Quick answer

A Philippine cyber libel case usually begins with a sworn complaint-affidavit filed with the proper city or provincial prosecution office. The prosecutor conducts a preliminary investigation and decides whether the evidence justifies filing an Information in a designated cybercrime Regional Trial Court (RTC). A respondent normally answers through a sworn counter-affidavit; receiving a prosecutor’s subpoena does not by itself mean the respondent has been arrested or found guilty.

Cyber libel is libel under Articles 353 and 355 of the Revised Penal Code committed through a computer system or information and communications technology. The prosecution must establish a defamatory imputation, malice where legally required, publication to another person, identification of the person defamed, use of a computer system, and the respondent’s responsibility as author. Mere receipt, reaction, “Like,” or simple sharing is not treated the same as authoring a defamatory statement, although a new caption or comment that adds another defamatory story may itself be an original publication. Republic Act No. 10175; Disini Jr. v. Secretary of Justice.

Act quickly. The Supreme Court has confirmed that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents—not automatically from the date of posting. Filing the criminal complaint or Information interrupts prescription. Discovery, interruption, venue, authorship, and privilege are often fact-sensitive and must be supported by evidence. Causing v. People, 2023 Decision; 2026 Resolution.

What must be proved

The case should be evaluated element by element. An offensive, unfair, or embarrassing post is not automatically cyber libel.

Issue	What generally must be shown
Defamatory imputation	The statement attributes a crime, vice, defect, act, omission, condition, or circumstance tending to cause dishonor, discredit, or contempt. Context and the statement’s ordinary meaning matter.
Publication	At least one person other than the person defamed received or understood the statement. A group chat or direct message to a third person may satisfy publication even if the communication was not publicly visible.
Identifiability	Readers could identify the offended person from the name, photograph, description, surrounding facts, or context. Naming the person is not always necessary, but hurt feelings alone do not establish identifiability.
Malice	The applicable form of malice must be established. The rules differ for private persons, privileged communications, public officials, and public figures.
Computer system	The publication was made through a device or system covered by the Cybercrime Prevention Act, including computers and smartphones.
Authorship	Reliable evidence links the respondent to the original defamatory statement. A username or screenshot alone may not prove who controlled the account.

The prosecution must eventually prove guilt beyond reasonable doubt at trial. At a DOJ preliminary investigation, the current standard is prima facie evidence with reasonable certainty of conviction: the evidence must be considered admissible, credible, preservable, and capable of proving the elements and the responsible person’s identity. The Supreme Court upheld that DOJ standard in Meking v. Remulla.

Important exceptions and defenses

Private persons and presumed malice

A defamatory imputation is generally presumed malicious unless good intention and justifiable motive are shown or the communication is privileged. The precise rule depends on the complainant, the subject, and how and why the statement was communicated.

Public officials, public figures, and public concerns

When a publication concerns the official conduct of a public officer or a matter involving a public figure or legitimate public interest, the prosecution may have to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false. Criticism of public conduct receives wider constitutional protection.

That protection is not unlimited. Personal attacks unrelated to public duties, fabricated factual accusations, or statements made with proven actual malice may still create liability. The classification of a person as a public figure and the connection between the statement and a public concern are factual and legal questions. See Daquer Jr. v. People.

Privileged communications

Potentially privileged communications include:

A private communication made in the performance of a legal, moral, or social duty, directed only to persons with a corresponding interest;
A fair and true report, made in good faith and without improper comments, of a non-confidential judicial, legislative, or other official proceeding; and
Fair comment on matters of legitimate public interest.

Most of these are qualified, not absolute, privileges. Unnecessary publication, excessive language, lack of good faith, or actual malice may defeat the protection. Posting a complaint, accusation, or court document online is not automatically privileged merely because the same material was submitted to an authority.

Truth is not always enough

Truth should never be treated as an automatic defense. Article 361 generally requires proof both that the imputation was true and that it was published with good motives and for justifiable ends. It also limits when proof of truth may be admitted for non-criminal imputations, subject to special treatment of statements about government employees in relation to their official duties. Articles 353–362 of the Revised Penal Code.

Opinion, satire, and hyperbole

A protected opinion usually does not assert a provably false fact. Calling a statement “opinion,” adding “allegedly,” or framing it as a question is not conclusive if the post still communicates a specific factual accusation. Courts examine the entire statement, its audience, tone, surrounding circumstances, and any implied facts.

