Quick answer

A cyber libel case may be filed when a person publicly and maliciously posts or transmits, through a computer system, a defamatory accusation that identifies a natural or juridical person. The prosecution must establish the defamatory imputation, publication to at least one third person, the complainant’s identity, malice, the accused’s authorship or responsibility, and use of a computer system.

Act quickly. The Supreme Court has definitively ruled that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Filing the proper complaint or Information interrupts prescription. A report to a social-media platform—or an informal request for investigation—should not be assumed to do so. Preserve proof of the discovery date and obtain legal advice well before the year expires. The Court reaffirmed this rule with finality on April 8, 2026 in Causing v. People.

If you are accused, do not ignore an NBI invitation, prosecutor’s subpoena, court summons, or warrant. Preserve your devices and account records, obtain the complete complaint, and prepare an evidence-backed response before the stated deadline. A bare denial is rarely enough.

What legally counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel to defamatory material published through a computer system or similar technology.

The prosecution ordinarily must prove:

A defamatory imputation. The material imputes a crime, vice, defect, discreditable act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose someone to contempt.
Publication. At least one person other than the person defamed received or understood the material. A public post is not essential; a group chat, restricted post, email, or private message sent to third persons may qualify.
Identification. The complainant is named or is identifiable from the words, images, context, or surrounding circumstances.
Malice. Malice is generally presumed from a defamatory imputation unless a privilege or constitutional rule removes that presumption.
Use of a computer system. The publication was made online or through information and communications technology.
Responsibility and identity. The accused authored, published, or caused the publication of the material. An account name or profile photograph alone may not conclusively prove authorship.

Context matters. Courts consider the entire post or conversation, the words’ ordinary meaning, the audience, accompanying images, the relationship of the parties, and surrounding events. Mere offensiveness, criticism, vulgarity, or general abuse does not automatically amount to libel if it does not convey a defamatory factual imputation about an identifiable person.

Cyber libel applies only to conduct punishable after the Cybercrime Prevention Act took effect. A post made before the law’s effectivity cannot be retroactively punished as cyber libel, although a later publication requires a separate factual and legal assessment.

Who may be liable for a post, comment, like, or share

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the author of the defamatory statement but declared the Cybercrime Act’s provisions on aiding, abetting, and attempting cyber libel unconstitutional.

Accordingly:

The original author or a person who caused a defamatory post to be published may be prosecuted.
A person is not liable for aiding or abetting cyber libel merely because they received the post or used a routine “like,” reaction, comment, or share function.
A commenter who writes a new defamatory accusation may become the original author of that separate statement.
Adding a defamatory caption, altered image, or new accusation to shared material is not the same as a bare reaction.
The same defamatory item cannot properly support convictions under both traditional libel and cyber libel when they are one and the same offense; double-jeopardy protections apply as explained in Disini.

Whether a particular republication is independently punishable depends on what the person actually authored or caused to be published. Do not assume that copying someone else’s accusation eliminates responsibility.

General rule on malice—and the important exceptions

Presumed malice

Article 354 of the Revised Penal Code provisions on libel generally presumes a defamatory imputation to be malicious, even if true, when no good intention and justifiable motive are shown.

Privileged communications

The presumption does not apply in the statutory situations that include:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or other official proceeding—or of an official act performed by a public officer.

For the first privilege, the communication normally must be made to a person or body with a corresponding interest, duty, or authority to act. Copying unnecessary recipients or publishing the accusation to the general public may defeat the claim that the communication was private and duty-bound.

Some statements made in official proceedings may also enjoy absolute privilege when legally relevant to the proceeding. Privilege is document- and context-specific; filing a complaint or pleading does not give a person unlimited license to circulate the allegations elsewhere.

Public officials, public figures, and matters of public interest

When the statement concerns a public official’s official conduct, a public figure, or a genuinely privileged matter of public interest, the prosecution may be required to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was true.

Actual malice is not established merely by hostility, harsh language, negligence, or failure to conduct a perfect investigation. It is determined from the evidence and circumstances. The Supreme Court explains this higher standard in Daquer v. People and Guingguing v. Court of Appeals.

