Quick answer

To file a Philippine cyber libel case, preserve the online material and proof of when it was discovered, identify the author, confirm the correct venue, and submit a sworn complaint with supporting evidence to the proper prosecution office. To defend one, do not ignore the subpoena: preserve your own records and timely file a detailed counter-affidavit challenging authorship, venue, prescription, or any missing element, and raise applicable defenses such as privilege, fair comment, truth with the legally required conditions, or lack of actual malice.

Cyber libel is not established merely because an online statement is false, offensive, embarrassing, or widely shared. The prosecution must prove a defamatory imputation, publication to at least one third person, an identifiable victim, and malice, plus the use of a computer system. Liability is generally directed at the author of the defamatory online statement—not everyone who merely reads, likes, reacts to, or shares it. The governing provisions are Section 4(c)(4) of the Cybercrime Prevention Act of 2012 and Articles 353 to 362 of the Revised Penal Code.

Act quickly. The Supreme Court has definitively held that criminal cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to interruption and other rules under Article 91 of the Revised Penal Code. A separate civil action for defamation ordinarily also has a one-year prescriptive period. Do not assume that a demand letter, platform report, police inquiry, or informal negotiation stops either deadline.

What the prosecution must prove

The following must all be supported by admissible, credible, and preservable evidence:

A defamatory imputation. The statement must impute a crime, vice, defect, act, omission, condition, status, or circumstance tending to cause dishonor, discredit, or contempt. Words are read as a whole, in their ordinary meaning and full context. Mere insults, general abuse, hurt feelings, or harsh criticism do not automatically amount to libel.
Publication. Someone other than the person allegedly defamed must have seen, heard, or received the statement. A public post easily satisfies this requirement, but a limited group chat, private account, email, or direct message may also qualify if communicated to a third person. A message sent only to its subject ordinarily lacks publication.
An identifiable victim. Naming the person is not indispensable, but readers must reasonably be able to identify who was being discussed. A vague statement about a large, undefined group may fail this element.
Malice. For a private complainant, malice is generally presumed from an unprivileged defamatory imputation, although the respondent may rebut that presumption. Different constitutional standards apply when the statement concerns a public official, public figure, or matter of legitimate public concern.
Authorship or legally attributable publication. The evidence must connect the respondent to the account and the particular content. A profile name or screenshot alone may not reliably prove who controlled an account at the relevant time.
Use of a computer system or similar digital means. This is what brings the publication within Section 4(c)(4) of Republic Act No. 10175.

These elements were recognized in the Supreme Court’s en banc ruling in Disini v. Secretary of Justice. Failure to establish any element beyond reasonable doubt prevents a criminal conviction.

Who may be liable for likes, shares, comments, and reposts?

In Disini, the Supreme Court upheld cyber libel as applied to the author of the libelous statement but invalidated the Cybercrime Prevention Act’s provisions on aiding or abetting cyber libel because of their chilling effect on online speech. A person who merely receives, likes, reacts to, agrees with, or shares the original post is not automatically liable as an aider or abettor.

There is an important qualification: a commenter or reposter who adds a new defamatory assertion of their own may become the author of that new statement. Copying and presenting an accusation as one’s own content may also require a different analysis from merely pressing a platform’s share button. Liability depends on the exact words, format, context, and conduct—not the platform label alone.

The same online publication should not be charged simultaneously as both ordinary libel under Article 355 and cyber libel under Republic Act No. 10175. The Supreme Court has treated them as the same libel offense committed through a digital medium, with the use of information and communications technology affecting the penalty.

Important defenses and exceptions

No defamatory meaning

Read the entire post, conversation, video, caption, image, and linked material. Selective screenshots may change the apparent meaning. Satire, rhetorical hyperbole, general criticism, and expressions that do not impute a discreditable fact may fall outside libel, depending on how an ordinary reader would understand them.

Labeling a statement “opinion” is not conclusive. A supposedly personal opinion may still be actionable if it implies undisclosed or false defamatory facts.

No publication or no identifiable person

There may be no libel if no third person received the statement or if the complainant was not reasonably identifiable. Proof that the complainant personally felt targeted is not enough if readers could not connect the statement to that person.

The respondent was not the author

Account ownership and actual authorship are separate questions. Relevant defenses may include hacking, impersonation, loss of access, a shared business account, unauthorized posting by another administrator, or fabricated screenshots. These defenses need technical and circumstantial support, such as security notices, login records, device history, account-recovery communications, witnesses, and prompt reports made when the compromise was discovered.

Privileged communication

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or other official proceeding, statement, report, speech, or official act.

Privilege is not a blanket license to attack someone. The communication must remain connected to the duty or official proceeding, be made to appropriate recipients, and satisfy good-faith requirements. Proof of actual malice may defeat a qualified privilege.

