again under Article 91.
The period does not run while the offender is absent from the Philippines, subject to the facts and the applicable interpretation of Article 91.

The Supreme Court reaffirmed the one-year period in its April 8, 2026 en banc resolution in Causing v. People. The Court also made clear that prescription can require evidence: a court may decline to quash a charge where the accused relies only on the posting date and does not prove when discovery occurred.

Do not assume that a post’s continued availability restarts the one-year period every day. Likewise, do not assume that every later screenshot or view is a new offense. A genuinely new publication by the author may raise a separate question, but that conclusion depends on what was republished, by whom, and when.

A separate civil action for defamation is also generally subject to a one-year limitation under Article 1147 of the Civil Code. Its accrual and possible interruption must be analyzed separately from criminal prescription.

Penalties and civil exposure

Article 355, as amended by Republic Act No. 10951, allows imprisonment, a fine, or both for traditional written libel. Section 6 of the Cybercrime Prevention Act raises the applicable penalty by one degree when information and communications technology is used.

For cyber libel:

The imprisonment range corresponding to the one-degree increase is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years, before application of the Indeterminate Sentence Law and any relevant circumstances.
A fine may be imposed instead of imprisonment. The Supreme Court has fixed the present cyber-libel fine range at ₱40,000 to ₱1,500,000 when the amended fine provisions apply.
The court may impose both imprisonment and a fine where legally warranted.
Civil damages and costs may also be awarded.

The precise sentence depends on the date of the offense, the charge, mitigating or aggravating circumstances, and the court’s application of sentencing laws. See People v. Soliman, G.R. No. 256700, April 25, 2023 and Republic Act No. 10951.

Before filing: test the case honestly

A complainant should answer these questions before filing:

What exact words, photograph, video, caption, or implication is defamatory?
What factual accusation does the material communicate?
Who saw or received it other than the complainant?
How would those people identify the complainant?
What evidence connects the respondent to the account and post?
When and how did the complainant first discover it?
Is the case still within the one-year period?
Is the statement privileged, substantially true, or directed at a public official or public figure on a matter of public concern?
What territorial facts establish the proper venue?
Can the electronic evidence be authenticated and preserved through trial?

A complaint that merely calls the post “fake,” “malicious,” or “damaging” without identifying the exact defamatory imputation and proving the other elements may not meet the DOJ’s current evidentiary standard.

Evidence to preserve

Preserve evidence before asking the author or platform to remove the material. Keep:

Full screenshots showing the entire post, account name, profile information, date, time, reactions, comments, and surrounding context
The complete URL, account handle, post identifier, and platform
A screen recording showing how the post is reached from the account or page
The original messages, emails, attachments, notification emails, and exported platform data
The device on which the material was received or discovered
Names and sworn accounts of people who saw the publication
Proof of the discovery date, including messages forwarding the post
Evidence linking the account to the respondent, such as prior admissions, known contact details, consistent account activity, or communications
For the defense, drafts, sources, public records, research notes, messages, and other material showing factual basis, good faith, or lack of authorship
Evidence of actual reputational or financial harm where civil damages are claimed

Do not crop away context, alter timestamps, annotate the only copy, log into another person’s account without authority, or impersonate someone to obtain private data. Keep an untouched master copy and make working copies.

Screenshots are useful but may not, by themselves, prove who controlled an account or whether the material is authentic. When account attribution or deleted content is important, report promptly to the NBI or PNP cybercrime unit. Under Republic Act No. 10175, those agencies are the designated cybercrime law-enforcement authorities. Investigators—not private complainants—may seek preservation, disclosure, search, or examination orders under the Rule on Cybercrime Warrants.

How to file the criminal complaint

1. Identify the proper venue

Cybercrime cases are tried by designated Regional Trial Courts. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the province or city:

Where the offense or any element was committed;
Where any part of the computer system used was situated; or
Where damage to the natural or juridical person occurred.

The first proper cybercrime court in which the action is filed acquires jurisdiction to the exclusion of the others. Venue should be supported by specific facts, not merely chosen for convenience.

The initial complaint is ordinarily filed with the city or provincial prosecution office corresponding to the intended court venue. Because an incorrect venue can defeat or delay the case, obtain local legal advice when the author, server, complainant, and audience are in different places.

2. Prepare a detailed complaint-affidavit

The affidavit should state, in chronological order:

The identities and addresses of the parties, insofar as known;
The exact defamatory words or material, including necessary translation;
When and where the material was posted and discovered;
How it referred to the complainant;
Who saw or received it;
Why the respondent is believed to be the author or account controller;
The computer system or platform used;
The venue facts;
The reputational or other harm caused; and
The attached evidence supporting every material allegation.

Avoid conclusions unsupported by personal knowledge. Clearly identify which facts came from witnesses or records.