A person does not lose all privacy and reputation rights merely by holding public office or becoming well known. The publication must still relate to the person’s public role or a legitimate matter of public concern.

Opinion and fair comment

Calling a statement an “opinion” does not automatically protect it. A statement framed as an opinion may still imply false, defamatory facts.

Fair comment is stronger when:

The underlying facts are true, accurately stated, or otherwise properly established;
The topic is genuinely of public interest;
The conclusion can reasonably be drawn from those facts; and
There is no proof of actual malice.

Truth is not always a complete defense

Under Article 361, proving truth alone does not invariably require acquittal. The defendant must generally also show good motives and justifiable ends. Proof of the truth of a non-criminal act or omission is subject to statutory limits, except where the imputation concerns a government employee’s discharge of official duties.

Anyone planning to publish a serious accusation should preserve the source documents and distinguish verified facts, allegations, and personal conclusions.

The one-year deadline

Cyber libel prescribes in one year. Under Articles 90 and 91 of the Revised Penal Code and the Supreme Court’s final ruling in Causing:

The period begins when the allegedly defamatory material is discovered by the offended party, the authorities, or their agents.
Publication and discovery may occur on the same day, but they are not legally presumed always to coincide.
A public privacy setting does not automatically prove that the complainant discovered the post on its publication date.
Comments, reactions, messages, screenshots, demand letters, or threats to sue may help prove when discovery actually occurred.
Filing the proper complaint or Information interrupts prescription.
The period may run again if proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.
Article 91 states that prescription does not run while the offender is absent from the Philippines.

The discovery date may become a contested factual issue. Complainants should record who first found the post, when and how it was found, and when it was forwarded. Respondents should preserve evidence suggesting an earlier discovery date.

A separately filed civil action for defamation is also subject to a short prescriptive period under Article 1147 of the Civil Code. Obtain specific advice before relying on any calculation.

Evidence to preserve immediately

If you are the complainant

Preserve more than a cropped screenshot:

The complete post, comment, message, video, image, or article;
The full URL, account handle, profile URL, account or post ID, and visible date and time;
The privacy or audience setting, if visible;
The surrounding conversation and earlier or later posts needed to explain context;
Reactions, comments, shares, view counts, and names of people who received or saw the material;
A screen recording showing navigation from the profile to the post;
Original downloaded files, without editing or recompression;
The device on which the post was first viewed;
Messages showing admissions, threats, motives, or links between the account and its operator;
Proof of the date of discovery;
Records of actual consequences, such as lost work, cancelled contracts, medical or counseling expenses, and communications from affected customers or colleagues; and
Witness affidavits from people with personal knowledge.

For an anonymous or dummy account, preserve the exact account identifiers before the account disappears. Contact investigators promptly so they can consider lawful data-preservation and disclosure procedures. Under Sections 13 and 14 of the Cybercrime Prevention Act, preservation and compelled disclosure from service providers are law-enforcement processes; a private complainant cannot simply demand confidential subscriber records.

If you are the respondent

Preserve potentially exculpatory material:

Full account archives, login history, security alerts, device lists, and recovery emails;
Reports of hacking, impersonation, lost devices, or unauthorized access;
The complete thread showing context rather than only the quoted sentence;
Drafts, source documents, recordings, official records, and communications relied upon;
Proof of fact-checking, requests for comment, corrections, and good-faith efforts;
Evidence showing who had access to a shared business or organization account;
Work, travel, device, or witness records relevant to authorship;
Evidence of the complainant’s earlier discovery of the post;
Copies of prior complaints or proceedings relevant to privilege; and
The original subpoena, envelope, email, or proof showing when it was received.

Do not fabricate, backdate, delete, or alter records. Preserve originals and work from copies.

Proving who controlled the account

The prosecution must prove the perpetrator’s identity, not merely that an account displayed the accused’s name or photograph.