Truth, good motives, and justifiable ends

Truth is not always a complete defense by itself. Under Article 361, the accused must generally establish both the truth of the imputation and that it was published with good motives and for justifiable ends. Proof of a non-criminal act or omission is subject to an additional statutory limitation unless the imputation concerns a government employee and facts related to official duties.

Preserve the actual records supporting the statement. Rumors, unnamed sources, screenshots of other posts, or a sincere belief unsupported by verification may not establish truth.

Public officials, public figures, and public issues

Speech about official conduct and legitimate public issues receives greater constitutional protection. Where the complainant is a public official or public figure and the statement concerns a relevant public matter, the prosecution must prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false. Mere negligence, an honest mistake, or an inaccuracy does not by itself establish reckless disregard.

The protection is not unlimited. Personal attacks unrelated to official conduct or the public issue may be treated differently. Unsupported accusations presented as facts remain risky. The Supreme Court discusses the actual-malice standard and its application to online speech in Disini and related decisions.

Prescription

Prescription is a complete defense if established, but the correct reckoning date is factual. In Causing v. People, as affirmed with finality in the Court’s April 8, 2026 resolution, the Supreme Court held that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents—not automatically from the date the post was uploaded.

Publication and discovery may occur on the same date, but they need not. A reaction, comment, message, threat to sue, or other contemporaneous conduct may help show when discovery occurred. If prescription is not apparent from the charging document, the accused generally bears the burden of proving it.

Filing the criminal complaint or information interrupts the criminal prescriptive period. The period may run again if proceedings end without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused. It does not run while the offender is absent from the Philippines.

Penalties and civil exposure

Traditional libel under the amended Article 355 is punishable by imprisonment, a fine, or both. Because cyber libel is committed through information and communications technology, Section 6 of Republic Act No. 10175 raises the penalty by one degree.

The potential imprisonment range for cyber libel is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years. A court may instead impose a fine; imprisonment is not mandatory in every conviction.

After Republic Act No. 10951 adjusted the fines under the Revised Penal Code, the Supreme Court held that the fine for online libel may range from ₱40,000 to ₱1,500,000. The actual penalty depends on the judgment and applicable mitigating or aggravating circumstances. See Republic Act No. 10951 and People v. Soliman.

Civil damages may be awarded separately from the criminal penalty. Article 33 of the Civil Code also permits an independent civil action for defamation, proved by preponderance of evidence rather than proof beyond reasonable doubt. Double recovery for the same act is not allowed.

How to file a cyber libel complaint

1. Record the discovery date immediately

Write down when, where, and how the material was first discovered and who discovered it. Preserve messages, notifications, comments, emails, or witness accounts that support that date. This evidence can determine whether the one-year criminal and civil deadlines have expired.

Do not delay filing solely because a demand for apology, correction, or takedown is being negotiated. Those measures may reduce harm but should not be assumed to interrupt prescription.

2. Preserve the complete online evidence

Before reporting or requesting removal, save:

The full post, article, video, image, caption, comment thread, and surrounding conversation;
The exact URL, username, profile link or account ID, platform, and visible audience setting;
The date, time, and time zone displayed;
Screenshots that include identifying interface details—not only cropped statements;
A screen recording showing navigation from the profile or page to the content;
Available downloads, exports, archived copies, and original media files;
Messages or notifications showing who received or reacted to the content;
Names and contact details of witnesses who personally saw it;
Evidence of reputational or financial harm; and
Proof of the complainant’s residence or public office at the time of the alleged offense, where relevant to venue.

Keep the original files and devices. Do not annotate or overwrite the only copy. Screenshots must still be authenticated; notarizing a printout does not automatically prove who authored the content or that it is complete and unaltered.

3. Identify the author without unlawful access

Collect only lawfully available information. Do not hack an account, impersonate another person, purchase stolen data, or deceive a service provider.

For anonymous or impersonating accounts, the NBI or PNP cybercrime units may investigate and seek appropriate court orders. Republic Act No. 10175 designates the NBI and PNP as cybercrime law-enforcement authorities, while disclosure, search, seizure, and examination of protected computer data are governed by warrants and judicial process. The NBI provides investigative assistance for victims of computer crimes and an online complaint facility.

A law-enforcement report assists investigation but should not automatically be treated as the formal prosecutorial filing that interrupts prescription.

4. Determine the proper venue

Venue in criminal cyber libel is jurisdictional and must be supported by specific facts. Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 is filed in the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used is situated; or
Where any of the damage to the natural or juridical person took place.

