Quick answer

Cyber libel is committed when a person authors or causes the online publication of a defamatory statement that identifies another person or juridical entity and is made with legally sufficient malice. It is punishable under Section 4(c)(4) of the Cybercrime Prevention Act in relation to Articles 353 and 355 of the Revised Penal Code.

To file a case, preserve the complete digital evidence immediately, establish who authored the publication, record when it was first discovered, choose a legally proper venue, and file a sworn complaint with the appropriate prosecution office. To defend one, do not ignore the subpoena: examine whether every element is supported, whether the complainant filed within the one-year prescriptive period, whether venue is proper, whether authorship and publication are proved, and whether truth, privilege, public-interest speech, or absence of malice applies.

A cyber-libel prosecution does not begin merely by reporting the post to Facebook, the police, or the barangay. A complaint must undergo the applicable prosecutorial process, and only a prosecutor may file the Information in the designated cybercrime Regional Trial Court.

What counts as cyber libel?

The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose someone to contempt.
Publication. The statement was communicated to at least one person other than the person allegedly defamed. A message seen only by its sender and the offended person ordinarily lacks this element. A public post, group-chat message, email copied to others, online article, video caption, or comment may satisfy publication.
Identification. The offended person is named or is identifiable from the words, images, surrounding facts, or circumstances. Naming the person is unnecessary if readers familiar with the situation can reasonably identify them.
Malice. The applicable kind and burden of proving malice depend on whether the communication is privileged and whether the complainant is a private person, public officer, or public figure speaking within a matter of public concern.
Use of a computer system or similar ICT. This includes online publication through computers, mobile phones, social-media services, websites, messaging applications, and comparable technology.
Authorship or responsibility for the publication. The evidence must connect the respondent—not merely the account name or profile photograph—to the content.

The statement is assessed as a whole, in its language and context. Courts do not isolate a single word when the entire post conveys a different meaning. Conversely, adding “allegedly,” “in my opinion,” or a question mark does not automatically protect an accusation that readers would understand as asserting a defamatory fact.

Who may be held liable?

The Supreme Court’s ruling in Disini v. Secretary of Justice limits the cyber-libel provision to the person who originally authored or posted the online libel. A person who merely receives, likes, reacts to, or passively shares an existing post is not liable under the unconstitutional aiding-or-abetting theory rejected in that case.

That protection is not a license to add new defamatory content. A person who writes a fresh defamatory caption, comment, introduction, or accusation may be treated as the author of that new material. Liability may also depend on proof that a person caused or participated in the original publication under the applicable provisions of the Revised Penal Code. The exact role of editors, account administrators, employers, and people sharing access to an organizational account must be assessed from the evidence rather than assumed from job titles.

The same defamatory material should not produce separate convictions for traditional libel and cyber libel merely because it appeared in both print and online form; Disini treated them as essentially the same offense for that purpose.

The one-year deadline is critical

The Supreme Court definitively affirmed in its April 8, 2026 resolution in Causing v. People that cyber libel prescribes in one year, despite its increased penalty.

Under Articles 90 and 91 of the Revised Penal Code:

The period is counted from the day the alleged cyber libel is discovered by the offended party, the authorities, or their agents.
Discovery is not automatically presumed to have occurred on the day an online post was published.
Filing the proper complaint or Information interrupts prescription.
The period may run again if the proceedings end without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused.
Prescription does not run while the offender is absent from the Philippines.

The actual discovery date is therefore an evidentiary issue. A complainant should state who discovered the material, the exact date and manner of discovery, and the records or witnesses supporting that date. A respondent claiming prescription should not rely on the publication date alone; Causing rejected the attempt to presume discovery without supporting evidence.

Do not wait until the final days. A report to a platform, a private demand letter, or an informal police inquiry may not be the pleading that interrupts criminal prescription. File through the proper prosecutorial channel in time.

A separate civil action for defamation is also generally subject to the Civil Code’s one-year period. A written extrajudicial demand may interrupt civil prescription under Article 1155, but it does not substitute for timely action on the criminal complaint.

Evidence to preserve immediately

Preserve evidence before requesting deletion, blocking the account, or confronting the author.

Preserve the publication

Keep:

Full-page screenshots showing the statement, account name, profile details, date, time, audience, comments, and surrounding context.
The exact URL, account handle, profile or page ID, group name, and privacy setting.
A screen recording showing how the post was accessed and the content above and below it.
The original photo, video, audio, message, article, or downloaded file in its native format when available.
Earlier and later versions of an edited post.
Comments, reactions, shares, and messages showing that third persons saw or understood the publication.
Platform notices, report acknowledgments, deletion notices, and account-security alerts.
A written chronology identifying the person who captured each item, when it was captured, and the device used.

