Quick answer

To file a cyber libel case in the Philippines, preserve the online material and proof of authorship, act within the one-year prescriptive period, and submit a sworn complaint-affidavit with supporting evidence to the prosecutor’s office that has territorial jurisdiction. Police or NBI cybercrime investigators can assist when the author is unknown or technical records must be preserved or obtained.

To defend a case, do not ignore a subpoena. Obtain the complete complaint and attachments, preserve your own records, and submit a sworn counter-affidavit addressing every legal element and the evidence identifying you as the author. A respondent generally must receive at least 10 days from receipt of the subpoena and complaint to submit a counter-affidavit.

Cyber libel is not established merely because a post is insulting or damaging. The prosecution must prove a defamatory imputation, publication to someone other than the person defamed, the identity of the person defamed, malice, use of a computer system, and the accused’s identity as the author or responsible publisher. Defenses involving privilege, public-interest commentary, truth, authorship, prescription, venue, or lack of malice depend heavily on the exact words, context, documents, and witnesses.

What Philippine law treats as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s libel provisions when the defamatory material is published through a computer system or similar technology. This can include material posted through social media, websites, blogs, online forums, email, or messaging platforms when the other elements are present.

Under Article 353 of the Revised Penal Code, libel involves a public and malicious imputation of:

A crime;
A vice or defect, whether real or imaginary;
An act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt; or
Matter that blackens the memory of a deceased person.

The Supreme Court has explained that cyber libel is essentially the existing offense of libel committed through information and communications technology. The principal controlling decisions include Disini v. Secretary of Justice and Causing v. People.

The prosecution must prove the essential elements

A cyber libel charge ordinarily requires proof of:

A defamatory imputation. The words, images, captions, or other material must impute a discreditable act or condition. Courts read the material as a whole and according to how an ordinary reader would understand it. Mere rudeness, abuse, exaggeration, or an unpopular opinion is not automatically libel.
Publication. At least one person other than the person defamed must have received, viewed, or understood the material. A message communicated only to the person complained about generally lacks the publication required for libel, although it could implicate another law.
Identification of the person defamed. The person need not always be named. It is enough if people who know the circumstances can reasonably identify the person referred to. A vague statement about a large, undefined group may present a different issue.
Malice. Article 354 generally presumes malice from a defamatory publication, subject to statutory privileges and constitutional protections. In cases involving the official conduct of public officers, public figures, or matters of legitimate public concern, the prosecution may have to prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false.
Publication through a computer system or similar technology.
Identity of the accused as the responsible author or publisher. A profile name or photograph alone may not conclusively establish who controlled an account or wrote a particular post.

Every element and the accused’s identity must ultimately be proved beyond reasonable doubt at trial.

Not every like, share, or comment creates liability

In Disini, the Supreme Court upheld the cyber libel provision only as applied to the author of the defamatory statement or article. It struck down the application of the Cybercrime Prevention Act’s general provisions on aiding, abetting, and attempt to online libel.

Accordingly, merely pressing “like” or using a platform’s ordinary share or reaction function is not automatically cyber libel. However, a person who adds a new defamatory caption or comment may become the author of that separate statement. Copying and publishing material as one’s own post can also present issues different from a passive reaction. Liability therefore depends on what the person actually wrote, published, or caused to be published.

The one-year filing deadline is critical

The Supreme Court has confirmed that cyber libel prescribes in one year, not 12 or 15 years. Under Article 91 of the Revised Penal Code, the period runs from the day the alleged cyber libel is discovered by the offended party, the authorities, or their agents. The Supreme Court reaffirmed this rule in its April 8, 2026 resolution in Causing v. People.

Publication and discovery may occur on the same day, but they are not legally presumed to coincide merely because a public post was accessible online. The actual discovery date can become a disputed question of fact. A complainant should preserve credible proof of when and how the material was first discovered, such as the original message forwarding the post, contemporaneous emails, incident reports, or witness affidavits.

Filing the complaint or information interrupts the running of prescription. The period may resume if the proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.

Do not assume that a demand letter, private negotiation, platform report, barangay visit, or informal police inquiry interrupts prescription. File the proper complaint promptly. A last-minute filing also leaves little time to correct venue or evidentiary defects.

