Quick answer

Cyber libel is committed when a person publishes through a computer system a defamatory statement that identifies another person, is communicated to at least one third person, and is legally malicious. It is prosecuted under Section 4(c)(4) of the Cybercrime Prevention Act in relation to the Revised Penal Code provisions on libel.

If you are filing, preserve the post and its digital context immediately, identify when and how you discovered it, gather proof connecting the account to its author, and file a properly supported complaint-affidavit with the correct prosecution office before prescription becomes an issue. If you are accused, do not ignore a subpoena, publicly argue the case, delete evidence, or assume that calling a statement “opinion” automatically defeats liability. Obtain counsel promptly and prepare a counter-affidavit addressing every element and the authenticity of the electronic evidence.

The Supreme Court has ruled that cyber libel generally prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to interruption and other fact-dependent issues. Because the discovery date can be disputed, both sides should preserve evidence of when the material was first found and when the complaint was filed. See Causing v. People, G.R. No. 258524, October 11, 2023.

What counts as cyber libel?

Section 4(c)(4) of Republic Act No. 10175 applies the Revised Penal Code’s law on written libel when the publication is made through a computer system or similar technology. A Facebook post, online article, public comment, blog entry, email sent to third persons, or other electronic publication can potentially qualify. A purely private message seen only by the person discussed ordinarily lacks publication to a third person, although forwarding it or sending it to a group may change the analysis.

The prosecution generally must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Identification. The complainant must be identifiable from the words, image, surrounding facts, tags, links, or other context. Naming the person expressly is not always necessary, but a vague statement about an undefined group may be insufficient.
Publication. Someone other than the complainant must have received or understood the statement. Public visibility, readership, recipients, comments, shares, or witness testimony may prove this element.
Malice. Malice is ordinarily presumed from a defamatory publication unless it falls within a recognized privileged category or the surrounding facts negate malice. Different constitutional rules may apply when the statement concerns a public official, public figure, or matter of public concern.
Use of a computer system. The publication must have been made through information and communications technology.
Authorship or legally attributable participation. The evidence must reliably connect the accused to the publication. A profile name or screenshot alone does not necessarily prove who controlled the account or created the post.

The controlling statutory provisions are Republic Act No. 10175 and Articles 353–362 of the Revised Penal Code.

Not every offensive online statement is cyber libel

Insults, criticism, sarcasm, exaggeration, opinion, and harsh language are not automatically criminal. Courts examine the words as a whole, their ordinary meaning, the audience, the surrounding exchange, and whether the statement communicates a defamatory assertion of fact.

Calling something an “opinion” is not conclusive. A statement framed as opinion may remain actionable if it implies undisclosed defamatory facts. Conversely, criticism based on disclosed facts—especially concerning public affairs—may receive strong constitutional protection.

The following issues commonly determine the result:

whether readers would understand the words as factual or rhetorical;
whether the complainant was actually identifiable;
whether a third person saw the statement;
whether the statement was substantially true;
whether it was a fair comment based on true or privileged facts;
whether it was made in the performance of a legal, moral, or social duty;
whether the subject was a public official or public figure;
whether the prosecution can prove actual malice when constitutionally required; and
whether reliable evidence identifies the accused as the original author.

Original authors, reactions, shares, and comments

In Disini v. Secretary of Justice, G.R. No. 203335, February 11, 2014, the Supreme Court upheld cyber libel as to the original author but struck down its application to persons who merely receive and react to a post. It also invalidated aiding or abetting liability specifically in relation to cyber libel.

Accordingly, a passive recipient or a person who merely uses a platform reaction is not automatically criminally liable for the original post. But this does not give blanket immunity to all later activity. A person who adds a new defamatory caption, comment, accusation, altered image, or other original content may be investigated for that person’s own publication. Whether editing or reposting amounts to a new publication depends on what was actually done and the applicable evidence.

Malice, privilege, truth, and public-interest speech

Presumed malice and privileged communications

Article 354 generally presumes malice from a defamatory statement, even if true, unless good intention and justifiable motive are shown or the statement is privileged.

Recognized qualified privileges include:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of specified official proceedings or acts of public officers.

