A practical legal guide for victims, families, schools, and employers

1) What counts as “online threats and harassment”?

In Philippine law, there isn’t a single, catch-all statute for “online harassment.” Instead, several laws can apply depending on what happened and who the victim is. Commonly-charged offenses include:

Grave threats / other light threats (Revised Penal Code Arts. 282–283): threatening another with a wrong amounting to a crime or a non-criminal wrong. Online delivery (DMs, posts, emails) still counts.
Unjust vexation / alarms (Art. 287 / 155): repeated, annoying acts that unduly disturb or irritate a person; may apply to persistent online pestering.
Stalking & online gender-based sexual harassment (Safe Spaces Act, RA 11313): includes unwanted sexual remarks, lewd messages, threats, stalking, doxxing, and misogynistic, transphobic, homophobic attacks done through ICT. Also covers “taking, sharing, or spreading” sexualized content without consent.
Violence against women and their children (VAWC) (RA 9262): psychological violence, stalking, intimidation, harassment—including through calls, texts, chats, or posts—by a spouse, ex-spouse, boyfriend, live-in partner, or anyone with whom the woman had a sexual or dating relationship; protects children, too. Electronic abuse is expressly covered.
Cybercrime Prevention Act (RA 10175):
- Computer-related identity theft (Sec. 4[a][3])
- Illegal access/interference (piggybacks on RA 8792 and the Penal Code)
- Cyberlibel (Sec. 4[c][4]; criminal libel committed through ICT).
- Section 6 increases penalties when traditional crimes are committed “by, through and with” ICT.
Anti-Photo and Video Voyeurism Act (RA 9995): capturing, copying, or sharing private sexual images/videos without consent, even if initially consensual.
OSAEC Law (RA 11930, 2022): online sexual abuse or exploitation of children; very strong duties on platforms/ISPs and tough penalties. (If the victim is a minor, use this law.)
Anti-Child Pornography Act (RA 9775) and RA 7610 (child abuse): for minors in sexualized content or abusive communications.
Anti-Bullying Act (RA 10627): schools must address cyberbullying among students, even off-campus acts that affect the school environment.
Data Privacy Act (RA 10173): unauthorized disclosure or processing of personal data (doxxing; posting personal info without basis) may trigger complaints with the National Privacy Commission (NPC).
E-Commerce Act (RA 8792): penalizes hacking and similar acts; used together with RA 10175.

Note on cyberlibel liability. The Supreme Court (e.g., Disini v. Secretary of Justice, 2014) upheld cyberlibel’s constitutionality but narrowed liability mainly to the author/original poster. Ordinary “liking” or passive viewing is generally not a crime absent active participation. (When in doubt, consult counsel.)

2) Where to report (criminal/administrative)

You can report to any of the following—there’s no requirement to choose only one:

Police: Philippine National Police – Anti-Cybercrime Group (PNP-ACG)
- Walk-in to the nearest police station or ACG regional field unit.
- For imminent danger, call emergency services or your local station immediately.
National Bureau of Investigation – Cybercrime Division (NBI-CCD)
- Handles complex/large-scale or cross-border cases; accepts walk-ins and referrals.
Prosecutor’s Office (DOJ/City/Provincial)
- You may file a criminal complaint-affidavit directly with evidence attached; the prosecutor can order further investigation.
Barangay
- Blotter for record; Katarungang Pambarangay (mediation) for non-VAWC disputes;
- Barangay Protection Orders (BPOs) under RA 9262 if abuse is from an intimate partner or covers a woman/child.
National Privacy Commission (NPC) (Data Privacy Act)
- For doxxing/unauthorized disclosure of personal data; you can file a complaint and request compliance orders against entities processing your data unlawfully.
Department of Education / CHED / School Officials (Anti-Bullying Act; Safe Spaces Act)
- Schools must have procedures for cyberbullying or online sexual harassment.
Employers / HR (Safe Spaces Act)
- Workplaces must maintain policies, investigate, and impose sanctions for gender-based online sexual harassment involving employees, clients, or third parties.
Online platforms and ISPs
- Use in-app reporting. Platforms can take down content, suspend accounts, and preserve data upon request from law enforcement. For child-related content (OSAEC), platforms and ISPs have mandatory measures, including blocking and reporting.

3) Evidence: collect, preserve, escalate

Strong, well-preserved evidence is often the difference between a closed case and a filed case.