How to preserve useful digital evidence

Screenshots are helpful, but a screenshot by itself may not prove when the post appeared, who authored it, or whether it accurately represents the original content.

Before reporting, preserve as much of the following as lawfully available:

Full-page screenshots showing the post, account name, date, time, comments, reactions, and surrounding context;
The complete URL or permanent link, account URL, username, profile identifier, group name, and platform;
Screen recordings showing how the post or message is reached from the account or conversation;
The original email, message, chat export, attachment, image, video, or audio file;
Available metadata and unedited original files;
The device on which the material was received or viewed;
Names and contact details of people who personally saw the post;
Messages or notifications through which the post was first discovered;
Earlier or later posts that help establish context or authorship;
Proof showing why an unnamed person was identifiable;
Proof of resulting harm, such as lost contracts, employment records, customer communications, or medical records, if damages will be claimed; and
For a respondent, account-login alerts, device records, travel or work records, evidence of hacking, shared access, impersonation reports, and requests to the platform concerning a fake account.

Keep an untouched copy. Do not crop away important context, annotate the only copy, alter timestamps, recreate a message, or ask a witness to describe something the witness did not personally see. Record who collected each item, when it was collected, and from which device or account.

Electronic evidence must still be authenticated and connected to the alleged author. Under the Supreme Court’s Rules on Electronic Evidence, authenticity may be established through technical proof or other evidence showing integrity and reliability.

Proving who controlled the account

In XXX v. People, G.R. No. 274842, the Supreme Court identified non-exclusive ways to prove account access and authorship, including:

An admission of ownership, access, or authorship;
A witness seeing the person use the account or compose the communication;
Information in the post known only to the person or a small group;
Distinctive language, style, or identifying characteristics;
Platform, telecommunications, ISP, geolocation, device, search-history, or forensic records;
Conduct consistent with the post or message; and
Other direct or circumstantial evidence linking the person to the account or content.

Technical records are useful but are not indispensable in every case. Conversely, displaying someone’s name and photograph does not by itself rule out impersonation or unauthorized use.

Steps for filing a cyber libel complaint

1. Record the discovery and publication facts

Prepare a clear chronology covering:

The exact allegedly defamatory words or images;
When and where they were posted;
When and how they were first discovered;
Who first saw them;
Why the words referred to the complainant;
What account published them;
The evidence connecting that account and post to the respondent; and
What occurred before and after publication.

Quote the relevant material accurately and attach the complete version. Do not paraphrase a post in a way that changes its meaning.

2. Assess the legal elements before filing

Ask whether the material states or implies a damaging fact, or instead expresses opinion, criticism, satire, or rhetorical exaggeration. Identify whether it concerns:

A private person and private dispute;
A public officer’s official conduct;
A public figure;
A judicial, legislative, administrative, or other official proceeding;
A fair report or complaint to a proper authority; or
Another matter of legitimate public interest.

These distinctions affect malice and privilege. They should be addressed in the complaint rather than concealed.

3. Obtain technical assistance when necessary

If the account is anonymous, fake, hacked, or disputed, report promptly to an appropriate cybercrime law-enforcement unit, such as the NBI Cybercrime Division or PNP Anti-Cybercrime Group. The DOJ Office of Cybercrime provides official information and agency referral details.

Private individuals cannot compel a platform, internet provider, or telecommunications company to disclose protected subscriber and traffic data merely by sending a demand. Law-enforcement officers may seek preservation, disclosure, search, seizure, or examination through the procedures authorized by Republic Act No. 10175 and the Supreme Court’s Rule on Cybercrime Warrants. Early reporting matters because provider records may not be retained indefinitely.

4. Select the proper territorial office

Cybercrime prosecutions are handled by designated Regional Trial Courts. Under the Rule on Cybercrime Warrants, a criminal action under Sections 4 or 5 of Republic Act No. 10175 may be filed in the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used is situated; or
Where any damage to a natural or juridical person took place.

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of the others. The prosecutor’s territorial jurisdiction should correspond to a proper court. Because an online post may have connections with several places, venue should be reviewed before filing rather than based only on where a screenshot was taken.