In XXX v. People, the Supreme Court gave non-exclusive guideposts for proving account ownership, access, or authorship through direct or circumstantial evidence. Relevant proof may include:

An admission of ownership, access, or authorship;
A witness who saw the person use the account or compose the communication;
Information in the post known only to the alleged author or a small group;
Distinctive language, style, or patterns consistent with the person’s communications;
Platform, internet-service-provider, telecommunications, device, geolocation, search-history, or forensic records;
Conduct consistent with the post or message; and
Other evidence connecting the person to the account or content.

Technical records are valuable but are not indispensable in every case. Conversely, merely saying “that was a dummy account” will not create reasonable doubt if the surrounding digital and testimonial evidence reliably points to the accused.

Electronic documents must also be authenticated. The Rules on Electronic Evidence permit authentication through evidence showing the record’s integrity and reliability, testimony from a competent witness, and other recognized methods.

How to file a cyber libel complaint

1. Have the exact publication evaluated

Separate each allegedly defamatory post, comment, image, or video. Identify:

The precise words or images complained of;
What defamatory fact they communicate;
Who understood the material to refer to the complainant;
Who received or saw it;
Why the proposed respondent is the author or responsible publisher;
When discovery occurred;
How the material used a computer system; and
Why the selected venue is proper.

Avoid filing merely because a post was embarrassing or insulting. The complaint must establish every legal element with admissible, credible, and preservable evidence.

2. Confirm venue before filing

Cybercrime cases fall within the jurisdiction of the Regional Trial Court, specifically a designated cybercrime court. Under Section 21 of the Cybercrime Prevention Act and the Rule on Cybercrime Warrants, a qualifying venue may be the province or city where:

The offense or any element occurred;
Any part of the computer system used was situated; or
Damage to the natural or juridical person occurred.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of other qualifying courts. Venue allegations must be supported by facts, not conclusions. Cross-border posts, travelling users, corporate complainants, public officers, and multiple places of alleged damage require particular care.

3. Choose the filing route

A complainant may:

File a complaint-affidavit with the appropriate Office of the City or Provincial Prosecutor; or
Seek investigative assistance from the NBI Cybercrime Division or another authorized cybercrime law-enforcement unit, especially when authorship or subscriber information must be investigated.

The NBI’s official Cybercrime Division procedure states that complainants may execute sworn statements, submit prepared affidavits and supporting documents, and present relevant devices for examination.

An investigative complaint and a prosecutor’s preliminary-investigation complaint are not necessarily the same procedural step. Because prescription is only one year, confirm that the proper complaint has been formally docketed in time. Do not wait for a platform to answer a takedown request before seeking legal advice.

4. Prepare a complete sworn complaint

The current DOJ checklist generally requires an Investigation Data Form, a sworn complaint-affidavit, witness affidavits, supporting evidence, and the necessary copies for each respondent. Confirm the local prosecution office’s current filing and e-filing requirements.

A useful complaint-affidavit should state, from personal knowledge where possible:

The parties’ identities and addresses;
The exact publication and its context;
The URLs, accounts, dates, and audience;
How the complainant is identifiable;
How third persons received and understood it;
The basis for attributing authorship;
The date and circumstances of discovery;
Facts supporting venue;
Facts showing malice or actual malice, when required;
The harm caused; and
A clear identification of every attachment.

Label allegations from other people as such. Do not swear that something is personally known if it was only reported to you.

5. Participate in preliminary investigation

Because cyber libel carries a prescribed imprisonment range extending beyond six years, it ordinarily undergoes regular preliminary investigation under DOJ Department Circular No. 15, series of 2024.

The prosecutor applies the standard of prima facie evidence with reasonable certainty of conviction. The evidence must appear admissible, credible, capable of preservation and presentation, and sufficient to establish the offense and the responsible person.

The respondent receives the complaint and subpoena and is directed to submit a counter-affidavit. Under the regular procedure, the hearing date should give the respondent at least 10 days from receipt to prepare, but the specific date stated in the subpoena must be followed. Clarificatory hearings, replies, and rejoinders are not automatic.

If the prosecutor finds the standard met, an Information is prepared for court. Otherwise, dismissal is recommended.

6. Observe review deadlines

An aggrieved party may file a motion for reconsideration of the prosecutor’s resolution within 15 days from receipt under Department Circular No. 15. Further review is governed by DOJ appeal rules and depends on which prosecution official issued the resolution.

