A comprehensive legal-practical guide (Philippine context)

Big picture

Threatening to post someone’s private or intimate photos online (“sextortion,” “exposure threats,” “revenge porn”) can violate multiple Philippine laws at once. The exact mix depends on who is involved (e.g., intimate partner, minor, co-worker), how the images were obtained, what the threat demands (money, sexual favors, silence), and where/how the threat is made (DMs, email, messaging apps, social platforms).

Key statutes commonly invoked:

Revised Penal Code (RPC): Grave threats, light threats, grave coercion, unjust vexation, libel, acts of lasciviousness, and related offenses.
Cybercrime Prevention Act (RA 10175): “Qualifies” offenses committed through ICT (online/phone/apps), generally increasing penalties and enabling cybercrime court jurisdiction and specialized investigation.
Anti-Photo and Video Voyeurism Act (RA 9995): Criminalizes taking, copying, and especially publishing/distributing private sexual images without consent—even if the subject earlier consented to the recording.
Safe Spaces Act (RA 11313): Penalizes gender-based online sexual harassment, including threats to publish intimate content and non-consensual sharing.
Anti-Violence Against Women and Their Children Act (RA 9262): If the parties have (or had) an intimate or dating relationship or share a child, threats to expose intimate images can be psychological violence with serious penalties and protection orders.
Data Privacy Act (RA 10173): When a person, firm, or employee misuses personal data (e.g., internal records, device repair images) and threatens disclosure without lawful basis.
Anti-Child Pornography Act (RA 9775) & Anti-OSAEC Law (RA 11930): If the subject is a minor, possession, production, distribution, or even threatened exploitation triggers child-protection offenses (strict, consent immaterial).
Access Devices Regulation Act (RA 8484): When the extortion includes stealing/abusing OTPs, passwords, or accounts to obtain images or payments.

Bottom line: A single exposure threat can simultaneously be (a) a stand-alone crime (threats/coercion), (b) an ICT-qualified crime (cybercrime), and (c) a content-specific offense (voyeurism/GB-OSH/VAWC/child protection), plus civil liability.

How prosecutors legally characterize the conduct

1) Threats & extortion (RPC)

Grave threats (Art. 282): Threatening another with a wrong amounting to a crime (e.g., to publish intimate images in violation of RA 9995) with or without a condition.
Light threats (Art. 283): Threatening a wrong not amounting to a crime with a condition (e.g., reputation harm).
Grave coercion (Art. 286): Forcing someone, by violence/intimidation, to do something against their will (e.g., pay, send more images, perform sexual acts) without legal authority.

If the threat is: “Pay/send nudes/meet me or I’ll post your photos,” prosecutors often charge grave threats and/or grave coercion. When money is demanded, some cases layer robbery/extortion-type theories depending on facts.

2) Cybercrime qualification (RA 10175)

When the threat or the underlying act is done through ICT (social media, messaging apps, email), the crime is ICT-qualified, which generally increases the penalty and places the case within specialized cybercrime courts’ jurisdiction; it also unlocks digital search, preservation, and disclosure tools.

3) Voyeurism / non-consensual sharing (RA 9995)

Criminalizes recording of sexual acts/exposed private parts without consent, copying, and crucially publishing/distributing such material without consent.
Consent to record ≠ consent to share; sharing still needs separate consent.
Threats to publish are powerful evidence of intent; the actual upload completes a separate offense. Attempt and conspiracy may be charged when acts are overt but incomplete.
Penalties heighten if the offender is an ex-partner, employee, or exploits authority.

4) Gender-Based Online Sexual Harassment (RA 11313)

Covers online conduct that causes physical/psychological/sexual harm or fear—threats to expose intimate content, sending unwanted sexual content, doxxing, impersonation to solicit sexual images, etc.
Provides criminal, administrative, and civil tracks; mandates employer/school policies and remedies.

5) Violence Against Women and Their Children (RA 9262)

If the victim is a woman (or her child) and the offender is a current/former spouse, partner, dating partner, or shares a child with her, then threatening to post intimate images is psychological violence—punishable separately.
Victims can seek Barangay/TPO/PPO (Protection Orders) with “no contact,” stay-away, device/account surrender, and other tailored conditions—often same- or next-day relief.

6) Children and minors (RA 9775 & RA 11930)

If the subject is under 18 (or appears child-like), possession/production/distribution of sexual images is categorically illegal.
Consent is immaterial; even mere threats to use an image to extract money/sex can be prosecuted alongside child-exploitation offenses.
Expect asset freezing, platform takedowns, and heavy sentencing ranges.

7) Data privacy misuse (RA 10173)

An employee/technician/agent who accesses your files and threatens to leak them can face unlawful processing, unauthorized disclosure, and malicious processing liabilities, in addition to threats/coercion.
Enables administrative fines and civil damages; the NPC can order cease-and-desist and coordinate with law enforcement.

Elements you (and counsel) will focus on

Threat (content + context): explicit or implied statement indicating disclosure of private images will occur if a condition isn’t met.
Medium: screenshots/exports of chats, emails, calls; headers/metadata help establish ICT use (for RA 10175).
Nature of images: private/intimate; whether consent to record existed (irrelevant for sharing under RA 9995), whether the subject is a minor (triggers child laws).
Demand/condition: money, sexual favors, silence, or compliance.
Intent: patterns of follow-up messages, countdowns, lists of target recipients, prepared cloud folders/links.
Relationship: intimate partner/ex-partner (RA 9262), workplace/school (RA 11313), caregiver/relative (aggravations; possible child laws).
Harm: anxiety, insomnia, lost work, medical/psych consults, concrete disruptions—relevant for damages and VAWC.