5. Prepare and file the complaint-affidavit

Under DOJ Department Circular No. 015, series of 2024, a regular preliminary investigation begins with:

The original complaint-affidavit;
Two duplicate copies for the official file;
An additional copy for every respondent;
A completed NPS Investigation Data Form;
Affidavits of witnesses; and
Documentary, electronic, and other evidence supporting every element and the respondent’s identity.

The complaint-affidavit should state the parties’ names and addresses, the date and place of the alleged offense, and a complete factual account of how it occurred. It must be sworn before a prosecutor or another government official authorized to administer oaths, or, when they are unavailable, before a notary public.

Local offices may have administrative checklists or intake arrangements in addition to the circular. Confirm these directly with the relevant city, provincial, or regional prosecutor’s office. The DOJ lists its current rules and services on its official issuances page and preliminary-investigation filing page.

6. Participate in the preliminary investigation

The prosecutor applies the standard of prima facie evidence with reasonable certainty of conviction. The available evidence must be credible, admissible, capable of preservation and presentation at trial, and sufficient—if left uncontroverted—to establish the elements and the accused’s identity.

If the complaint proceeds, the respondent receives a subpoena with the complaint and attachments. The hearing and deadline for the counter-affidavit must be at least 10 days from the respondent’s receipt of those documents.

The prosecutor may:

Consider the case submitted after the counter-affidavit;
Hold a physical or virtual clarificatory hearing;
Require a reply-affidavit and rejoinder-affidavit;
Require relevant witnesses or documents through subpoena; or
Dismiss the complaint if the evidentiary standard is not met.

A criminal case is formally commenced in court only if the prosecutor approves and files an Information.

How to respond if you are accused

Do not ignore the subpoena

Record the exact date of receipt and obtain a complete copy of every attachment. Failure to appear or file a counter-affidavit despite proper service can result in the case being resolved on the complainant’s evidence.

The ordinary submission period must be at least 10 days. Extensions are not automatic. Under the 2024 DOJ-NPS Rules, an extension may be allowed when the interests of justice require time to obtain counsel, examine voluminous records, or study a novel, complicated, or technical issue. An allowed extension may not exceed 10 days.

Preserve your account and device records

Do not fabricate, backdate, or secretly alter evidence. Preserve the original state of relevant accounts and devices before deleting or editing anything. Save:

Login histories and security alerts;
Evidence of compromised passwords or unauthorized access;
Device possession and location records;
Account-management and administrator lists;
Platform reports concerning impersonation;
The full conversation or thread;
Sources relied upon for factual statements;
Drafts, notes, interviews, official records, and fact-checking materials; and
Communications showing the intended audience and purpose.

Do not surrender passwords or devices to the complainant. If law enforcement requests access, consult counsel about consent, the scope of any warrant, and preservation obligations.

Answer every material allegation under oath

A useful counter-affidavit should separately address:

The exact statement charged;
Whether it is defamatory when read in full context;
Whether a third person received it;
Whether the complainant was identifiable;
Whether the respondent authored or controlled the post;
Whether the exhibit is authentic and complete;
Whether the communication was privileged;
Whether the matter involved public conduct or public concern;
The factual basis for the statement;
Good faith, verification, and the absence of actual malice;
Prescription;
Venue and jurisdiction; and
Any material discrepancy between the complaint and its exhibits.

A motion to dismiss generally cannot be used merely to avoid filing a counter-affidavit. A verified motion containing the respondent’s defenses may be treated as the counter-affidavit.

Be careful with apologies and public replies

A correction, retraction, or apology may reduce harm and can matter when a court considers damages or penalty. It does not automatically extinguish criminal liability. Its wording may also be offered as evidence.

Do not retaliate, pressure witnesses, threaten the complainant, or start a second online argument. If a response is necessary, have counsel review it for accuracy and tone.

Important defenses and exceptions

No defamatory factual imputation

Courts consider the ordinary meaning and complete context. A statement may be non-actionable when it is plainly opinion, satire, rhetorical hyperbole, or criticism that does not assert or imply a provably damaging fact. Labeling a factual accusation as “opinion” does not necessarily protect it.

No publication to a third person

A communication seen only by the complainant ordinarily does not satisfy the publication element of libel. Publication may be established, however, when another person reads a post, group message, forwarded email, or public comment.

The complainant was not identifiable

The statement must refer to the complainant. Identification can be proved without a name when readers familiar with the circumstances understood who was meant. The defense is stronger where the reference is genuinely indeterminate and no witness can reliably connect it to the complainant.