Qualified privilege does not automatically end the case. It generally shifts the dispute toward whether the speaker acted with actual malice—such as knowledge of falsity or reckless disregard of whether the statement was false. Excessive publication, irrelevant accusations, hostility, fabrication, or failure to verify an inherently improbable accusation may be relevant, but no single fact is automatically decisive.

Certain statements made in judicial or legislative proceedings may be absolutely privileged when pertinent to the proceeding. The boundaries of privilege are technical and depend heavily on context.

Truth is important but not always sufficient by itself

Truth can be a defense, but Philippine criminal-libel law does not reduce every case to “true or false.” Under Article 361, the admissibility and effect of proof of truth depend on the nature of the imputation. Acquittal may require proof not only of truth but also of good motives and justifiable ends.

Before publishing an accusation, retain the records that support it. Repeating a rumor, relying on an anonymous message, or saying “allegedly” does not necessarily protect the author if the overall publication adopts an unsupported accusation as true.

Public officials, public figures, and matters of public concern

Speech about public officials and public figures receives greater constitutional protection. When the defamatory statement relates to official conduct or a matter of public concern, liability may require proof of actual malice in the constitutional sense: knowledge that the statement was false or reckless disregard of whether it was false.

Actual malice is not the same as personal dislike, anger, or spite. It concerns the publisher’s state of mind regarding falsity. Courts may consider the source, verification efforts, obvious reasons to doubt the information, the wording used, and the full circumstances.

The protection of public-interest criticism is substantial, but it is not permission to fabricate facts or knowingly publish false accusations.

The filing deadline

The Supreme Court’s controlling ruling in Causing v. People states that cyber libel prescribes in one year from the day the offense is discovered by the offended party, the authorities, or their agents. Publication and discovery may occur on the same date, but they are not necessarily identical.

Prescription is interrupted by the institution of the appropriate complaint or proceedings and may run again if proceedings terminate without conviction or acquittal for a reason not constituting jeopardy. The precise interrupting event and calculation should be reviewed against the actual record.

A claim that the post remained continuously accessible does not automatically make cyber libel a continuing offense or restart prescription every day. Likewise, the mere continued existence of an old webpage should not be treated casually as a fresh publication. Material edits or genuinely new publications require separate factual analysis.

Anyone considering a complaint should act well before the one-year mark. Anyone defending should obtain:

evidence of the original publication date;
evidence of the complainant’s earliest knowledge;
earlier messages or public responses showing discovery;
dates of referral to police, the NBI, counsel, or prosecutors; and
the official filing and docket dates.

Prescription may require an evidentiary hearing if it is not apparent from the face of the Information. The accused carries the practical burden of supporting the defense with competent evidence rather than relying solely on the date printed on a screenshot.

How to preserve online evidence

Preserve evidence before requesting removal or blocking the account. A screenshot is useful, but it should not be the only record.

Capture and retain:

the full text, photographs, video, caption, hashtags, tags, and comments;
the complete URL or other unique identifier;
the account name, profile URL, account ID if visible, and identifying information;
the exact date and time displayed, including the device’s time zone;
a screen recording showing navigation from the profile or page to the post;
the surrounding thread and earlier posts needed to understand context;
visible reactions, shares, audience settings, and engagement;
messages or admissions concerning authorship;
the original electronic files rather than only compressed copies;
email headers, message-export files, download archives, and available metadata;
names and contact details of people who personally saw the publication;
evidence of the discovery date; and
evidence of harm, such as lost work, cancelled contracts, inquiries from clients, or relevant medical records.

Do not crop away context, alter filenames, annotate the only copy, or repeatedly re-save files. Keep a clean original and document who collected each item, when it was collected, and how it was stored. Generate file hashes or use forensic assistance when authenticity is likely to be contested.

Electronic evidence must still be authenticated. The Rules on Electronic Evidence allow electronic documents to be proved through evidence of their integrity, reliability, manner of generation or storage, and other circumstances supporting authenticity. See the Supreme Court’s Rules on Electronic Evidence, A.M. No. 01-7-01-SC.

How to file a cyber-libel complaint

1. Assess the statement before filing

Identify the exact words claimed to be defamatory. Do not submit only a general allegation that the post was “false,” “offensive,” or “damaging.” Explain:

what factual imputation was made;
why it is defamatory;
how it refers to you;
who received or saw it;
why the publication was malicious;
how the account or device is connected to the respondent;
when you discovered it; and
why the filing is timely.