Criminal, civil, and administrative tracks (you can use several at once)

A) Criminal complaints

Where: NBI-Cybercrime Division or PNP Anti-Cybercrime Group, Women and Children Protection Desks (WCPD) for VAWC/child matters; filing may proceed to the City/Provincial Prosecutor for preliminary investigation.
What to attach: device forensic copies (if possible), original screenshots/exports with timestamps/URLs, call logs, payment records, cloud share links, witness affidavits, medical/psych reports, and chain-of-custody notes.

B) Civil actions

Damages under Civil Code Arts. 19/20/21 (abuse of rights, tort), plus moral/exemplary damages, attorney’s fees; injunctions (to stop threatened publication) and writs for content takedown/preservation.
Separate civil liability is also recognized under RA 9995 and 10173.

C) Administrative/regulatory relief

NPC complaints for privacy violations (cease-and-desist, fines, orders to delete or secure data).
Workplace/school channels mandated by RA 11313; employers/schools must implement procedures and can discipline offenders.

D) Protection orders (VAWC)

If applicable, seek Barangay Protection Order (BPO), Temporary Protection Order (TPO) (typically ex parte), then Permanent Protection Order (PPO). Conditions can include no-contact, device/account surrender, stay-away, and payment of costs.

Evidence playbook (do this immediately)

Stop engaging; do not pay and do not send new images (“sunk cost” traps escalate demands).
Preserve everything: full-conversation exports (not cropped), message headers, voice/video messages, call logs, link previews, and original files. Keep hashes (SHA-256) where you can; never “re-save” via apps that strip metadata.
Document the images’ origin: whether they were shared consensually, stolen from a device, or fabricated (“morphed/AI-generated”).
Secure accounts/devices: change passwords, enable 2FA, revoke logins, rotate recovery emails/phone numbers.
Platform actions: report accounts, request preservation (so data isn’t auto-deleted), and use trusted flagger channels if available.
Medical/psych consult: if anxious or distressed, seek help; records support psychological harm claims and VAWC cases.
Name control: set up alerts for your name/handles; capture any actual postings quickly (URLs, hashes, live-web copies).

Defenses you’ll hear—and why they often fail

“You consented to the recording.” Sharing/distribution still requires separate consent (RA 9995).
“It’s a joke / no intent.” Repeated countdowns, doxxing, tags, prepared folders, or any conditional demand contradict that.
“She’s my partner/ex.” Relationship aggravates responsibility (RA 9262/RA 11313), it does not excuse it.
“She’s 17 but agreed.” Consent of a minor is legally irrelevant in child-exploitation statutes.
“It’s just words; nothing was posted.” Threats/coercion are punishable even without actual posting; if posting occurs, that is another crime.

Special contexts

Minors

Treat as a child-exploitation matter first. Prioritize child protection protocols, WCPD, and social workers. Expect swift preservation orders and platform escalations.

Workplace/school

GB-OSH (RA 11313) requires policies, investigators, sanctions; escalate internally and criminally. Employer/school inaction can trigger administrative liability.

Data custodians (repair shops, HR, telcos, cloud services)

Using customer/employee data to threaten exposure is a privacy offense and often computer-related (RA 10175). Seek NPC relief in parallel to criminal action.

Remedies you can realistically expect

Immediate: Account takedowns and link blocking; TPO/BPO with no-contact and stay-away clauses (if VAWC fits); platform preservation of logs.
Short-term: Inquest if arrestable; subpoenas for subscriber information, IP logs; freezing of wallets/accounts when AML red flags are present.
Medium-term: Filing of Informations in cybercrime courts; injunctions against further sharing; damages and costs awards in civil cases.

Quick decision tree

Is the subject a minor? → Prioritize RA 9775/RA 11930 + cybercrime, WCPD, child protocols.
Is/was there an intimate relationship? → Add RA 9262 + Protection Orders.
Is the conduct online/app-based? → RA 10175 qualification applies.
Were images recorded/shared without sharing consent? → RA 9995.
Is there a sexualized pattern or public harassment? → RA 11313.
Is a company/employee misusing your data? → RA 10173 (+ criminal overlays).
Any demand/condition? → Grave threats / grave coercion.

Practical filing package (what to bring)

Affidavit-Complaint narrating facts in chronology, with relationship context and demands quoted verbatim.
Annexes: device-level exports (PDF/HTML), screenshots (uncropped), filenames and hashes, URLs, platform reports, any posted copies captured, receipts of payments (if any), medical/psych notes, and ID documents.
Relief requests: data preservation, takedown, no-contact orders, protection orders (if VAWC), hold-departure (when warranted), and non-disclosure of victim identity in pleadings.

Civil damages & privacy remedies (snapshot)

Moral and exemplary damages for mental anguish and bad faith.
Actual damages (lost wages, therapy, devices/services bought to mitigate harm).
Attorney’s fees.
Injunctions (temporary/permanent) to stop dissemination and compel deletion.
Privacy fines and orders via NPC (Data Privacy Act).

Final takeaways

A threat to post private photos online is not just one crime—it’s often several, with higher penalties when done through ICT, against women by partners, or involving minors.
You can and should layer remedies: criminal (threats/coercion + voyeurism/GB-OSH/VAWC/child laws + cybercrime), civil (damages/injunction), and administrative (privacy enforcement, school/workplace sanctions).
Preserve evidence now, seek immediate protective relief where eligible, and file in parallel with cybercrime authorities and regulators. Early, thorough action meaningfully increases the odds of swift takedown, prosecution, and recovery.

This guide is for general information only and not legal advice. For a specific incident, consult Philippine counsel or approach NBI-CCD/PNP-ACG/WCPD for urgent assistance.