The accused was not the author

The prosecution must prove who authored or controlled the post, not simply who appears in the profile name or photograph. Evidence of impersonation, hacking, several account administrators, shared devices, or absence of access can be material. A bare denial may be insufficient if admissions, distinctive content, account history, witnesses, or technical records point to the accused.

Privileged communication

Article 354 recognizes qualified privileges, including:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of qualifying official proceedings or acts.

Other absolute or constitutional privileges may apply in particular legislative, judicial, or official settings. Qualified privilege can be defeated by proof of actual malice. Unnecessary online publication to the general public may fall outside the purpose and audience of a claimed private-duty communication.

Public officers, public figures, and public concern

Criticism of a public officer’s official conduct receives stronger constitutional protection. The prosecution must prove actual malice where the governing public-official or public-concern standard applies.

Actual malice means that the accused knew the statement was false or acted with reckless disregard of whether it was false. Mere error, inaccuracy, or ordinary negligence is not automatically reckless disregard. In July 2026, the Supreme Court acquitted an accused because actual malice was not proved beyond reasonable doubt in a case involving accusations about a mayor’s official functions. The official decision is available in Tan v. People, G.R. No. 265929.

This protection is not a license to knowingly invent crimes or repeat accusations while consciously doubting their truth.

Truth, good motives, and justifiable ends

Truth is not an automatic complete defense in every Philippine libel case. Article 361 regulates when proof of truth is admissible and provides for acquittal when the matter is true and publication was made with good motives and for justifiable ends. The application depends on the nature of the imputation and the person concerned.

Preserve the reliable sources available at the time of publication. Evidence discovered only after publication may prove truth, but it may not necessarily establish the publisher’s original good faith or lack of actual malice.

Fair comment based on established facts

An opinion or conclusion about a public matter may be protected when based on established or accurately disclosed facts and reasonably inferable from them. A comment based on invented facts or a materially false factual premise is less likely to qualify.

Prescription

Cyber libel prescribes one year from discovery by the offended party, authorities, or their agents. Prescription is often fact-dependent. A respondent asserting it should present evidence of the actual discovery date rather than relying only on the original posting date.

Conduct before the law took effect

An online post made before the Cybercrime Prevention Act became effective cannot be punished retroactively as cyber libel. A genuinely new publication after effectivity presents a separate factual and legal question.

Duplicate charges for the same publication

The State may not obtain separate convictions for ordinary libel and cyber libel based on the identical defamatory publication merely because the same conduct is described under both the Revised Penal Code and Republic Act No. 10175. Disini recognized the double-jeopardy problem because the provisions concern the same underlying offense.

Possible penalties and civil liability

Article 355, as amended by Republic Act No. 10951, provides imprisonment, a fine of ₱40,000 to ₱1,200,000, or both for ordinary written libel. Section 6 of Republic Act No. 10175 generally raises the imprisonment penalty by one degree when the offense is committed through information and communications technology.

Imprisonment is therefore legally possible in a cyber libel conviction. A fine-only sentence is also legally possible, but it is not an entitlement. In People v. Soliman, the Supreme Court upheld the court’s authority to impose only a fine for online libel. Courts consider the law, Supreme Court guidelines favoring fines in appropriate libel cases, and the specific circumstances.

A claim for civil damages may accompany the criminal case. An offended party may also have an independent civil action for defamation under Article 33 of the Civil Code, subject to rules on venue, reservation, consolidation, prescription, and double recovery. Settlement or forgiveness may resolve the civil aspect but does not automatically terminate the public criminal case, which is prosecuted in the name of the People of the Philippines.

After the prosecutor issues a resolution

Either party may file a motion for reconsideration of a regular preliminary-investigation resolution within 15 days from receipt under DOJ Department Circular No. 015. A further petition for review or appeal may be available under the applicable DOJ rules.

If an Information has already been filed in court, a DOJ petition for review does not by itself suspend the court proceedings. The proper motion to suspend must be filed with the court.

Once the Information reaches the designated Regional Trial Court, the judge independently evaluates probable cause. The court may dismiss the case, require additional evidence, issue a summons when legally appropriate, or issue a warrant of arrest. Cyber libel is ordinarily bailable before conviction. If a warrant has been issued, counsel can coordinate lawful voluntary surrender and an application for bail.