The court where the action is first properly filed acquires jurisdiction to the exclusion of the others. The Supreme Court has also warned that merely accessing an online article in a particular city does not necessarily prove that it was printed or first published there. Venue should not be selected simply for convenience or to burden the respondent. See Bonifacio v. RTC of Makati and Tieng v. Palacio-Alaras.

Because online venue can be contested, have the proposed venue reviewed before filing.

5. Prepare the complaint-affidavit and attachments

The sworn complaint should state facts within the complainant’s personal knowledge, including:

The respondent’s name and last known address, if available;
The exact defamatory words or material and a faithful translation where needed;
The complete context in which the statement appeared;
Why it is defamatory;
How the complainant is identifiable;
Who received, read, or viewed it;
Facts connecting the respondent to the account and publication;
The computer system or online medium used;
The discovery date;
Facts supporting venue; and
A numbered list of supporting documents and witnesses.

Attach the Investigation Data Form, witness affidavits, electronic evidence, records supporting identification and damage, and the required number of copies. The DOJ’s current public checklist is available on its Filing of Complaint for Preliminary Investigation page. Confirm the receiving office’s latest local requirements before submission.

6. File with the appropriate prosecution office

The complaint is ordinarily filed with the City or Provincial Prosecutor corresponding to the proper venue. Referral through the NBI or PNP may be useful when technical investigation or lawful account identification is needed.

Because cyber libel carries a prescribed penalty reaching more than six years, it undergoes regular preliminary investigation under DOJ Department Circular No. 015, series of 2024. The prosecution office first assesses the complaint’s form and evidentiary completeness. A complaint that does not establish prima facie evidence with reasonable certainty of conviction may be dismissed or returned for additional case build-up.

7. Participate in the preliminary investigation

If the complaint proceeds, the prosecutor issues a subpoena with the complaint and attachments. The subpoena directs the respondent to submit a sworn counter-affidavit and supporting evidence. Under the current DOJ rules, the scheduled date must ordinarily give the respondent at least ten days from receipt to respond.

The prosecutor may conduct clarificatory proceedings or require limited reply and rejoinder affidavits. The case is then resolved under the standard of prima facie evidence with reasonable certainty of conviction. The Supreme Court upheld this standard and the validity of the current DOJ rules in Meking v. Remulla.

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. Further review follows the applicable DOJ rules. For an RTC-cognizable offense such as cyber libel, review is generally elevated to the Secretary of Justice. Once an Information has been filed in court, a DOJ review does not by itself suspend the court proceedings; the proper motion must be filed.

How to defend a cyber libel complaint

1. Do not ignore the subpoena

Record the date and method of receipt. Read the subpoena and every attachment. The operative deadline is the date stated by the prosecutor, subject to the governing rules and any extension expressly granted.

Failure to respond does not amount to an admission, but the prosecutor may resolve the complaint using the evidence already submitted after proper notice. Contact counsel immediately if the attachments are incomplete, the deadline is near, or service was made at an incorrect address.

2. Preserve evidence before changing anything online

Do not delete posts, wipe devices, close accounts, edit timestamps, or ask witnesses to remove messages. Preserve:

The full content and context;
Drafts, research, interview notes, source materials, and edit history;
Account-access and security records;
Devices used or not used at the relevant time;
Messages showing who controlled the account;
Evidence of hacking, impersonation, or loss of access;
Proof of residence and location relevant to venue;
Evidence of the complainant’s earlier discovery;
Corrections, clarifications, or apologies; and
Communications showing good faith, verification efforts, or a legitimate duty.

A correction or apology may be relevant to malice, mitigation, or damages but does not automatically erase criminal liability.

3. Address every element in the counter-affidavit

A general denial is rarely enough. The counter-affidavit should identify the precise defect in the complaint, such as:

The words are not defamatory when read in full context;
No third person received the statement;
The complainant is not identifiable;
The respondent did not author or publish it;
The electronic evidence is incomplete, altered, unauthenticated, or inadmissible;
The statement is privileged;
It is a protected fair comment based on established facts;
The truth, good-motive, and justifiable-end requirements are satisfied;
Actual malice was not proved in a public-official or public-figure case;
Venue is improperly laid;
The complaint has prescribed; or
The charging document improperly duplicates ordinary and cyber libel.

Attach the evidence supporting each assertion. Do not speculate, disclose unnecessary private information, or contact the complainant’s witnesses to influence their testimony.

4. Raise venue and prescription promptly

These defenses may require documents and testimony. For prescription, establish when the offended party, authorities, or their agents actually discovered the content. For venue, examine where the relevant acts, computer system, and alleged damage are claimed to have occurred.

Do not assume that the upload date alone proves prescription or that the place where the complainant later opened the post automatically establishes venue.