A motion for reconsideration or petition for review does not automatically stop an already filed court case. The appropriate motion to suspend proceedings must also be filed in court. Missing these deadlines can be fatal.

How to defend a cyber libel complaint

Respond immediately but carefully

Upon receiving a subpoena:

Record the exact date and manner of service.
Obtain the complaint, affidavits, and all attachments.
Consult a lawyer before contacting the complainant or investigators.
Preserve accounts, devices, source documents, and access records.
Identify witnesses and obtain their affidavits early.
Calendar the counter-affidavit date and the 15-day reconsideration period.
Check whether any Information has already been filed in court.

Do not substitute an unsworn letter or social-media rebuttal for a proper counter-affidavit. Do not publish the complainant’s private evidence or make new accusations while defending yourself.

Address every required element

A counter-affidavit should respond to the evidence, not merely deny the accusation. Depending on the facts, defenses may include:

The words are not defamatory when read in full context;
The complainant is not named or reasonably identifiable;
No third person received the communication;
The accused did not author, publish, or control the account;
The electronic evidence is incomplete, altered, unauthenticated, or hearsay;
The communication was privileged;
The post was fair comment based on established facts;
The subject was a public official or public figure and actual malice cannot be proved;
The relevant factual imputation was true and was published with good motives and justifiable ends;
The complaint was filed after prescription had run;
Venue or territorial jurisdiction is unsupported;
The same publication is being impermissibly charged as both traditional and cyber libel;
The post predates the Cybercrime Prevention Act; or
Evidence was obtained through an unlawful search, disclosure, interception, or examination.

A privilege defense should include the underlying duty, the recipient’s corresponding authority or interest, good faith, and the reason circulation was limited. A truth defense should attach competent source records and explain the legitimate purpose of publication.

Prescription may require evidence. In Causing, the Supreme Court allowed the issue to be raised at trial because the accused had not supplied adequate evidence establishing when the complainant discovered the posts.

If an Information has already been filed in court

The designated cybercrime RTC independently determines judicial probable cause. It may dismiss the case when the record clearly fails to establish probable cause, issue a summons where permitted, or issue a warrant of arrest.

If a warrant may exist:

Do not evade service.
Have counsel verify the case and warrant with the court.
Arrange lawful voluntary surrender and bail when appropriate.
Bring valid identification and the documents required by the court and bondsman.

Bail is generally a matter of right before conviction by the RTC for this non-capital offense, but the court determines the amount and conditions. Do not rely on an unofficial “standard bail” figure.

At arraignment, the accused is informed of the charge and enters a plea. The prosecution must then prove guilt beyond reasonable doubt. Available court remedies—including a motion to quash, objections to electronic evidence, demurrer to evidence, and appeal—have technical requirements and deadlines. A motion to quash based on prescription may fail when the claimed ground depends on contested evidence rather than facts apparent from the Information or record.

An RTC judgment is generally appealed to the Court of Appeals by filing a notice of appeal within 15 days from promulgation or notice, subject to the Rules of Criminal Procedure. Obtain advice immediately after judgment; post-judgment deadlines run quickly.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional libel. The prescribed imprisonment range is prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years.

For conduct governed by the current amended fine amounts, the Supreme Court held in People v. Soliman that the alternative fine for online libel ranges from ₱40,000 to ₱1,500,000. The court may impose imprisonment, a fine, or both, depending on the governing law and circumstances. Courts may choose a fine instead of imprisonment in a proper case, but an accused has no automatic entitlement to that result.

Older conduct may require application of the penal law in force when it occurred and any later law favorable to the accused.

Civil liability for reputational and other proven injury may be included in the criminal case unless the offended party waived it, reserved the right to sue separately, or previously filed the civil action. Moral, exemplary, nominal, and actual damages are not automatic; their legal and evidentiary requirements differ.

Settlement, correction, and apology

A prompt, accurate correction or apology may reduce harm and help the parties settle civil claims. It is not an automatic defense and does not erase a completed offense.