After arraignment, defenses are litigated through pre-trial, motions allowed by the Rules of Criminal Procedure, and trial. A party seeking reconsideration of or appeal from a court judgment must act quickly: the ordinary period for a motion for new trial or reconsideration, or for an appeal from an RTC judgment, is generally 15 days from promulgation or notice, subject to the applicable rule and procedural history.

Common mistakes

Waiting for negotiations to finish while the one-year period is running;
Filing in a convenient location without establishing territorial venue;
Submitting cropped screenshots without URLs, dates, or context;
Assuming the account name alone proves authorship;
Naming every person who reacted to or shared a post without examining what each person authored;
Treating an insulting opinion as automatically libelous;
Assuming truth alone always ends the case;
Ignoring privilege, public concern, or the actual-malice standard;
Ignoring a subpoena because no court case has yet been filed;
Filing an unsworn denial instead of a proper counter-affidavit;
Missing the 15-day reconsideration or appeal period;
Altering or deleting evidence before preserving it;
Pressuring a complainant or witness to execute an affidavit of desistance;
Assuming an apology or private settlement automatically dismisses the criminal case; and
Posting accusations about the pending case that create additional legal problems.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year prescriptive period may expire soon;
You have received a prosecutor’s subpoena, resolution, court summons, or warrant;
The account is anonymous, hacked, deleted, or controlled from abroad;
Law enforcement requests a device, password, account access, or consent to a search;
A device or account has been seized or frozen;
The case involves a journalist, public officer, public figure, election issue, whistleblower, or matter of public concern;
The respondent is a child;
The publication includes threats, extortion, doxxing, intimate images, stalking, identity theft, or unauthorized account access, which may involve offenses beyond cyber libel; or
There are several possible venues, respondents, publications, or related civil cases.

Persons who cannot afford private counsel may ask the Public Attorney’s Office about eligibility. A complainant may also seek investigative assistance from the NBI or PNP cybercrime units, but those referrals should not be allowed to consume the filing period.

Frequently asked questions

Is a demand letter required before filing?

No general rule makes a demand letter an element of cyber libel. A demand for correction or removal may be useful, but it does not replace a timely complaint and should not be assumed to stop prescription.

Can I file if the post has been deleted?

Possibly. Deletion does not erase an offense already completed, but the remaining evidence must still establish the content, publication, authorship, and other elements. Preserved originals, witnesses, notifications, archives lawfully obtained, and platform or device records may become important.

Can an anonymous account be prosecuted?

Potentially, if investigators can lawfully identify the person responsible and the evidence meets the prosecutorial and trial standards. Report early so that authorities can consider data preservation and appropriate cybercrime warrants.

Is a private or group-chat message cyber libel?

It can be if a defamatory imputation was communicated through a computer system to at least one person other than the person defamed. Privacy settings affect the facts and audience but do not automatically eliminate publication.

Can a corporation be the subject of cyber libel?

Article 353 recognizes that a natural or juridical person may be defamed. The complaint must still establish an actionable imputation, publication, identification, malice, authorship, and the other applicable requirements.

Does reposting someone else’s accusation protect me?

Not necessarily. Attribution—such as saying “someone alleged”—does not automatically neutralize a defamatory republication. Liability depends on whether the person authored or caused a new defamatory publication, the context, privilege, public concern, and applicable defenses.

Does an apology end the case?

No. It may support mitigation, correction of harm, settlement of civil liability, or an evaluation of good faith, but it does not automatically extinguish the criminal action.

Can the parties settle?

They may compromise the civil aspect within legal limits. The criminal action belongs to the State, so a private agreement or affidavit of desistance does not automatically require dismissal. The prosecutor or court must determine its legal effect.

Should an accused answer the accusation publicly?

Usually not before counsel reviews the facts. A reactive post can create admissions, influence witnesses, waive confidentiality, or generate another complaint. Preserve evidence and respond through the proper proceeding.

Official legal sources

This article provides general legal information, not advice for a particular case. Cyber libel outcomes depend on the exact publication, discovery date, evidence, parties, venue, and procedural history. The controlling sources and procedures were checked as of July 30, 2026.