Avoid relying only on cropped screenshots. Preserve the original device and unedited files. Do not mark up the only copy, alter metadata, or log in to another person’s account without authority.

Prove who controlled the account

An account bearing a person’s name or photograph is not conclusive by itself. In XXX v. People, the Supreme Court identified several ways ownership, access, or authorship may be shown, including:

An admission of account ownership, access, or authorship.
Testimony that the person was seen accessing the account or composing the communication.
Information in the post known only to that person or a limited group.
Distinctive language or writing patterns linked to the person.
Provider, telecommunications, ISP, geolocation, or device-forensic records.
Conduct consistent with earlier account activity.
Other circumstances that, taken together, reliably identify the author.

A complainant should gather lawful evidence pointing to authorship. A respondent claiming hacking, impersonation, or shared access should preserve login histories, security emails, device records, password-change notices, police or platform reports, and the identities of people who had authorized access.

Preserve evidence about truth and malice

The parties should also retain:

Documents and firsthand witnesses bearing on whether the accusation is true.
Sources, interview notes, drafts, recordings, official records, and verification efforts existing before publication.
Communications showing the author was warned that information was false.
Corrections, retractions, replies, apologies, or refusals to correct.
Evidence of hostility, threats, retaliation, or a legitimate duty or public purpose.
Proof of actual harm, such as lost engagements, customer cancellations, employment consequences, medical treatment, or messages from people who saw the post.

How to file a criminal complaint

1. Test every element before filing

Identify the exact allegedly libelous words. Explain their meaning in context rather than simply labeling the post “malicious.” State:

What discreditable act or condition was imputed.
How the complainant was identified.
Who other than the complainant saw it.
Why the named respondent authored or caused the publication.
Why the communication was malicious and not privileged.
When and how it was discovered.
Where the relevant acts, computer system, or damage occurred.

A weak complaint often alleges injury but fails to establish authorship, publication to a third person, or the proper discovery date.

2. Choose a proper venue

Under the Rule on Cybercrime Warrants, a criminal action under Section 4 of Republic Act No. 10175 is filed in the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where any of the damage to a natural or juridical person occurred.

The court where the action is first properly filed acquires jurisdiction to the exclusion of the others. The fact that an internet post can be viewed nationwide does not permit filing in any city chosen for convenience.

The initial complaint should be lodged with the prosecution office having the territorial connection necessary to bring the Information in the proper designated cybercrime RTC. Venue in a criminal case is jurisdictional, so the complaint should allege and document the connection precisely.

3. Prepare the complaint-affidavit

Under the 2024 DOJ-NPS Rules, regular preliminary investigation is initiated by filing:

The original complaint-affidavit;
Two duplicate copies for the prosecution office;
An additional copy for every respondent;
The completed NPS Investigation Data Form;
Witness affidavits; and
The supporting documentary, electronic, and object evidence.

The affidavit should give the parties’ names and addresses, the date and place of the offense, and a clear narrative establishing every element. It must be sworn before a prosecutor or another government official authorized to administer oaths, or, when they are unavailable, a notary public.

Confirm the receiving office’s current administrative and payment requirements before filing, particularly if the complaint involves voluminous electronic records.

4. Seek technical investigation when necessary

The NBI Cybercrime Division, appropriate PNP cybercrime unit, or DOJ Office of Cybercrime may assist when the author is anonymous, an account may be fake, provider data are needed, or forensic examination is necessary.

Act quickly. Under Republic Act No. 10175, traffic data and subscriber information are preserved by service providers for a minimum of six months from the transaction. Content data may be preserved for six months after a law-enforcement preservation order, with a one-time six-month extension. Disclosure of protected provider data generally requires the process and judicial warrants prescribed by law.

A private complainant cannot compel a social-media platform or telecommunications provider to disclose subscriber information simply by sending a demand. Law enforcement must use the proper preservation and warrant procedures.

5. Follow the preliminary-investigation process

Cyber libel carries a possible penalty reaching eight years, so it falls under regular preliminary investigation under DOJ Department Circular No. 015, series of 2024.

The current process includes these important periods:

Within five calendar days after receiving the complete record, the investigating prosecutor should either recommend dismissal or issue subpoenas.
The hearing date stated in the subpoena must give the respondent at least ten days from receipt of the subpoena and complaint.
The respondent files the counter-affidavit and supporting evidence on the date set.
An extension is exceptional, must be justified by the interests of justice, and may not exceed ten days.
If clarification is needed, the prosecutor may set a physical or virtual clarificatory hearing within ten calendar days after receiving the counter-affidavit.
A required reply or rejoinder must be filed within no more than ten calendar days from receipt of the pleading answered.
The investigating prosecutor generally has 60 calendar days from assignment to resolve the complaint, subject to a maximum 30-day extension in the cases specified by the rules.