Consider whether the statement may be privileged, substantially true, rhetorical, or protected public-interest criticism. A criminal complaint should not be used simply to silence disagreement or obtain leverage in an unrelated dispute.

2. Determine the proper place of filing

Cybercrime jurisdiction exists when the statutory connecting factors in Section 21 of Republic Act No. 10175 are present, including where an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, or qualifying damage was caused to a person who was in the Philippines.

That broad jurisdictional provision does not eliminate procedural venue requirements. Do not assume that a case may be filed anywhere the post could be viewed. Venue must be supported by specific facts alleged and eventually proved. The location of the author, the relevant computer system, publication, the complainant, and the place where damage occurred may matter.

A complaint is ordinarily lodged with the appropriate city or provincial prosecution office. The NBI Cybercrime Division or the PNP Anti-Cybercrime Group may assist with identifying an account holder, preserving provider data, or obtaining evidence that requires compulsory legal process. They do not replace the prosecutor’s determination of whether charges should be filed.

3. Prepare the complaint-affidavit and supporting affidavits

The complaint-affidavit should be sworn, based on personal knowledge or properly identified authentic records, and organized chronologically. Attach legible, numbered exhibits and explain each exhibit.

Supporting material commonly includes:

authenticated captures of the publication;
witness affidavits proving publication and identification;
records connecting the respondent to the account;
documents disproving the accusation;
proof of the complainant’s discovery date;
proof of the filing date and venue facts;
records of any request for correction or response; and
proof of actual harm, if relevant.

A demand letter or prior request to delete or apologize is not an element that must invariably precede a criminal complaint. It may nevertheless be relevant to malice, mitigation, settlement, or damages. Sending one may also provoke deletion, alteration, or further publication, so preserve the evidence first.

4. Follow the current preliminary-investigation rules

The prosecutor evaluates whether the evidence meets the governing standard for filing a criminal case. Under the 2024 DOJ–National Prosecution Service rules, preliminary investigation focuses on whether the evidence establishes a prima facie case with reasonable certainty of conviction, subject to the rules and current Supreme Court rulings.

The respondent is normally given notice and an opportunity to submit a counter-affidavit and supporting evidence. Hearings are not automatic trials; prosecutors may call clarificatory proceedings when necessary. Parties must comply with the dates and service instructions stated in the subpoena or prosecutor’s order rather than relying on an informal summary of deadlines.

The current issuances are available through the Department of Justice issuances page. The Supreme Court addressed the validity of the heightened preliminary-investigation standard in its 2026 ruling in G.R. No. 280455.

5. After the prosecutor’s resolution

If the complaint is dismissed or an Information is recommended, the aggrieved party may have an administrative remedy within the DOJ under its applicable rules. The correct remedy, reviewing office, filing period, and effect on court proceedings depend on the resolution and procedural posture. Obtain the complete resolution and proof of receipt immediately; review periods are usually short and late filing can be fatal.

If an Information is filed, the case proceeds in the designated Regional Trial Court or cybercrime court. The court independently determines probable cause for issuing a warrant or summons. Filing by a prosecutor does not itself establish guilt.

Requests for subscriber information and computer data

Private parties ordinarily cannot compel a platform or telecommunications provider to disclose confidential subscriber, traffic, or content data merely by sending a letter. Disclosure and forensic examination may require law-enforcement involvement and an appropriate court-issued cybercrime warrant.

Under Republic Act No. 10175 and the Rule on Cybercrime Warrants, investigators may seek appropriate orders for preservation, disclosure, interception, search, seizure, or examination of computer data. Different warrants have different requirements and scopes. Content data and subscriber information should not be treated as freely obtainable.

Service providers may retain different categories of information for limited periods. Section 13 of Republic Act No. 10175 provides statutory preservation periods and permits a one-time extension in specified circumstances. Prompt coordination with competent investigators can therefore matter, particularly when the author used a pseudonym or deleted an account.

The applicable procedure is in the Supreme Court’s Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC. Evidence obtained through an unlawful search may be challenged. The Supreme Court also invalidated warrantless real-time traffic-data collection under Section 12 and executive blocking under Section 19 in Disini.

