Quick answer

To file a cyber libel case, preserve the online material immediately and file a sworn complaint-affidavit—supported by admissible evidence—before the proper City, Provincial, Regional, or State Prosecution Office. The complaint must show a defamatory imputation, publication to at least one person other than the complainant, identification of the person defamed, malice, use of a computer system or similar technology, and the respondent’s responsibility as the original author.

Act quickly. The Supreme Court has definitively ruled that cyber libel prescribes in one year from its discovery by the offended party, the authorities, or their agents, not automatically from the date it was posted. There is no presumption that an online post was discovered on publication. Filing the criminal complaint with the prosecution office interrupts the prescriptive period. These rules were affirmed in the Supreme Court’s April 8, 2026 resolution in Causing v. People.

If you are defending a complaint, do not ignore the prosecutor’s subpoena. Submit a sworn, evidence-backed counter-affidavit on the stated date, which must ordinarily be at least ten days after you receive the subpoena and complaint. Raise missing elements, lack of authorship, privilege, absence of actual malice when required, prescription, improper venue, and evidentiary defects as early as possible.

A prosecutor’s subpoena is not an arrest warrant. If an Information is later filed, however, the designated cybercrime Regional Trial Court may issue a warrant after independently finding probable cause. Obtain counsel promptly so that any warrant, bail, arraignment, or pre-plea defense can be handled correctly.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the libel provisions of Articles 353 and 355 of the Revised Penal Code when the defamatory material is published through a computer system or a similar technological means.

The prosecution must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the material. A private message sent only to the target ordinarily lacks this element; a group chat, public post, email copied to others, video, website article, or similar communication may satisfy it.
Identification. The complainant must be named or reasonably identifiable from the words, images, circumstances, or audience’s knowledge. Avoiding a name does not prevent liability if readers can determine who was meant.
Malice. For an unprivileged defamatory statement about a private person, malice is generally presumed under Article 354. Where the speech is privileged or concerns the official conduct of a public official or a public figure, the prosecution must prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false.
Use of a computer system or similar means. This includes publication through social media, websites, online messaging, email, or comparable information and communications technology.
Responsibility of the accused for the publication. The prosecution must connect the accused to the account and prove that the accused authored or caused the publication.

The Supreme Court in Disini v. Secretary of Justice upheld cyber libel only as applied to the original author and struck down liability for people who merely receive and react to a post. It also invalidated Section 5’s provisions on aiding, abetting, and attempting cyber libel.

A person who adds a new defamatory caption, creates a new accusation, or otherwise authors a fresh defamatory publication cannot safely assume that the protection for a passive like, share, or reaction applies.

Malice, truth, opinion, and protected communications

Truth is not automatically a complete defense

Article 361 allows the accused to prove truth. As a general rule, acquittal requires both:

proof that the imputation was true; and
proof that it was published with good motives and for justifiable ends.

The rules on admitting proof of truth differ depending on whether the imputation alleges a crime, a noncriminal act, or conduct connected with a government employee’s official duties. A bare assertion that “it is true” is therefore not enough. Preserve the records, witnesses, and sources that establish both the factual basis and the legitimate reason for publication.

Calling something an “opinion” does not settle the issue

Courts consider the complete statement and its context. Pure comment, rhetorical criticism, or hyperbole may receive constitutional protection, particularly on public affairs. But an “opinion” that implies undisclosed or provably false facts—such as an accusation of bribery, theft, fraud, or sexual misconduct—may still be defamatory.

Public officials and public figures

When a statement concerns a public official’s conduct in office or a public figure on a matter of public concern, the prosecution must prove actual malice beyond reasonable doubt. Actual malice means that the author knew the statement was false or seriously doubted its truth and published it anyway. Failure to investigate, error, or even serious negligence does not by itself always prove this demanding mental state.

In July 2026, the Supreme Court acquitted a person charged with cyber libel over Facebook posts concerning a mayor because actual malice was not proved beyond reasonable doubt. A grudge and failure to verify did not, on the evidence presented, establish knowledge of falsity or reckless disregard. See Tan v. People, G.R. No. 265929.

Public officials may still bring cyber libel complaints. Their status is not an automatic defense; it changes what the prosecution must prove when the statement concerns public conduct.

Privileged communications

Article 354 removes the ordinary presumption of malice from:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of a nonconfidential judicial, legislative, or other official proceeding, or of an official act.

Privilege depends on the occasion, recipients, content, relevance, good faith, and manner of publication. Distributing an accusation far beyond the people who have a legitimate interest may defeat a claim that it was a protected private communication. Qualified privilege also does not protect a publication proved to have been made with actual malice.