The prosecutor applies the current standard of prima facie evidence with reasonable certainty of conviction. The evidence should appear admissible, credible, preservable, and sufficient—if left uncontroverted—to establish every element and the respondent’s identity.

6. Act promptly on the resolution

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the prosecutor’s resolution. A qualifying resolution may also be taken through the petition-for-review process under the 2022 NPS Rule on Appeal. Because the proper reviewing authority and required attachments depend on the case and the issuing office, follow the resolution’s notice and the applicable circular exactly.

If an Information has already been filed in court, a petition for review should be accompanied by the appropriate motion asking the trial court to suspend proceedings. Filing an administrative appeal does not automatically stop the court case.

How to defend against a cyber-libel complaint

Respond to the subpoena, not just the accusation

The subpoena should include the complaint and attachments and set the counter-affidavit date. Calendar the date of actual receipt. A motion to dismiss cannot ordinarily replace a counter-affidavit unless it is verified, contains the defenses, and can be treated as the counter-affidavit.

Failure to answer allows the prosecutor to resolve the complaint from the complainant’s evidence. If more time is genuinely needed to obtain counsel, examine voluminous records, or address a technical issue, request an extension immediately and explain the specific grounds.

Challenge each element with evidence

A strong defense is organized element by element:

No defamatory imputation: The complete statement does not accuse the complainant of a discreditable fact when read in context.
No publication: No third person received or saw it.
No identification: The complainant was neither named nor reasonably identifiable.
No authorship: The evidence does not reliably connect the respondent to the account or content.
No malice: The statement was made on a verified factual basis, for a legitimate purpose, or under a recognized privilege.
Prescription: More than one year elapsed from provable discovery to the filing that interrupted prescription.
Improper venue: The complaint does not establish a legally sufficient connection to the chosen province or city.
Non-retroactivity: Online material published before the cyber-libel law became effective cannot be prosecuted retroactively under that provision.
Duplicate prosecution: The State is attempting to punish the same defamatory publication twice under traditional and cyber-libel provisions.

General denials are rarely enough. Attach the full thread, source documents, witness affidavits, account-security data, drafts, and evidence of verification or legitimate purpose.

Truth, privilege, opinion, and public-interest speech

Truth is not automatically a complete defense

Article 361 permits proof of truth in a criminal libel case, but acquittal ordinarily requires both:

That the matter is true; and
That it was published with good motives and for justifiable ends.

Proof of the truth of an imputation that is not itself a crime is generally inadmissible unless the imputation concerns a government employee and facts related to official duties.

Someone who publishes a true but gratuitously humiliating accusation out of spite should therefore not assume that truth alone ends the case.

Qualified privileged communications

Article 354 recognizes, among others:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of qualifying official proceedings or acts that are not confidential.

The privilege depends on the occasion, purpose, audience, manner, and content. Sending an otherwise proper complaint only to an authorized supervisor is different from posting it publicly. Adding malicious accusations or unnecessary commentary to an official report can defeat the protection.

When a communication is qualifiedly privileged, malice is not presumed; the prosecution must prove actual malice.

Statements made in judicial proceedings may enjoy stronger privilege when relevant to the proceeding, but publishing the same accusations to the general public is a separate act that does not automatically share that protection.

Public officers and public figures

Where the complainant is a public official or public figure and the publication concerns public conduct or a legitimate matter of public concern, the prosecution must satisfy the stricter actual-malice standard. Actual malice means knowledge that the statement was false or reckless disregard of whether it was false, involving a high degree of awareness of probable falsity.

Mere mistake, inaccuracy, or inadequate investigation is not necessarily actual malice. But fabricated sources, purposeful avoidance of obvious contrary proof, or publication despite serious doubts may support it.

Not every statement about a government employee automatically receives this protection. The person’s role, the subject discussed, and the relationship of the statement to public duties matter.

Opinion and fair comment

A genuine value judgment or criticism on a matter of public interest may be protected, particularly when its factual basis is disclosed and true. But an accusation of crime or misconduct does not become immune merely because it is introduced with “I think.” Courts consider whether an ordinary reader would understand the words as opinion, rhetorical criticism, or a verifiable assertion of fact.

What happens after an Information is filed?

The case goes to a designated cybercrime Regional Trial Court. The judge independently evaluates probable cause and may dismiss the case, require additional evidence, or issue a warrant of arrest.

Cyber libel is bailable as a matter of right before conviction because it is not punishable by reclusion perpetua. The amount and conditions of bail are determined under the Rules of Criminal Procedure. A respondent who learns that a warrant has issued should coordinate promptly with counsel regarding voluntary surrender, bail, and recall or lifting of the warrant—not evade service.

The accused is then arraigned, followed by pretrial and trial. The prosecution must prove guilt beyond reasonable doubt. The prosecutor’s earlier finding is not proof of guilt at trial.

