Quick answer

A Philippine cyber libel case is filed through a sworn complaint with the proper City or Provincial Prosecutor’s Office, usually after evidence is preserved and, when needed, investigated by the NBI Cybercrime Division or PNP Anti-Cybercrime Group. The prosecution must establish every element of libel, the respondent’s authorship or responsibility for the online publication, and the use of a computer system.

Act quickly. As of August 10, 2026, the Supreme Court has definitively ruled that cyber libel prescribes one year from discovery of the publication by the offended party, the authorities, or their agents. Discovery is not automatically presumed on the date the material was posted, but the claimed discovery date must be supported by evidence. A mere police report or platform complaint should not be assumed to stop prescription; file the proper complaint with the prosecutor within the one-year period.

A person accused of cyber libel should not ignore a subpoena or rely only on deleting the post. Obtain the complete complaint and attachments, preserve the account and surrounding context, and submit a sworn, evidence-supported counter-affidavit by the date stated in the subpoena. Prescription, improper venue, lack of authorship, failure to identify the complainant, absence of publication, privilege, truth accompanied by good motives and justifiable ends, and failure to prove actual malice in cases involving public officials or public figures may be material defenses, depending on the facts.

What the prosecution must prove

Cyber libel is libel committed through a computer system or similar information and communications technology. It is governed by Section 4(c)(4) and Section 6 of the Cybercrime Prevention Act, together with Articles 353 to 361 of the Revised Penal Code.

The evidence must establish:

A defamatory imputation. The material attributed a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt. Meaning is assessed from the words, images, context, language, audience, and overall publication—not from an isolated phrase alone.
Identification of the offended party. The person need not always be named. It is enough if the words and surrounding circumstances allowed at least one third person to identify the complainant. A vague statement about a large or undefined group may fail this element.
Publication to a third person. Someone other than the author and offended party must have received, read, heard, or seen the material. A one-to-one private message seen only by the offended party ordinarily lacks publication, while a group chat, public post, email copied to others, online article, video, or comment thread may satisfy it.
Malice. Article 354 generally presumes malice from a defamatory imputation, subject to recognized privileges and constitutional protections. In qualifiedly privileged communications and in criminal cases involving criticism of public officials or public figures on matters of public concern, the prosecution may have to prove actual malice—knowledge that the statement was false or reckless disregard of whether it was false.
Use of a computer system or similar technology. This includes online publications made through social media, websites, messaging applications, email, or comparable digital systems.
The respondent’s responsibility for the publication. A profile name, photograph, or screenshot does not by itself conclusively prove who operated an account or authored a post. Attribution may require admissions, witness testimony, account records, device evidence, login information, correspondence, or properly obtained subscriber and traffic data.

The prosecution bears the burden at trial of proving guilt beyond reasonable doubt. At the prosecutor’s investigation, the current DOJ standard is prima facie evidence with reasonable certainty of conviction: the available evidence must be admissible, credible, preservable, and capable of establishing every element and the identity of the responsible person.

Who may be liable

The Supreme Court sustained cyber libel principally as applied to the original author of the defamatory online material. Merely receiving, liking, reacting to, or sharing another person’s post is not automatically cyber libel under the aiding-or-abetting theory rejected in Disini v. Secretary of Justice.

There are important limits:

A person who adds an independently defamatory caption, comment, accusation, edited image, or video may become the author of that new material.
Evidence that someone caused or participated in the original publication must be evaluated individually.
A platform user is not proved to be the author merely because the content appeared under that person’s name.
The same act should not be punished simultaneously as both traditional libel and cyber libel; the Supreme Court invalidated that form of double prosecution under Section 7 of the Cybercrime Prevention Act.

Material originally posted before the Cybercrime Prevention Act became effective cannot be punished retroactively as cyber libel. A later, deliberate republication or new upload may present a different issue, but merely finding an old item online does not by itself prove a new publication by the accused.

The one-year deadline

The controlling rule is now clear: criminal cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents.

Preserve evidence of both publication and discovery, including:

The first message, email, or call alerting the complainant to the post
The date the complainant first opened or received it
The identity and affidavit of the person who first showed it to the complainant
Earlier comments, replies, tags, or communications that may show an earlier discovery date
The dates of any NBI, PNP, prosecutor, or other official report
The stamped filing date of the prosecutor’s complaint

The Supreme Court has rejected an automatic presumption that an online post was discovered the moment it was uploaded. Nevertheless, a disputed discovery date is a factual issue. A complainant cannot safely rely on a bare assertion of late discovery, and an accused cannot establish prescription merely by pointing to the upload date if the actual discovery date is different.