The one-year deadline

Cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. The April 8, 2026 en banc resolution in Causing v. People rejected both the 12-year and 15-year positions that appeared in earlier cases and arguments.

Important consequences follow:

Record exactly when, how, and from whom the complainant first learned of the publication.
Save the message, notification, email, or witness statement that can corroborate the discovery date.
Do not assume that continuing online availability restarts the deadline each day.
Do not wait for a platform to finish an internal review before filing.
A later edit, repost, or materially new publication may raise a separate republication issue, but that question is fact-sensitive.
Prior proceedings, their termination, and the respondent’s absence from the Philippines may affect computation under Article 91. Obtain specific advice if the deadline is close.

The Supreme Court has also clarified that filing a criminal complaint with the prosecution office interrupts prescription. See G.R. No. 258563, April 2, 2025. Preserve the receiving copy, docket number, official receipt, and filing date.

A separate civil action for defamation is likewise generally subject to a one-year period under Article 1147 of the Civil Code. Civil claims require separate analysis because the civil liability arising from the crime is ordinarily deemed instituted with the criminal action unless waived, reserved, or previously filed.

How to preserve online evidence

Screenshots are useful but may be inadequate by themselves. Electronic evidence must be authenticated and shown to be reliable under the Rules on Electronic Evidence.

Preserve as much of the following as possible:

full, uncropped screenshots showing the account name, account identifier, URL, date, time, post, captions, images, comments, and surrounding context;
a screen recording that begins at the profile or page and navigates to the material;
the original URL and direct links to the post, image, or video;
downloaded copies of the webpage, messages, video, audio, and attached files;
the original phone, computer, storage device, or account from which the evidence was viewed;
message exports, account-download archives, email headers, source files, and available metadata;
affidavits from people who personally saw the publication;
evidence identifying the account owner, such as admissions, prior messages, linked contact information, consistent account activity, or verified profile records;
proof of publication to third persons, including witness testimony and relevant engagement records;
records supporting truth, falsity, privilege, good faith, motive, or actual malice;
documents showing actual reputational or financial harm if damages will be claimed; and
evidence fixing the date of discovery.

Keep an untouched master copy and work from duplicates. Do not crop, annotate, compress, rename, or repeatedly forward the only original file. Record who collected each item, when it was collected, and where it has been stored.

If the account is anonymous, the material is disappearing, or platform data will be essential, seek investigative help promptly. The NBI Cybercrime Division can receive requests for investigative assistance. Law-enforcement officers may seek preservation, disclosure, search, or examination orders under the Rule on Cybercrime Warrants. A private demand letter is not a substitute for a legally effective preservation order or warrant.

How to file the complaint

1. Identify a legally supportable venue

Cyber libel cases are tried by designated cybercrime Regional Trial Courts. Under Section 2.1 of the Rule on Cybercrime Warrants, venue may be based on the province or city where:

the offense or any element was committed;
any part of the computer system used was situated; or
damage to a natural or juridical person took place.

Venue must rest on specific facts. Merely showing that an internet post could be accessed in a particular city does not automatically make every such city a proper venue. Filing in the wrong place can result in dismissal or substantial delay.

The complaint is initially filed with the prosecution office that has territorial authority corresponding to the proper court. If venue is uncertain—especially where the author, server, device, and complainant are in different places—obtain legal advice before filing.

2. Prepare a complete complaint-affidavit

Under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, the complainant should file:

the original complaint-affidavit;
two duplicate copies for the official file;
one additional copy for each respondent;
a completed NPS Investigation Data Form;
witness affidavits; and
all available documentary, electronic, and object evidence.

The complaint-affidavit should state the parties’ names and addresses, the date and place of the offense, the exact statements or images complained of, the surrounding context, the discovery date, the facts establishing venue, how each element was committed, and how the respondent is connected to the account.

Affidavits must be sworn before a prosecutor or another government official authorized to administer oaths, or, when they are unavailable, before a notary public. Check the DOJ filing checklist and the receiving office’s current requirements before filing. Do not assume that ordinary email submission is accepted unless the office has authorized it.

3. Meet the current evidentiary standard

A prosecutor may file an Information only when there is prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, preservable, and capable of establishing every element and the identity of the responsible person. The Supreme Court upheld this prosecutorial framework in G.R. No. 280455.

This heightened screening makes a complete, trial-ready complaint important. A viral post or offensive language alone does not prove authorship, malice, proper venue, or admissibility.