Under DOJ Department Circular No. 15, the filing ordinarily consists of the original complaint-affidavit, two duplicate copies for the official file, and a copy for each respondent, together with a completed NPS Investigation Data Form and the supporting evidence. Confirm the current checklist, office hours, copy requirements, and accepted filing method with the particular prosecution office.

3. Consider an NBI or PNP investigation

Law-enforcement assistance is especially important when:

The account is anonymous or fictitious;
Platform or subscriber records are needed;
The post has been deleted;
Account hacking or impersonation is alleged;
Devices may need forensic examination; or
Evidence is located abroad.

A platform report or police intake alone should not be relied upon to interrupt the one-year criminal period. Coordinate the investigation without delaying a timely prosecutor’s complaint.

4. Participate in preliminary investigation

Cyber libel falls under the regular preliminary-investigation process because its prescribed imprisonment can exceed six years.

The DOJ’s current standard is prima facie evidence with reasonable certainty of conviction. The prosecutor considers whether the evidence is admissible, credible, capable of preservation and presentation at trial, and sufficient to establish the elements and the responsible person. The Supreme Court upheld the validity of that standard in Meking v. Remulla, G.R. No. 280455, November 11, 2025.

If the evidence warrants further proceedings, the prosecutor issues a subpoena and receives the respondent’s counter-affidavit. Reply and rejoinder affidavits or a clarificatory hearing may be allowed when necessary. The prosecutor then recommends dismissal or the filing of an Information, subject to approval by the head of the prosecution office.

The governing procedures are in DOJ Department Circular No. 15, series of 2024.

5. Understand what happens in court

If an Information is filed, the RTC judge independently evaluates probable cause. The judge may dismiss the case for a clear lack of probable cause, require additional evidence, issue a summons where custody is unnecessary, or issue a warrant of arrest.

The civil action arising from the offense is generally deemed instituted with the criminal case unless the complainant waives it, reserves the right to sue separately, or previously filed it. A separate civil case requires its own assessment of venue, filing fees, prescription, proof, and possible defenses.

How to respond if you are accused

1. Do not ignore the subpoena

Record the exact date and manner of receipt and keep the envelope or electronic service record. Verify that the complaint-affidavit and all listed attachments were included.

The subpoena should set the preliminary-investigation hearing and give at least ten days from receipt for submission of the counter-affidavit. Follow the specific date stated in the subpoena. If evidence is missing or unreadable, request complete copies and appropriate relief immediately in writing. Any extension is discretionary, requires meritorious grounds, and ordinarily may not exceed ten days.

A motion to dismiss generally cannot replace the counter-affidavit. Put the factual and legal defenses, supporting documents, and witness affidavits into a properly sworn response.

2. Preserve your account and source material

Do not destroy devices, delete relevant messages, fabricate screenshots, alter account records, or coach witnesses. Preserve:

Login and security notifications;
Account-recovery records;
Device and location information;
Drafts and publication history;
Communications with page administrators;
Research, source documents, and verification efforts;
Evidence of hacking, impersonation, or unauthorized access; and
The complete context of the conversation or thread.

Deleting the public post does not erase an already completed offense. An apology or correction may be relevant to the parties and to later proceedings, but it does not automatically extinguish criminal liability.

3. Address every element

A useful counter-affidavit should identify which elements are absent and why. Possible defenses, depending on the evidence, include:

The words are not defamatory in their full context;
The complainant is not named or identifiable;
No third person received the communication;
The respondent did not create, control, or publish through the account;
The evidence is unauthenticated or does not reliably show the original publication;
The statement is covered by a qualified privilege;
The publication concerned a public official or public figure and actual malice cannot be proved;
The accusation was true and published with good motives and for justifiable ends, within the limits of Article 361;
Venue is unsupported;
The charge was filed after the one-year prescriptive period; or
The respondent merely received or reacted to another person’s post and did not author the defamatory material.

Avoid relying on “freedom of speech” as a stand-alone slogan. The stronger approach is to show concretely why the speech is protected, privileged, non-defamatory, unsupported by malice, or otherwise outside the statutory elements.

4. Use privileges carefully

Article 354 recognizes two statutory qualified privileges:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of a non-confidential official proceeding, statement, report, speech, or act performed by a public officer in the exercise of official functions.

The communication must remain reasonably connected to the duty or official matter. Excessive publication, irrelevant attacks, added accusations, or proof of actual malice may defeat the privilege.

Criticism of a public official or public figure on a matter of public concern generally requires proof of actual malice—knowledge of falsity or reckless disregard of whether the statement was false. This protection does not automatically extend to unrelated attacks on private life.