How to defend a cyber-libel complaint

1. Treat a subpoena as urgent

Record the exact date and manner of receipt. Obtain the complete complaint, annexes, subpoena, and docket information. Consult counsel before submitting explanations to investigators or contacting the complainant.

Do not ignore the proceeding. A prosecutor may resolve the complaint on the available evidence if the respondent fails to participate properly.

2. Preserve your own evidence

Do not delete the post, account, device contents, messages, drafts, research, or source material after learning of a complaint. Deletion does not guarantee disappearance and may destroy favorable evidence or create credibility problems.

Preserve:

the original post and complete conversation;
audience and privacy settings;
drafts and revision history;
sources relied upon;
records of verification efforts;
documents supporting truth or substantial truth;
communications showing the purpose and context;
account-security records if authorship is disputed;
proof of compromise, impersonation, or unauthorized access;
evidence of publication and discovery dates; and
all notices and filing records.

3. Address every element in the counter-affidavit

A useful defense does more than deny malice. Depending on the facts, it may show that:

the words were not defamatory in context;
the statement was opinion, satire, or rhetorical hyperbole rather than a factual assertion;
the complainant was not identified;
no third person received the statement;
the accused was not the author or account controller;
the electronic evidence is incomplete, altered, unauthenticated, or hearsay;
the imputation was true and made with good motives and justifiable ends;
the statement was privileged;
constitutionally required actual malice cannot be proved;
venue or jurisdiction is defective;
the offense had prescribed;
the post predated the law’s effectivity and was not later republished; or
the Information would expose the accused to impermissible duplicate prosecution for the same online libel.

Admissions should be made carefully. A blanket statement such as “my account was hacked” is unlikely to help without logs, security notices, device evidence, a timely platform report, or other corroboration.

4. Examine the Information after filing in court

Defense counsel should determine whether the Information alleges all essential facts, including the defamatory publication, identity, authorship, use of a computer system, venue, and relevant date. Possible remedies may include a motion to quash, motion for judicial determination of probable cause, request for particulars, or presentation of a defense at trial. The correct remedy depends on the defect and procedural stage.

Prescription is not necessarily waived by arraignment because it extinguishes criminal liability, but raising and proving it promptly is safer. If the discovery date is disputed, be prepared to present evidence.

5. Avoid trial by social media

Publicly posting the complaint, insulting the complainant, rallying followers, or repeating the contested accusation may create new evidence or additional claims. Communicate through counsel and preserve lawful defenses for the proper forum.

Penalties and other possible liability

Article 355 of the Revised Penal Code, as amended by Republic Act No. 10951, provides imprisonment or a fine for ordinary written libel. Section 6 of Republic Act No. 10175 makes the penalty one degree higher when the crime is committed through information and communications technology. The resulting imprisonment range commonly associated with cyber libel is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years, subject to the Indeterminate Sentence Law, the charge proved, and judicial sentencing rules.

The exact lawful sentence cannot be determined from the post alone. Courts consider the applicable penalty provisions, modifying circumstances, the Indeterminate Sentence Law, and whether a fine rather than imprisonment is warranted. In Administrative Matter No. 08-1-17-SC, the Supreme Court expressed a preference for fines in appropriate libel cases, but it did not remove imprisonment from the statute or create an automatic right to a fine-only sentence.

Civil liability may be pursued with or separately from the criminal case under the applicable procedural and Civil Code rules. Damages are not automatic; causation and the factual basis for each claimed amount must be proved. A separate civil action for defamation also has its own prescriptive period—generally one year—so counsel should assess it immediately.

A person should not be punished twice for the same online publication as both ordinary libel and cyber libel. Disini held that dual prosecution for the same online libel would violate the rule against double jeopardy.

Common mistakes by complainants

Waiting close to or beyond one year without preserving proof of discovery.
Submitting cropped screenshots without URLs, timestamps, context, or authentication.
Assuming a fake profile automatically proves the suspected person was the author.
Treating hurt feelings or criticism as sufficient proof of a defamatory factual imputation.
Filing wherever convenient without establishing venue.
Omitting proof that a third person saw the statement.
Ignoring privilege, public-interest context, or the complainant’s public-figure status.
Claiming unsupported damages.
Asking a platform to remove the material before preserving it.
Naming people who merely reacted to or received the original post.
Using the complaint primarily to pressure someone over an unrelated debt, employment dispute, or political disagreement.