4. Follow the preliminary-investigation process

For regular preliminary investigation:

Within five calendar days after receiving the complete records, the investigating prosecutor must either recommend dismissal or issue subpoenas.
The hearing date must generally be no later than 30 days from the prosecutor’s receipt of the records.
The respondent’s deadline to submit a counter-affidavit must be at least ten days after receipt of the subpoena and complaint.
A clarificatory hearing may be held when necessary.
A reply and rejoinder may be required for substantial new issues; each must be filed within ten calendar days after receipt of the pleading being answered.
Preliminary-investigation complaints should generally be resolved within 60 calendar days from assignment, with a maximum 30-day extension for specified circumstances such as complex issues, countercharges, consolidation, or reassignment.

These disposition periods guide the prosecution service; their lapse does not automatically dismiss a case. Keep copies of notices, orders, proof of service, and follow-up correspondence.

How to defend the complaint

1. Calendar every deadline immediately

Record the date and manner in which the subpoena and attachments were received. The date written in the subpoena controls unless lawfully changed.

An extension is not automatic. The investigating prosecutor may grant one when the interests of justice require additional time to obtain counsel, examine voluminous records, or address complicated factual or legal issues. An approved extension for a responsive pleading may not exceed ten days.

2. File a sworn counter-affidavit, not a bare denial

The respondent should file:

the original counter-affidavit;
two duplicate copies for the official file;
a copy for each complainant;
witness affidavits; and
documentary and electronic evidence supporting every defense.

A motion to dismiss generally cannot replace the counter-affidavit. A verified motion containing the respondent’s defenses may instead be treated as the counter-affidavit. If the respondent fails to answer after valid service at the last known address, the prosecutor may resolve the case using only the complainant’s evidence.

Personal appearance may be dispensed with when the counter-affidavit has already been properly sworn, but the respondent must follow the subpoena and any specific prosecutorial order. Attendance is mandatory if a clarificatory hearing is set.

3. Test every element

A useful defense review asks:

Were the words or images actually defamatory when read in context?
Was the complainant reasonably identifiable?
Did any third person receive the communication?
Did the respondent create or cause the publication?
Is account ownership proved, or merely assumed from a display name?
Was the publication made through a computer system?
Was it privileged?
Does the statement concern official conduct or a public figure, requiring proof of actual malice?
What records show the respondent’s sources, belief in the statement, verification efforts, or serious doubts?
Was the complaint filed within one year from provable discovery?
Are the alleged place and facts sufficient to establish venue?
Were the screenshots and other electronic records properly authenticated?
Does the Information, if already filed, allege facts matching the prosecution’s evidence?
Is the same publication being impermissibly charged as both ordinary libel and cyber libel?

The Supreme Court held in Disini that charging the same defamatory publication under both the Revised Penal Code and Section 4(c)(4) of Republic Act No. 10175 violates the prohibition against double jeopardy.

4. Preserve defense evidence

Do not delete the account, messages, drafts, devices, source materials, or records showing who had access. Deletion may destroy exculpatory evidence and can create disputes about concealment.

Preserve:

account login and security history;
original drafts and source files;
research, reports, official records, and communications relied upon;
evidence that another person controlled or compromised the account;
the complete conversation or thread, not only the quoted portion;
proof of limited recipients or privacy settings;
records relevant to privilege, good faith, or legitimate purpose; and
travel and location records relevant to venue or prescription.

5. Avoid retaliatory publication or pressure

Do not attack the complainant, publish confidential case records, coach witnesses, or demand an affidavit of desistance through threats or harassment. New posts may create separate evidence or additional causes of action.

An apology, correction, settlement, or affidavit of desistance does not automatically extinguish criminal liability. Cyber libel is prosecuted in the name of the People of the Philippines, and the prosecutor or court retains control of the criminal case. A sincere correction or settlement may still affect the evidence of malice, civil damages, or the appropriate penalty, depending on the facts.

What happens after the prosecutor’s resolution

If the complaint is dismissed or an Information is recommended, an aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A further petition for review follows the DOJ’s applicable appeal rules.

If an Information has already been filed in court, a DOJ petition for review does not by itself stop the court proceedings. The party seeking review must also request suspension from the court, and the court retains control of the case.

Defenses involving prescription, venue, defects in the Information, or other grounds for quashal must be assessed before plea because some objections can be waived if not raised at the proper time.

Arrest and bail

A cyber libel complaint ordinarily undergoes preliminary investigation because the prescribed imprisonment reaches eight years. Filing a complaint does not itself authorize arrest.