Once a criminal complaint is filed, the case is prosecuted in the name of the People of the Philippines. An affidavit of desistance or private settlement does not compel the prosecutor or court to dismiss a case supported by sufficient evidence. Any settlement should address the criminal and civil consequences separately and should not involve threats, payment for silence, fabricated affidavits, or obstruction of evidence.

Common mistakes to avoid

For complainants

Waiting for the post to “go viral” before preserving or filing;
Treating the publication date as automatically identical to the discovery date;
Submitting only cropped screenshots with no URL, context, or authenticating witness;
Assuming a profile name proves who authored the post;
Filing in a convenient location without facts establishing venue;
Quoting an insulting phrase without identifying a defamatory factual imputation;
Relying on a police blotter, platform report, or demand letter to interrupt prescription;
Omitting evidence that the complainant was identifiable to readers; and
Exaggerating damage or stating hearsay as personal knowledge.

For respondents

Ignoring a subpoena because it is “not yet a court case”;
Deleting the post, messages, login records, or account;
Posting a retaliatory accusation;
Contacting witnesses to influence their statements;
Relying only on “it was an opinion,” “it was true,” or “my account was hacked”;
Submitting a motion to dismiss instead of the required evidence-backed counter-affidavit;
Missing the 15-day reconsideration or appeal period;
Assuming a DOJ review automatically suspends the court case; and
Giving investigators an informal statement without understanding its possible use.

When legal help is urgent

Seek a Philippine criminal-law or cybercrime lawyer immediately if:

The one-year period may expire within the next several months;
The account is anonymous, deleted, or rapidly changing;
Platform or service-provider records may need urgent preservation;
You received an NBI or PNP invitation, prosecutor’s subpoena, court summons, or warrant;
The subpoena deadline is less than 10 days away;
An Information has already been filed;
The complainant is a public officer, public figure, corporation, or person abroad;
Multiple posts, jurisdictions, or defendants are involved;
The publication includes private records, intimate images, threats, or personal data that may trigger other offenses;
A search, seizure, account disclosure, or device examination occurred; or
Settlement discussions involve payment, retraction, confidentiality, or withdrawal of charges.

Those unable to afford private counsel may inquire with the Public Attorney’s Office, subject to its indigency, merit, conflict, and service rules.

Frequently asked questions

Can a private message be cyber libel?

A message sent only to the person defamed normally lacks publication to a third person. A group message, copied email, or private post seen by other people may satisfy publication. Other crimes or civil wrongs may still apply even when libel does not.

Is a screenshot enough?

A screenshot may help prove content, but it does not automatically prove authenticity, authorship, completeness, or publication. Preserve the original device, URL, context, witnesses, and account-identifying information.

Can I file against a dummy account?

Yes, but the responsible person must still be identified through admissible evidence. Investigators may seek lawful preservation, disclosure, and forensic evidence. A displayed name or photograph by itself may be insufficient.

Does deleting the post prevent a case?

No. Deletion does not erase a completed publication, and copies or platform records may remain. Deletion after notice can also create disputes about evidence preservation.

Is truth a complete defense?

Not always. Article 361 generally also requires good motives and justifiable ends, and restricts proof of some non-criminal imputations. Public-official, public-figure, and public-interest cases may involve additional constitutional rules.

Are likes and shares punishable?

Mere receipt, reaction, or use of standard like, comment, and share functions is not punishable as aiding or abetting cyber libel under Disini. Writing a new defamatory accusation or caption may create separate liability.

Does an apology end the criminal case?

No. It may reduce harm, support settlement, or affect the court’s assessment, but it does not automatically extinguish criminal liability.

Can a company be cyber-libeled?

Yes. Article 353 expressly protects both natural and juridical persons. The corporation must still be identifiable, properly represented, and able to establish the other elements and any claimed damage.

What if the author or platform is abroad?

Philippine jurisdiction may exist when an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, damage was caused to a person in the Philippines, or the accused is a Filipino national covered by Section 21. Venue, evidence gathering, service, and enforcement can nevertheless be complex.

Official legal and filing resources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The applicable remedy may change based on the exact publication, discovery date, evidence, parties, venue, and procedural history. Laws and official sources were checked through August 3, 2026.