Common mistakes by respondents

Ignoring a prosecutor’s subpoena or missing the stated submission date.
Deleting posts, chats, devices, or account records after notice of a complaint.
Repeating the accusation while claiming to defend it.
Assuming “it was only my opinion” or “I used the word allegedly” is a complete defense.
Claiming hacking or impersonation without supporting technical evidence.
Relying only on truth while ignoring good motive, justifiable ends, or privilege.
Attacking the complainant personally instead of addressing the elements and exhibits.
Overlooking prescription, discovery evidence, venue, and authentication.
Contacting or threatening witnesses.
Giving passwords or consenting to a device search without understanding the request, warrant, and right to counsel.

When legal help is urgent

Seek a Philippine lawyer experienced in criminal procedure and electronic evidence immediately if:

the one-year period may expire soon;
you received a prosecutor’s subpoena, summons, warrant, or court notice;
police or NBI personnel want to search, seize, unlock, or examine a device;
an anonymous account must be identified before provider data disappears;
the post has been deleted or altered;
the disputed material concerns a public official, journalist, whistleblower, election, or public controversy;
the statement repeats allegations from confidential, leaked, or unlawfully obtained records;
several people, pages, or jurisdictions are involved;
a child, protected victim, or sealed proceeding is mentioned;
the publication creates an immediate safety threat; or
related charges such as threats, harassment, identity theft, data-privacy violations, or obstruction are possible.

The Public Attorney’s Office may assist qualified indigent parties, subject to its mandate, eligibility requirements, and conflict rules. Law-enforcement cybercrime units can assist with investigation, but they do not provide independent legal representation.

Frequently asked questions

Can I file because a post is false and embarrassing?

Not necessarily. You must establish the statutory elements, including a defamatory imputation, identification, publication to a third person, malice, use of a computer system, and reliable attribution to the respondent. Constitutional and statutory defenses may still apply.

Is a screenshot enough?

A screenshot may support a complaint, but it may not prove authorship, completeness, authenticity, publication, or when the post was discovered. Preserve the URL, full context, original files, metadata, witnesses, and account-identification evidence.

Do I have to send a demand letter first?

No general rule makes a demand letter an essential element of cyber libel. It may be useful in some cases, but evidence should be preserved first and the prescription period should not be allowed to expire during negotiations.

Does deleting the post end the case?

No. Deletion may limit continuing harm but does not erase an already completed publication. It may affect evidence, mitigation, settlement, or damages. Preserve a forensic copy before removing material.

Am I liable for liking or sharing someone else’s post?

A mere recipient or reactor is not automatically liable for the original cyber libel under Disini. A person who adds an independently defamatory caption or comment may be answerable for that new content. The precise act and wording matter.

Can a private message be cyber libel?

A message sent only to the person discussed ordinarily lacks publication to a third person. Sending it to another person, a group chat, an employer, relatives, clients, or the public may satisfy publication. The sender’s duty, purpose, and audience may also raise privilege issues.

Can a corporation be the complainant?

A juridical person can have a business reputation and may be identifiable as the target of defamatory allegations. The complaint must still establish the applicable elements and show who is authorized to act for the entity.

Can an anonymous account be sued immediately?

A complaint may begin with available evidence, but identifying and connecting a real person to the account often requires investigation and lawful data-disclosure procedures. Do not equate suspicion, writing style, or a display name with proof of authorship.

Is cyber libel bailable?

Yes. Before conviction, cyber libel is ordinarily bailable because it is not punishable by reclusion perpetua. The court determines the amount and conditions under the applicable bail rules.

Can the parties settle?

They may explore apology, correction, takedown, or civil settlement, but private agreement does not automatically terminate a public criminal prosecution once initiated. Any affidavit of desistance is not binding on the prosecutor or court, although it may affect the evidence and the practical course of the case. Do not pay, threaten, or sign a waiver without legal advice.

Can I file both criminal and civil cases?

Potentially, but the relationship between civil liability arising from the offense, an independent civil action, reservation or waiver, prescription, and double recovery must be handled carefully. A claimant cannot recover twice for the same injury.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel questions depend on the precise words, context, electronic records, discovery date, venue, and procedural history. The cited laws, procedures, and official sources were checked as of September 21, 2026.