Truth is not always enough by itself. Article 361 requires both truth and publication with good motives and for justifiable ends. It also restricts proof of truth for imputations of non-criminal acts or omissions, except when made against government employees concerning the discharge of official duties.

5. Act promptly after the prosecutor’s resolution

Under DOJ Department Circular No. 15, an aggrieved party may generally move for reconsideration within 15 days from receipt of the resolution. A further petition for review may be available, but its proper reviewing office, contents, deadline, and effect on a case already filed in court are technical matters. Filing a DOJ remedy does not automatically suspend court proceedings; counsel may need to seek appropriate relief from the trial court.

If an Information has already been filed, defenses such as prescription, lack of jurisdiction, defective allegations, or double jeopardy may support a motion to quash under Rule 117. Such a motion is ordinarily made before entering a plea. Prescription based on a disputed discovery date may require evidence rather than summary dismissal.

If a warrant has issued, arrange lawful surrender and bail through counsel. Cyber libel is generally bailable before conviction, but the court fixes the conditions and amount. Do not evade service or assume that a pending DOJ appeal cancels the warrant.

Common mistakes

Waiting for a platform investigation while the one-year period expires
Treating the posting date as automatically identical to the discovery date
Filing in the complainant’s preferred city without proving a venue connection
Submitting isolated or cropped screenshots without URLs, context, or account attribution
Naming every person who liked or shared a post despite the ruling in Disini
Assuming that a false statement is automatically criminal
Assuming that “opinion” or “allegedly” automatically prevents liability
Believing truth alone always defeats libel
Ignoring public-official, public-figure, and qualified-privilege rules
Filing a counter-affidavit late because counsel was still being consulted
Contacting, threatening, or publicly attacking the complainant after receiving a subpoena
Deleting devices, messages, or source material needed for the defense
Assuming an apology, retraction, settlement, or affidavit of desistance automatically dismisses the criminal case

A criminal case is prosecuted in the name of the People of the Philippines. Once filed, the complainant does not have unilateral control over dismissal. A settlement or desistance may be considered but is not conclusive.

When legal help is urgent

Seek a Philippine criminal-law or cybercrime lawyer immediately if:

The first anniversary of discovery is approaching;
The account is anonymous and platform records may disappear;
You received a prosecutor’s subpoena or court summons;
The response date is less than ten days away;
An Information or warrant of arrest has been issued;
The dispute involves a journalist, public official, public figure, whistleblower, or confidential official proceeding;
Several people, pages, or companies are being named as respondents;
The publication or evidence is located outside the Philippines;
Hacking, identity theft, threats, intimate images, or extortion are also alleged; or
A proposed correction, takedown, or settlement could be treated as an admission.

Frequently asked questions

Can a case proceed if the post was deleted?

Yes. Deletion does not undo publication, but the complainant must still present admissible and credible proof of the original material, authorship, publication, and the other elements. Deleted content may make authentication and account attribution more difficult.

Is a screenshot enough?

Not necessarily. A screenshot may show content but fail to prove when it was posted, whether it is complete, or who controlled the account. URLs, device evidence, witnesses, platform data, admissions, and surrounding account activity may be needed.

Can I be charged for merely liking or sharing a post?

Not automatically. Disini invalidated aiding-or-abetting liability for mere receivers and reactors in relation to cyber libel. Liability remains possible where a person independently authors or adopts a new defamatory statement, such as by adding an accusatory caption.

Does an apology or retraction end the case?

No. It may support settlement, mitigation, or an evaluation of motive, but it does not automatically extinguish the State’s criminal action. Preserve the original evidence before modifying or removing anything.

Is a truthful accusation always protected?

No. Article 361 generally requires proof of truth together with good motives and justifiable ends. Admissibility of proof of truth also depends on whether the imputation concerned a crime or a government employee’s official duties.

Can police arrest someone immediately over an old online post?

Filing a complaint does not itself authorize arrest. Ordinarily, an Information must first be filed and a judge must independently find probable cause before issuing a warrant. Warrantless arrest is lawful only in the limited circumstances provided by Rule 113; the continuing online availability of an old post should not be assumed to create an unlimited warrantless-arrest power.

Where should the complaint be filed?

Start with the city or provincial prosecution office corresponding to a proper cybercrime venue—where an element occurred, part of the computer system was situated, or legally cognizable damage occurred. The venue facts should be specifically documented.

Can damages be claimed with the criminal case?

Generally, yes. Civil liability arising from the alleged offense is ordinarily included unless waived, reserved for a separate case, or previously filed. The complainant must still prove the nature and amount of recoverable damages where proof is required.

Official legal sources

This article provides general Philippine legal information, not advice for a particular case. Cyber-libel outcomes depend heavily on the exact words, context, evidence, discovery date, authorship, privilege, and venue. Legal sources and procedures were checked as of August 3, 2026.