After an Information is filed, the judge independently evaluates probable cause. The judge may dismiss the case, require further evidence, or issue a warrant. Before conviction, cyber libel is generally bailable as a matter of right because it is not punishable by reclusion perpetua or life imprisonment. The court determines the amount and conditions of bail based on the applicable rules and circumstances.

If you learn of a warrant, do not evade it. Have counsel verify the warrant and case number, coordinate lawful surrender if appropriate, and prepare the bail application.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional written libel:

imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years;
a fine from ₱40,000 to ₱1,500,000; or
both imprisonment and fine.

The Supreme Court confirmed the adjusted fine and held that a court may impose a fine alone instead of imprisonment in People v. Soliman. A fine-only sentence is discretionary, not guaranteed. Civil damages may also be awarded when legally and factually supported.

The civil liability arising from the alleged offense is generally deemed included in the criminal case unless waived, reserved for separate filing, or previously instituted. Article 33 of the Civil Code also recognizes an independent civil action for defamation, subject to procedural and prescriptive rules and the prohibition against double recovery.

Common mistakes

Waiting for months while negotiating, demanding deletion, or pursuing a platform appeal.
Counting the one-year period from the wrong event.
Filing cropped screenshots without URLs, context, authentication, or an original copy.
Failing to prove who controlled an anonymous or shared account.
Choosing venue solely because the post could be opened there.
Naming everyone who liked, shared, or reacted without showing that each authored a new defamatory statement.
Assuming truth, “opinion,” public interest, or an apology is automatically decisive.
Filing an unsworn narrative instead of a compliant affidavit.
Ignoring a subpoena or filing a bare motion to dismiss in place of a counter-affidavit.
Deleting accounts, messages, devices, or source records.
Reposting the accusation while discussing the case.
Treating a settlement or affidavit of desistance as an automatic dismissal.
Assuming the prosecutor’s internal resolution period automatically ends the complaint.

When legal help is urgent

Seek a Philippine lawyer immediately when:

the one-year deadline is approaching;
the post or account is being deleted;
the author is anonymous or platform records are required;
you received a subpoena with a near deadline;
an Information or arrest warrant may already have been issued;
police or investigators want to search, seize, or examine a device;
venue could lie in more than one province or city;
the case involves journalists, election speech, public officials, or confidential sources;
the same facts are being charged under multiple laws;
the publication includes threats, intimate images, impersonation, hacking, doxxing, or violence in addition to defamation; or
the complainant or respondent is a child.

Frequently asked questions

Is one screenshot enough?

Not necessarily. It may show the publication, but authorship, completeness, reliability, discovery date, and context may remain disputed. Preserve the original electronic material and corroborating testimony.

Can I sue an anonymous account?

Yes, but liability cannot be based on a display name alone. Prompt law-enforcement assistance may be necessary to preserve and lawfully obtain subscriber, traffic, or device evidence.

Is cyber libel still subject to a 12- or 15-year deadline?

No. The Supreme Court’s April 8, 2026 en banc ruling states that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents.

Are likes, reactions, comments, and shares criminal?

A person who merely receives and reacts to the original post is not liable for cyber libel under Disini. A user who writes a new defamatory accusation or caption may be treated as the author of that new material.

Does deleting the post end the case?

No. Deletion does not erase an already completed publication, although proof may become more difficult. Preserve evidence before requesting or making changes.

Does an apology or affidavit of desistance dismiss the case?

No. It may affect malice, damages, mitigation, or prosecutorial assessment, but it does not automatically extinguish the State’s criminal case.

Can a public official file cyber libel?

Yes. When the statement concerns official conduct, however, the prosecution must prove actual malice—knowledge of falsity or reckless disregard of truth—beyond reasonable doubt.

Is truth always a defense?

No. Article 361 generally requires both truth and good motives or justifiable ends, and it limits when proof of truth is admissible for certain noncriminal imputations.

Can I be arrested as soon as the complaint is filed?

Ordinarily, no. A prosecutor’s subpoena is not an arrest warrant. A judge may issue a warrant only after an Information is filed and the judge independently finds probable cause. Valid warrantless arrests remain possible only under the narrow situations allowed by the Rules of Criminal Procedure.

Must the parties first undergo barangay conciliation?

Cyber libel’s prescribed imprisonment exceeds the jurisdictional limit for offenses subject to mandatory barangay conciliation. Other personal or territorial circumstances may still require individual review.

Official references

This article provides general legal information, not advice for a particular case. Cyber libel outcomes depend on the exact publication, parties, evidence, dates, and procedural history. Official sources were checked through July 30, 2026.