Likes, shares, and comments

In Disini, the Supreme Court upheld cyber libel as to the original author but invalidated its application to persons who merely receive and react to a post. It also invalidated aiding or abetting liability under Section 5 as applied to cyber libel.

However, a person who writes a new defamatory caption, adds a separate factual accusation, or creates a new defamatory story may be the original author of that additional statement. Copying an accusation from elsewhere also does not make a person’s own authored publication automatically safe.

The one-year deadline

Cyber libel prescribes in one year from the day the alleged offense is discovered by the offended party, the authorities, or their agents. The Supreme Court’s April 8, 2026 Resolution rejected any automatic presumption that an online post was discovered on the day it was uploaded.

Under Article 91 of the Revised Penal Code:

Filing the complaint or Information interrupts the period;
The period may run again if proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused; and
The period does not run while the offender is absent from the Philippines.

Do not assume that a platform report, demand letter, barangay blotter, police entry, informal agency inquiry, or private negotiation interrupts prescription. File through the legally proper channel well before the deadline. Record the exact discovery date, who discovered the post, how it was found, and any earlier messages showing when the complainant or authorities first knew about it.

Prescription is usually a defense requiring evidence unless it is already clear from the Information. A respondent should preserve proof of earlier discovery, including prior replies, forwarding messages, platform reports, meeting records, or public discussions of the post.

A civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. The applicable civil remedy, reckoning point, and effect of related criminal proceedings should be assessed separately.

How to file a complaint

1. Preserve the publication before requesting removal

Capture the material before it disappears or changes. Preserve:

The complete post, article, video, caption, comments, and surrounding thread;
The full URL and any post, video, or message identifier;
The account’s profile page, username, display name, photographs, and public account details;
The visible date and time, together with the device’s timezone;
A screen recording showing navigation from the profile or page to the post;
Original downloaded files, exports, emails, notifications, and message data;
The device used to access the material; and
Notes identifying when and how the material was first discovered.

Keep an untouched master copy. Do not crop, annotate, re-save, or alter the only copy. Screenshots are useful, but electronic evidence must still be authenticated and shown to be reliable. Rules on Electronic Evidence.

After preservation, a complainant may use the platform’s reporting system or request removal. Takedown is not a prerequisite to filing, and deletion does not necessarily undo an already completed publication.

2. Identify witnesses and the author

Obtain sworn statements from people who:

Saw the publication;
Understood that it referred to the complainant;
Can explain when and where they saw it;
Know facts connecting the respondent to the account or publication; or
Have personal knowledge relevant to falsity, malice, privilege, or damages.

Do not guess who operated an anonymous account. Lawful attribution may require platform records, subscriber information, traffic data, admissions, linked contact details, device examination, or other corroborating evidence.

The NBI Cybercrime Division or another authorized cybercrime law-enforcement unit may assist with investigation and preservation. The NBI publishes an official procedure for investigative assistance to victims of computer crimes and an online complaint page. An investigative report is not necessarily a substitute for timely filing with the proper prosecution office.

Prompt investigation matters because Republic Act No. 10175 sets preservation periods for certain service-provider data and authorizes law-enforcement preservation orders. Disclosure of protected computer data generally requires the legal process and court authorization specified by law. Private parties should not hack an account, impersonate another person, unlawfully intercept communications, or obtain data by coercion.

3. Determine the proper venue

The criminal action belongs in a designated cybercrime court of the city or province:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The court where the action is first properly filed acquires jurisdiction to the exclusion of the others. The complaint-affidavit should therefore state concrete venue facts, not merely select the most convenient place. See Tieng v. Judge Palacio-Alaras.

The usual initial filing is with the city or provincial prosecution office whose territorial jurisdiction corresponds to the proper court venue. Cases involving foreign accounts, acts abroad, several possible locations, or a Filipino respondent abroad require particular care under Section 21 of Republic Act No. 10175.

4. Prepare a complete sworn complaint-affidavit

The affidavit should clearly state:

The complainant’s and respondent’s names and addresses, if known;
The exact defamatory words, with a faithful translation where necessary;
The complete context—not only an isolated sentence;
The platform, URL, account, posting date, and discovery date;
How the publication used a computer system;
Who received or saw it;
How those readers identified the complainant;
Why the statement is defamatory and materially false, if falsity is asserted;
The evidence connecting the respondent to authorship;
Facts supporting malice or actual malice, where required;
The basis for venue;
Any related communications, demands, admissions, corrections, or removal; and
The supporting documents and witness affidavits.