Do immediately

Screenshot the entire screen including: profile/page name, handle/URL, timestamp, and device clock.
Record identifiers: usernames, profile links, channel IDs, message IDs, email headers, phone numbers, and payment handles used to extort.
Save the raw files: download the HTML, export chats, or use “Download your data.”
Note the context: who else saw it, how it affected you (anxiety, missed work/school), and any prior incidents.

Do not

Don’t reply in anger, threaten back, or solicit illegal hacks.
Don’t delete your copy of the conversation until you’ve safely exported it.
Don’t “doctor” images—keep originals and create working copies for redaction.

Chain-of-custody & admissibility

The Rules on Electronic Evidence (A.M. No. 01-7-01-SC) govern how electronic data is authenticated (e.g., by the person who captured it, by metadata, or by system custodian).
For law enforcement, the Rules on Cybercrime Warrants (A.M. No. 17-11-03-SC) authorize warrants to preserve, disclose, search, and seize computer data. Victims may request police/prosecutors to seek preservation orders quickly.
Under RA 10175 Sec. 13, service providers can be ordered to preserve traffic and subscriber data for a limited period (extendable). Ask investigators to send preservation requests early.

Tip: When possible, export conversations in platform-native formats (e.g., Messenger JSON, Telegram export, email EML). Keep a hash (SHA-256) of files to show they were not altered.

4) How to file a criminal complaint (step-by-step)

Prepare a Complaint-Affidavit
- Facts in chronological order: who, what, when, where, how you discovered the account.
- Identify the applicable offenses (you can state “for violation of RA 10175 (cyberlibel/identity theft), RA 11313 (Safe Spaces Act), Art. 282 (grave threats), etc.”)
- Attach evidence (index and label: Annex “A” – Screenshot 11/08/2025 19:36 with URL; Annex “B” – Messenger export; etc.).
- Sworn before a prosecutor or notary.
File with the City/Provincial Prosecutor (where any element occurred or where the complainant resides, depending on the offense) or report to PNP-ACG / NBI-CCD for investigation first.
Inquest or Preliminary Investigation
- If the suspect is arrested, inquest may proceed; otherwise, a preliminary investigation with counter-affidavits follows.
Protective remedies (can be simultaneous)
- BPO (RA 9262) if the abuser is an intimate partner and the victim is a woman/child.
- TRO/Preliminary Injunction (Rule 58) in civil court for urgent take-downs or to restrain further contact, where applicable.
- Safe Spaces Act administrative/criminal action via police/prosecutor + sanctions in schools/workplaces.
Civil damages (often alongside or after criminal case)
- Under the Civil Code (Arts. 19, 20, 21) for abuse of rights, acts contrary to law, or willful injury; also moral, exemplary, and temperate damages.
- Privacy damages via NPC proceedings or civil action for privacy violations.

5) Jurisdiction, venue, and cross-border issues

Venue: Generally, where any element of the offense occurred (e.g., where the post was accessed, where the victim resides for certain offenses). Many cybercrimes allow flexible venue because acts and effects happen in multiple places.
Extraterritoriality: If the offender is abroad but uses a computer system or causes effects in the Philippines, RA 10175 allows asserting jurisdiction; investigators may seek international cooperation (mutual legal assistance) to unmask or obtain data.
Identity & SIM: The SIM Registration Act (RA 11934) can assist in identifying senders of threat texts, subject to due process and data requests routed through law enforcement.

6) Special contexts & quick matches

Ex-partners / domestic situations → RA 9262 (psychological violence, stalking, harassment), RA 9995 (non-consensual sharing of intimate images), RA 11313 (online sexual harassment).
Minors (victim or offender) → OSAEC (RA 11930), RA 9775, RA 7610, Anti-Bullying Act; schools and parents have mandatory roles.
Workplace → RA 11313: employers must maintain policies, designate officers, investigate, sanction; victims can escalate to DOLE/PNP.
Defamation → Cyberlibel (RA 10175) or libel/slander under the RPC. Consider also civil damages; preserve posts fast due to short prescriptive periods (libel traditionally 1 year).

7) Timelines and prescription (why speed matters)

Different offenses have different prescriptive periods (deadlines to start a case). As a rule of thumb:

Libel/cyberlibel: traditionally 1 year from publication/last publication; do not delay.
Grave threats and most crimes with correctional penalties: generally 10 years (Art. 90 RPC).
Light offenses (e.g., some vexation): 2 months.
Special laws (RA 11313, RA 9995, RA 11930, RA 10173): check the statute; many follow the general rules for prescription under Act No. 3326 or specify their own.