Do not wait for a demand letter, apology, platform takedown, or private negotiation if prescription is approaching. Those steps do not reliably preserve the right to prosecute.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code, but its accrual and interaction with a criminal case require separate analysis. Obtain advice promptly if damages are being considered.

Where to file

Cyber libel cases are tried by designated Regional Trial Courts acting as cybercrime courts. Under the Rule on Cybercrime Warrants, the criminal action may be filed in the province or city:

Where the offense or any element was committed
Where any part of the computer system used was situated
Where damage to the natural or juridical person occurred

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of other courts.

Venue is not established merely because a webpage could be accessed anywhere in the Philippines. The complaint must allege and ultimately support a concrete connection to the chosen city or province. Libel also has special venue principles intended to prevent harassment through distant lawsuits. Residence, place of first publication, the complainant’s status as a private person or public officer, and the location of the relevant computer system may matter.

Because an incorrect venue can defeat the case, confirm the proper City or Provincial Prosecutor’s Office before filing—especially when the complainant and respondent live in different places, the account was operated abroad, the complainant is a public officer, or the supposed damage occurred in several locations.

How to prepare and file the complaint

1. Preserve the online material immediately

Capture more than a cropped screenshot. Preserve:

The full post, article, comment, image, audio, or video
The complete URL, account handle, profile page, and visible account identifiers
Publication and edit dates, timestamps, time zone, audience setting, and sharing information
The thread before and after the disputed statement
Comments or messages showing that third persons saw and understood it
A screen recording showing how the material was accessed from the profile or webpage
The original downloaded file, where available, with its metadata
The device and account on which the material was received or viewed
Platform notices, deletion notices, reports, and responses
The first communication showing when the complainant discovered the material

Do not crop away context, annotate the only copy, alter metadata, or rely solely on a printed screenshot. Keep an untouched copy and working duplicates.

Electronic documents must be authenticated under the Rules on Electronic Evidence. Notarizing a printout does not automatically prove that it is authentic, complete, or attributable to the respondent.

2. Identify witnesses and supporting records

Useful witnesses may include:

A person who saw the publication and recognized the complainant
The person who first informed the complainant
A person with personal knowledge of the account or authorship
A records custodian or forensic witness, when necessary
A witness who can explain specialized language, local references, or an edited recording

Also preserve documents disproving the accusation, evidence of reputational or business harm, public records relevant to falsity, and any admission or communication from the author.

3. Seek technical investigation when needed

For an anonymous, impersonated, hacked, or disputed account, request assistance promptly from the NBI Cybercrime Division or PNP Anti-Cybercrime Group. Investigators can guide evidence collection and, when legal requirements are met, seek preservation, disclosure, search, or examination orders.

A private complainant cannot lawfully hack an account or compel a platform to disclose protected subscriber data. Platform records may disappear under retention policies, so ask investigators or counsel about lawful preservation without delay.

4. Draft the sworn complaint-affidavit

Under the 2024 DOJ-NPS Rules, the complaint-affidavit should state:

The parties’ names and addresses
The date and place of the alleged offense
The chosen venue’s factual basis
The precise words, images, or statements complained of
How the complainant was identified
Who received or saw the publication
Why the material is defamatory and, where relevant, false
Facts showing authorship or responsibility
When and how the complainant discovered it
The evidence supporting every element

Attach sworn witness affidavits and properly labeled documentary and electronic evidence. Avoid conclusions such as “this ruined my reputation” without explaining the underlying facts.

5. File the required copies and form

A regular preliminary investigation is initiated by filing:

The original complaint-affidavit
Two duplicate copies for the prosecution office
One additional set for each respondent
A completed NPS Investigation Data Form
Witness affidavits and supporting evidence

Confirm the receiving office’s current filing arrangements. The DOJ rules permit electronic and virtual procedures in specified circumstances, but an ordinary email to an unofficial address should not be assumed to constitute a valid filing.

What happens during preliminary investigation

After checking the complaint’s form and evidentiary completeness, the prosecution office may docket it and assign an investigating prosecutor.

The current procedural periods include:

The prosecutor ordinarily has five calendar days from receiving the complete records to recommend dismissal or issue subpoenas.
The hearing date stated in the subpoena should be no more than 30 days from the prosecutor’s receipt of the complete records.
A respondent must receive at least 10 days between receipt of the subpoena and the scheduled submission of the counter-affidavit.
A reply-affidavit and rejoinder-affidavit, when required, must each be filed within 10 calendar days of receiving the pleading answered.
An extension is exceptional, requires a meritorious reason, and may not exceed 10 days.
Preliminary-investigation complaints should ordinarily be resolved within 60 calendar days from assignment, with a maximum 30-day extension in specified complex or related cases.
A motion for reconsideration of the prosecutor’s resolution must be filed within 15 days from receipt.