5. Prepare for court proceedings if an Information is filed

The prosecutor’s resolution is not a conviction. Once the Information reaches the RTC, the judge independently determines whether probable cause exists for an arrest warrant. An accusation or prosecutor’s resolution does not by itself authorize an immediate search of devices or accounts.

If a warrant of arrest is issued, obtain counsel and arrange lawful surrender and bail without delay. Bail is generally a matter of right before conviction for this offense, subject to the court’s requirements. If law-enforcement officers seek access to a phone, computer, account, or stored data, ask to see the warrant and consult counsel before giving consent. Do not obstruct a lawful search.

Common mistakes to avoid

Filing in a convenient but legally unsupported venue;
Waiting for a platform response, apology, or demand-letter deadline while prescription runs;
Treating every liker, sharer, group administrator, page owner, or internet provider as the author;
Submitting only cropped screenshots without URLs, context, source files, or witnesses;
Assuming a notarized screenshot automatically proves authorship and authenticity;
Assuming that truth alone always defeats the charge;
Calling a factual accusation an “opinion” without disclosing its basis;
Publicly retaliating with new accusations;
Deleting content or devices after learning of a complaint;
Ignoring a subpoena because no arrest warrant has been issued;
Filing both ordinary libel and cyber libel over the same online act; and
Assuming that an affidavit of desistance or private settlement automatically ends the criminal case.

Once criminal proceedings begin, the prosecution is brought in the name of the People of the Philippines. The complainant cannot unilaterally command the prosecutor or court to dismiss it. Settlement may resolve civil claims or affect the available evidence, but its effect on the criminal case must be assessed separately.

When legal help is urgent

Seek a Philippine criminal-law or media-law lawyer immediately if:

The one-year period is close to expiring;
A subpoena, prosecutor’s resolution, Information, or court order has been received;
An arrest or cybercrime warrant has been issued;
The account is anonymous or the content may disappear;
The case involves a journalist, public official, public figure, or matter of public concern;
The post was edited, re-uploaded, translated, or published through several accounts;
A compromised or impersonating account is involved;
Law enforcement requests voluntary access to devices or accounts; or
The conduct also involves threats, extortion, intimate images, stalking, or an immediate safety risk.

Frequently asked questions

Is one screenshot enough to file?

It may support a complaint, but it is rarely ideal by itself. Preserve the URL, complete context, account details, timestamp, original files, witnesses, and evidence connecting the respondent to the publication. Authentication and authorship remain separate issues.

Can I file where I happened to read the post?

Not automatically. Venue must fall within the Rule on Cybercrime Warrants and be supported by specific facts. Mere access in a city does not necessarily establish proper venue.

Does a private or friends-only post count?

It can. Publication requires communication to at least one third person, not necessarily publication to the entire internet.

Can someone be charged merely for sharing another person’s post?

Not automatically. Disini protects persons who merely like, react to, comment on, or share the original statement from liability as aiders or abettors. A person who adds a new defamatory assertion may, however, be treated as the author of that new content.

Will the respondent be arrested as soon as the complaint is filed?

Ordinarily, no. A regular complaint proceeds through preliminary investigation. If an Information is later filed, the judge independently determines probable cause for a warrant. Lawful warrantless arrests remain possible only under the limited circumstances allowed by the Rules of Criminal Procedure.

Does taking the post down end the case?

No. Removal may limit continuing harm and may be relevant to damages or good faith, but it does not erase a completed publication. Preserve the evidence before requesting removal.

Does a demand letter stop the one-year period?

Do not assume so. A demand, platform report, or informal police report is not necessarily the complaint or information contemplated by Article 91. Obtain case-specific advice and make the proper filing before prescription becomes an issue.

Can the parties settle?

They may settle civil claims, request corrections, or submit an affidavit of desistance. The prosecutor or court, however, is not automatically bound to dismiss the criminal case because cyber libel is prosecuted in the name of the People.

What if the statement is true?

Truth can be a defense, but Article 361 generally also requires good motives and justifiable ends, and restricts proof of certain non-criminal imputations. Public-official and public-issue cases may involve additional constitutional protections. The supporting records and context are crucial.

Can a company file a cyber libel complaint?

Potentially, yes. Article 353 protects both natural and juridical persons, but the company must still be identifiable and establish every element, proper representation, venue, and timely filing.

Is acquittal in the criminal case the end of all civil exposure?

Not necessarily. An independent civil action for defamation may proceed under Article 33 of the Civil Code under a lower evidentiary standard, subject to prescription, procedural rules, and the basis of the acquittal.

Official sources

This article provides general Philippine legal information, not advice for a specific complaint, publication, or defense. Outcomes depend on the exact words, evidence, discovery date, venue, account attribution, and procedural history. The controlling sources and procedures were checked as of July 27, 2026.