Because jurisprudence evolves, file as early as possible and consult counsel to confirm the exact clock for your case.

8) What outcomes can you ask for?

Criminal penalties: imprisonment, fines, protective orders, forfeiture of devices.
Civil damages: moral, exemplary, temperate, and actual damages; attorney’s fees; injunctive relief.
Platform remedies: content removal, account suspension, preservation of data for law enforcement.
Privacy remedies (NPC): compliance orders, cessation orders, monetary penalties against erring controllers/processors.

9) Practical checklists

A) Evidence package

Narrative timeline (1–2 pages max).
Copies of threats/harassing messages with full-screen screenshots.
Exports (Messenger/Telegram/WhatsApp/email EML).
Links/handles/phone numbers and any known real names.
Medical/psychological reports (if applicable).
Proof of loss (missed work, expenses, receipts).
Witness statements (who saw the posts, who you told).
Device details (model, OS, account names).
Hashes of key files.

B) Information to bring when reporting

Government ID; contact details.
Two copies of your Complaint-Affidavit and annexes (organized, paginated).
USB drive (clean) with digital evidence folders.
If child victim: birth certificate; parent/guardian ID; school letters if cyberbullying.
For VAWC: proof of relationship (marriage cert, child’s BC, photos, chats showing relationship).

10) Model Complaint-Affidavit (skeleton)

Title: Affidavit-Complaint for Grave Threats (Art. 282), Violation of RA 11313 (Online GB Sexual Harassment), and RA 10175 (Cyberlibel/Identity Theft) Complainant: Juan Dela Cruz, of legal age, Filipino, … Respondent: [Name/Username unknown a.k.a. “@handle”] Allegations:

On [date/time], respondent using account @handle sent me the message “[…]” via [platform], threatening […]. (Annex “A”)

On [date], respondent posted a sexualized comment “[…]” on my photo. (Annex “B” – URL, screenshot)

I suffered anxiety, missed work, and sought counseling. (Annex “C”) Legal basis: Art. 282 RPC; Sec. 12–15 RA 11313; Sec. 4(c)(4) & 6 RA 10175. Reliefs sought: Filing of information, issuance of subpoenas/preservation orders, and other relief. Verification & jurat.

(Attach an Annex Index with page numbers and brief descriptions.)

11) Common defenses you should anticipate (and how evidence helps)

“My account was hacked.” → Preserve login notifications, 2FA logs; request law enforcement to obtain IP/session data from the platform.
“It was a joke / no intent.” → Show the context, prior messages, and reasonableness of fear. Threats don’t need magic words; persistence and specificity matter.
“Public figure / fair comment.” (libel) → Truth, good motives, and justifiable ends are defenses; your evidence should show malice, falsity, or reckless disregard.

12) Safety planning beyond the case

Lock down privacy settings; enable 2FA; rotate passwords and recovery options.
Document doxxing risks (home, school, work info) and ask platforms to suppress certain search results where offered.
For ongoing danger, arrange safe transport/routes and inform trusted contacts and building security.
If the abuser is a partner/ex-partner, prioritize BPO/TPO and device-safety checks (spyware, shared Apple ID/Google accounts).

13) Quick answers (FAQ)

Can I be sued/arrested for posting about my harasser? Possibly, if your post is defamatory. Focus on facts and reports to authorities; avoid naming if unsure.
What if I don’t know the real name? You can still file “John/Jane Doe” complaints; agencies can subpoena subscriber/IP/session data.
Are screenshots enough? They help, but best is a combination: screenshots + exports + witness + platform certification (later).
Do I have to attend barangay mediation? Not for VAWC; you can go straight to court/police. For non-VAWC disputes between private individuals in the same city/municipality, barangay conciliation may be a pre-condition unless covered by exceptions.

14) One-page action plan (print this)

Safety first (if credible threat: call police; tell someone; secure your devices).
Preserve evidence (screenshots with URLs, exports, keep originals).
Report: PNP-ACG/NBI-CCD; file a blotter; notify platform; if VAWC, seek a BPO; if school/work, activate policies.
Complain: Prosecutor’s Office (criminal); NPC (privacy); civil case (damages/injunction) if needed.
Follow through: attend hearings; keep a log; update investigators; mind prescription periods.

Final note

This guide condenses Philippine statutes and court rules most frequently used for online threats and harassment. Because facts and jurisprudence matter, consider consulting a lawyer or legal aid clinic to tailor this playbook to your exact situation.