The dates in the subpoena or written order remain critical. Do not calculate a deadline from hearsay or assume weekends, late service, an informal settlement, or a pending platform request suspends it.

If the prosecutor finds sufficient evidence, an Information is filed in the proper RTC. The court independently evaluates judicial probable cause and may issue a warrant of arrest. Bail is generally a matter of right before conviction for this non-capital offense, but the court fixes the conditions and amount.

A DOJ petition for review may be available under the applicable NPS appeal rules. The correct reviewing office depends on the issuing prosecutor and court jurisdiction. If an Information is already in court, a petition for review does not automatically halt the criminal case; the current DOJ rules require an accompanying motion to suspend proceedings. This stage warrants immediate legal assistance.

How to defend the case

Respond to the subpoena

Obtain the complete complaint, all attachments, the investigation number, and proof of the date the subpoena was received. A counter-affidavit should be sworn, fact-specific, and supported by witness affidavits and documents.

A motion to dismiss generally cannot replace a counter-affidavit. If a verified motion contains all defenses, the prosecutor may treat it as the counter-affidavit, but relying on form alone is risky. Failure to respond can result in resolution based only on the complainant’s evidence.

Preserve—not destroy—the account and devices

Save the disputed publication and its full context, including drafts, edit history, privacy settings, source materials, messages, account-security notices, login alerts, and evidence of compromise. Preserve documents showing how information was verified and why it was published.

Do not:

Delete messages or devices after receiving notice of a case
Fabricate screenshots or backdate documents
Ask witnesses to change their statements
Threaten or publicly attack the complainant
Post new accusations about the dispute
Surrender passwords or consent to a device search without understanding the lawful basis and scope

Deletion or apology may be relevant to good faith, mitigation, damages, or settlement, but it does not automatically erase a completed publication.

Examine every element and procedural issue

Potential defenses include:

No authorship or attribution. The account was impersonated, compromised, shared, or operated by someone else, and the prosecution lacks competent attribution evidence.
No defamatory imputation. In context, the words were not reasonably understood as accusing the complainant of a dishonorable fact.
No identification. Third persons could not reasonably determine that the statement referred to the complainant.
No publication. The material was communicated only to the complainant, or there is no competent proof that a third person received it.
No qualifying online act. The accused did not make the publication through a computer system, or the alleged online act occurred before the Cybercrime Prevention Act could lawfully apply.
Prescription. More than one year elapsed from actual discovery before the criminal action was properly instituted.
Improper venue or lack of jurisdiction. The complaint or Information lacks a sufficient territorial basis.
Privilege. The communication falls within a recognized absolute or qualified privilege and, where applicable, actual malice is absent.
Truth, good motives, and justifiable ends. Truth alone is not always enough. Article 361 generally requires both truth and proof that publication was made with good motives and for justifiable ends.
Public-official or public-figure criticism. When the statement concerns a public official’s conduct or a public matter, the prosecution must prove actual malice where the constitutional standard applies.
Failure to authenticate electronic evidence. Screenshots, messages, recordings, or printouts lack competent authentication, completeness, or reliable attribution.
Double jeopardy or duplicative charging. The same online publication is improperly charged under both traditional and cyber libel provisions.

Insults, exaggeration, satire, rhetorical hyperbole, or opinion are not automatically protected or automatically criminal. Courts consider whether the material, in context, asserts or implies a defamatory fact and whether privilege or actual malice rules apply.

Raise court defenses at the proper time

Once an Information is filed, some objections must be raised before plea through an appropriate motion to quash or other remedy. Waiting until after arraignment may waive certain defects. Prescription, jurisdiction, double jeopardy, and failure of the allegations to constitute an offense involve different procedural rules, so obtain counsel before entering a plea.

Privileged communications and fair comment

Article 354 recognizes qualified privileges that include:

A private communication made in the performance of a legal, moral, or social duty
A fair and true report, made in good faith and without added comments, of non-confidential official proceedings or acts of public officers

The privilege is qualified, not an unrestricted license to publish accusations. Excessive publication, irrelevant personal attacks, knowingly false statements, reckless disregard of obvious doubts, or added defamatory commentary may defeat it.

Statements made in judicial or official proceedings may receive broader protection when relevant to the proceeding. Republishing the same accusation on social media is a separate act and does not automatically inherit the proceeding’s privilege.

Fair comment on matters of public interest may also be protected, particularly where the underlying facts are accurately stated and actual malice is absent. Labeling a factual accusation as “opinion” does not make it immune.