Under the 2024 DOJ-NPS Rules, regular preliminary investigation is initiated with the original complaint-affidavit, two duplicate official-file copies, and one copy for each respondent, accompanied by the NPS Investigation Data Form and the supporting evidence. Check the receiving office’s current administrative checklist before filing. The DOJ also maintains an official filing checklist.

5. Participate in the preliminary investigation

The head of the prosecution office first checks the complaint’s form and evidentiary completeness. Once docketed and assigned, the investigating prosecutor may recommend outright dismissal or issue subpoenas.

The prosecutor may consider the case submitted after receiving the counter-affidavit or may schedule a physical or virtual clarificatory hearing. A reply-affidavit and rejoinder-affidavit are allowed only when the prosecutor finds them necessary. The prosecutor may also require parties, witnesses, or third persons to produce material records or sworn statements.

A favorable prosecutor’s resolution is not a conviction. If approved, an Information is filed in the designated RTC, where a judge independently determines whether there is probable cause to issue a warrant of arrest.

How to defend a complaint

1. Treat the subpoena as urgent

Record the exact date and manner of receipt. Obtain the complaint-affidavit and every attachment. The subpoena should set the counter-affidavit hearing at least 10 days after receipt of the subpoena and complaint. Under the regular preliminary-investigation procedure, the hearing is ordinarily scheduled within 30 calendar days from the investigating prosecutor’s receipt of the complete record.

The counter-affidavit is due on the date stated in the subpoena. Extensions are allowed only when the interests of justice require them and may not exceed 10 days. Do not rely on receiving an extension.

A respondent’s personal appearance may be dispensed with if the counter-affidavit was properly sworn before a prosecutor, authorized government official, or, when those officers are unavailable, a notary public. Follow the subpoena and local office instructions exactly.

2. Preserve your own evidence

Do not delete the account, post, drafts, messages, source materials, or device after learning of the complaint. Preserve:

The complete original publication and its context;
Drafts and revision history;
Sources relied upon before publication;
Research notes and verification efforts;
Messages showing who operated the account;
Account-security and login records;
Evidence of hacking or impersonation, if genuinely claimed;
Communications showing the complainant’s earlier discovery;
Witnesses who can address authorship, context, truth, motive, or privilege; and
Corrections, requests for comment, responses, or good-faith efforts made before publication.

Stop discussing the complainant or the pending case online. Retaliatory posts can create new evidence or separate legal problems.

3. Answer every element under oath

A counter-affidavit should identify the precise evidentiary or legal defect, such as:

The respondent did not author or control the publication;
The screenshot or account attribution is unreliable or altered;
No third person received the statement;
The complainant was not reasonably identifiable;
The words are not defamatory when read in context;
The communication was privileged;
The prosecution cannot establish the legally required malice;
The statement concerned public conduct and actual malice cannot be shown;
Truth, good motive, and justifiable purpose are established where Article 361 permits the defense;
The complaint was filed after prescription;
Venue is unsupported; or
The electronic evidence cannot be authenticated or preserved for trial.

A bare denial is rarely enough. Attach admissible records and witness affidavits. Under the current DOJ rules, a motion to dismiss filed instead of a counter-affidavit is generally not allowed unless it is verified and contains the respondent’s defenses; it will then be treated as the counter-affidavit.

If the respondent ignores a duly received subpoena without justification, the prosecutor may resolve the case on the existing record.

4. Act promptly after the resolution

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. A petition for review may also be available under DOJ rules, but its destination, contents, and interaction with an already filed court case are technical. A DOJ appeal does not automatically halt court proceedings; the current rules require an appropriate motion to suspend proceedings when applicable. DOJ Department Circular No. 015, series of 2024.

If an Information has been filed, counsel should immediately verify:

The assigned RTC and case number;
Whether the court issued a warrant or another order;
Bail arrangements;
Arraignment and motion deadlines;
Whether any ground for a motion to quash exists; and
How to preserve objections while any DOJ review is pending.

Cyber libel is bailable as a matter of right before conviction, but bail does not dismiss the charge. Do not ignore a court notice or assume that a prosecutor-level appeal cancels an arraignment.

Possible penalties and civil liability

The prescribed imprisonment for cyber libel is four years, two months, and one day to eight years. The Supreme Court has also fixed the alternative cyber-libel fine at ₱40,000 to ₱1,500,000. Depending on the circumstances, a court may impose imprisonment, a fine, or both, in addition to civil liability. People v. Soliman.

Supreme Court Administrative Circular No. 08-2008 recognizes a preference for a fine rather than imprisonment in appropriate libel cases, but it does not remove imprisonment from the law. Sentencing remains within judicial discretion and depends on the proven circumstances.

The civil action arising from the alleged offense is ordinarily deemed instituted with the criminal action unless it was waived, reserved, or previously filed under Rule 111. Separate civil remedies may also involve different legal bases and consequences. A takedown, apology, settlement, or affidavit of desistance does not automatically terminate a criminal prosecution, which is brought in the name of the People of the Philippines.

Evidence worth preserving

For either side, preserve:

Complete, uncropped screenshots and screen recordings;
URLs, post IDs, account IDs, timestamps, and timezone information;
Original downloads, exports, emails, and notification files;
The device on which the material was created or received;
Backups stored without altering the originals;
Witness statements based on personal knowledge;
Evidence identifying the account operator;
The complainant’s exact discovery timeline;
Sources used to verify or disprove the allegation;
Proof of requests for comment, corrections, or good-faith investigation;
Proof of readership, forwarding, and identifiability; and
Documents supporting actual financial loss or other claimed civil damages.

Electronic printouts are not automatically self-authenticating. The party offering them must be able to show their integrity and reliability through a competent witness, authentic records, security procedures, or other legally accepted proof.

Common mistakes

Waiting because the post is “still online,” despite the one-year prescriptive period;
Treating a platform report or demand letter as if it filed the criminal case;
Filing in a convenient city without evidence supporting venue;
Submitting cropped screenshots without the URL, profile, context, or discovery details;
Naming a respondent solely because a fake account used that person’s photograph;
Assuming truth, “opinion,” “for awareness only,” or “allegedly” is a complete defense;
Confusing a simple Like or Share with a newly authored defamatory accusation;
Deleting evidence before making a forensic or reliable copy;
Publicly threatening, insulting, or doxxing the other party;
Ignoring a subpoena or answering with an unsworn letter;
Filing only a motion to dismiss instead of a proper counter-affidavit;
Missing the 15-day reconsideration period; and
Assuming an apology, desistance, or private settlement automatically ends the public prosecution.

When legal help is urgent

Seek a Philippine criminal lawyer immediately when:

The one-year period is close to expiring;
The post, account, or platform data may disappear;
The author is anonymous or located abroad;
You received a prosecutor’s subpoena, especially with a counter-affidavit date approaching;
An Information, arrest warrant, or arraignment notice has been issued;
The matter concerns a public official, journalist, media organization, company, or high-reach account;
There are several possible venues;
Private messages, hacked accounts, or disputed electronic evidence are involved; or
The conduct also involves threats, extortion, stalking, intimate images, sexual harassment, identity theft, or danger to a child.

Those facts may trigger laws and protective remedies beyond cyber libel. Eligible indigent parties may also inquire with the Public Attorney’s Office.

Frequently asked questions

Is a screenshot enough to win a case?

Usually not by itself. It must reliably show the statement and context, and the proponent must authenticate it and connect the publication to the respondent. Publication, identifiability, malice, venue, and the other elements still require evidence.

Does the one-year period always start on the posting date?

No. It starts upon discovery by the offended party, the authorities, or their agents. Publication and discovery may occur on the same day, but the law does not automatically presume that they did.

Can an anonymous account be charged?

A complaint may prompt investigation, but a criminal case ultimately requires reliable identification of the responsible person. Do not accuse someone based only on suspicion, a profile photograph, or an unverified username.

Can I be charged merely for sharing or liking a post?

Under Disini, persons who simply receive and react to a post are not criminally liable for cyber libel on that basis. A new caption, comment, or repost that authors an additional defamatory accusation may be treated differently.

Must the complainant send a demand letter first?

No. A prior demand, request for correction, or takedown notice is not an element or filing prerequisite. It may nevertheless become relevant to discovery, malice, mitigation, damages, or settlement.

Does deleting or apologizing for the post end the case?

No. Deletion does not erase an already completed publication, and an apology or affidavit of desistance does not automatically dismiss a public criminal action. These steps may still affect evidence, damages, motive, or the parties’ practical resolution.

Can the same online statement be charged as both ordinary libel and cyber libel?

The same publication cannot be punished twice as ordinary libel and cyber libel. The Supreme Court held that they are the same offense for double-jeopardy purposes when based on the identical publication.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Results depend on the exact words, context, parties, dates, documents, electronic evidence, and procedural history. Law and official procedures were checked through August 4, 2026.