Penalties and civil liability

For conduct governed by the amended fine provisions, cyber libel carries a penalty one degree higher than traditional written libel:

Imprisonment of prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years
A fine of ₱40,000 to ₱1,500,000
Or both, depending on the judgment and circumstances

The Supreme Court has confirmed that a court may impose a fine instead of imprisonment in an appropriate online-libel case. A fine-only sentence is not guaranteed; sentencing remains judicial and depends on the governing law, date of the offense, and circumstances.

A criminal case may also include civil liability unless the civil action is validly waived, reserved, or separately instituted. Article 33 of the Civil Code permits an independent civil action for defamation requiring a preponderance of evidence, but venue, prescription, reservation, and consolidation rules must be handled carefully.

Common mistakes

Waiting for the post to “go viral” before preserving or filing
Counting the one-year period only from upload while ignoring evidence of actual discovery
Assuming a police blotter, demand letter, or platform report interrupts prescription
Filing wherever the post was viewed without proving proper venue
Submitting only cropped or edited screenshots
Failing to preserve the original device, URL, account identifiers, timestamps, and context
Treating a profile name as conclusive proof of authorship
Filing emotional affidavits that do not establish each legal element
Assuming truth alone always results in acquittal
Assuming every criticism, insult, negative review, share, or reaction is cyber libel
Ignoring a subpoena because the respondent believes the complaint is weak
Filing a bare motion to dismiss instead of a complete sworn counter-affidavit
Discussing the case publicly and creating additional evidence or possible publications
Missing the 15-day period for reconsideration or failing to seek suspension while pursuing DOJ review

When legal help is urgent

Consult a Philippine lawyer immediately if:

The one-year criminal or civil deadline is close
The post or account may soon disappear
The account is anonymous, hacked, or impersonated
A prosecutor’s subpoena, resolution, Information, or warrant has been received
Arraignment or a court hearing has been scheduled
The complainant is a public official or the publication concerns government conduct
Several posts, respondents, cities, or countries are involved
The case also involves threats, extortion, intimate images, stalking, child abuse, or immediate physical danger
Police request access to a device, password, or account
Settlement, retraction, or an affidavit of desistance is being proposed

Qualified indigent accused persons may inquire with the Public Attorney’s Office about representation. For immediate threats to safety, contact law enforcement rather than treating the matter solely as a libel dispute.

Frequently asked questions

Is a demand letter required before filing?

No. A demand, request for correction, or opportunity to retract is not a general statutory prerequisite to a criminal cyber libel complaint. It may be useful in some cases, but it should not be allowed to consume the one-year period.

Does deleting the post prevent a case?

No. Deletion does not undo a completed publication if admissible evidence remains. It may affect proof, damages, good faith, or sentencing. Preserve the content before requesting removal.

Is a false statement automatically cyber libel?

No. The prosecution must still prove defamatory meaning, identification, publication to a third person, malice under the applicable standard, authorship, and use of a computer system.

Is truth a complete defense?

Not by itself in every criminal libel case. The Revised Penal Code generally requires proof that the matter was true and was published with good motives and for justifiable ends. The admissibility and effect of proof of truth also depend on the nature of the accusation and the complainant.

Can a person be charged for liking or sharing a post?

A like, reaction, receipt, or bare share is not automatically cyber libel. A person who adds an independently defamatory accusation or materially republishes content as their own may face a different analysis.

Can a private group chat amount to publication?

Yes, if at least one person other than the author and offended party received the defamatory material. “Private” platform settings do not necessarily eliminate the publication element.

Can a company file a complaint?

A juridical person can be the subject of libel if the imputation tends to discredit it and the other elements are established. The person signing for the entity must have proper authority.

Can an anonymous account be charged?

The responsible natural person must still be identified and linked to the publication through admissible evidence. NBI or PNP cybercrime investigation and court-authorized platform data may be necessary.

Does an affidavit of desistance automatically end the case?

No. A criminal offense is prosecuted in the name of the People of the Philippines. A desistance or settlement may influence the evidence or civil claims, but it does not automatically require the prosecutor or court to dismiss the criminal case.

Will the accused be arrested as soon as the complaint is filed?

Ordinarily, the prosecutor first conducts preliminary investigation. If an Information is later filed, the court determines probable cause for a warrant. Warrantless arrest is lawful only under the strict situations provided by the Rules of Criminal Procedure.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Cyber libel conclusions depend heavily on the exact publication, evidence, discovery date, parties’ status, and venue. Laws, rules, and official guidance were checked through August 10, 2026.