For current offenses, the possible imprisonment is one degree higher than traditional libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years. Under Soliman v. People, the court may impose a fine instead of imprisonment. The current fine range for online libel is ₱40,000 to ₱1,500,000, or the court may impose both fine and imprisonment, depending on the circumstances. A fine-only sentence is permitted but never guaranteed.

Civil liability and damages may also be adjudged.

Civil remedies

A person injured by defamation may pursue:

Civil liability arising from the criminal offense, which is generally deemed included when the criminal action is filed unless waived, reserved, or previously instituted; or
An independent civil action for defamation under Article 33 of the Civil Code, proved by preponderance of evidence rather than beyond reasonable doubt.

The claimant cannot recover twice for the same injury. Venue, coordination with any criminal case, prescription, proof of actual loss, and the legal basis for moral or exemplary damages require careful pleading. The Civil Code generally requires an action for defamation to be filed within one year.

A takedown request, correction, retraction, or demand for apology can be pursued before litigation, but none is a statutory prerequisite to a criminal complaint. Preserve the evidence first.

Retractions, apologies, settlement, and desistance

Deleting the post does not erase a completed publication, and an apology is not an automatic defense. Prompt deletion, correction, and a sincere apology may nevertheless affect the evidence of malice, damages, or the penalty. In Soliman, immediate deletion and repeated apologies were among the circumstances considered in sustaining a fine-only sentence.

An accused person should obtain advice before issuing a statement that may become an admission. A complainant should avoid demanding money through threats of exposure or prosecution; depending on the circumstances, that conduct may create separate legal problems.

Settlement or an affidavit of desistance also does not automatically terminate a criminal case. Once an offense is prosecuted in the name of the People of the Philippines, the prosecutor—and, after filing, the court—decides whether lawful grounds exist to dismiss it.

Common mistakes

Saving only one cropped screenshot.
Requesting platform deletion before preserving the post and account details.
Assuming a profile name proves authorship.
Filing wherever the post happened to be viewed.
Treating a barangay report or platform complaint as the filing that stops criminal prescription.
Waiting for the respondent to answer a demand while the one-year period expires.
Assuming truth, opinion, or public interest is automatically sufficient.
Naming everyone who liked or received the post as a respondent.
Ignoring a subpoena and filing nothing by the counter-affidavit date.
Deleting devices, drafts, messages, or account logs after receiving notice of a complaint.
Contacting witnesses to coordinate stories or threatening the other party.
Submitting illegally obtained account data or private communications.
Assuming an appeal from the prosecutor automatically suspends the RTC proceedings.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year deadline is approaching or the discovery date is disputed.
A prosecutor’s subpoena, court order, or warrant has been received.
The account is anonymous and provider data may soon be lost.
A device is being searched, seized, or requested for forensic examination.
The case concerns a journalist, public official, whistleblower, workplace complaint, or privileged report.
Several people controlled the account.
The post has been edited, deleted, reposted, or published in several formats.
The dispute also involves threats, extortion, stalking, doxxing, intimate images, minors, or physical danger.
A separate civil action, injunction, employment case, or administrative complaint is contemplated.
The respondent or relevant computer system is outside the Philippines.

For immediate danger, contact law enforcement or emergency services. Cyber libel should not be used as a substitute for reporting threats, sexual abuse material, identity theft, illegal access, or other conduct governed by different laws.

Frequently asked questions

Can a Facebook comment or group-chat message be cyber libel?

Yes, if it contains a defamatory imputation, identifies the complainant, reaches at least one third person, is malicious under the applicable standard, and is attributable to the respondent. The group’s privacy setting does not by itself defeat publication.

Is a private message to the offended person enough?

Ordinarily not if nobody else received or saw it, because libel requires publication to a third person. Forwarding or copying the message to someone else may change the result.

Can I charge everyone who liked or shared the post?

Not merely for receiving, liking, or reacting to it. Disini protects those acts from cyber-libel aiding liability. A person who authors an additional defamatory caption or comment may face liability for that new content.

Does deleting the post prevent a case?

No. Deletion does not undo a publication that others already saw or preserved. It may, together with a genuine correction or apology, affect malice, damages, or sentencing.

Do I need to send a demand letter first?

No. A demand is not required before filing a criminal cyber-libel complaint and should not be allowed to consume the one-year period. A written demand may have a separate effect on civil prescription.

Can I file if the account is anonymous?

Potentially, but authorship must ultimately be established. Preserve the account identifiers and seek prompt assistance from a cybercrime law-enforcement unit so lawful preservation and warrant procedures can be considered.

Does the one-year period always start on the posting date?

No. Under the 2026 Causing resolution, it begins upon discovery by the offended party, the authorities, or their agents. Discovery is not presumed merely from online publication and must be supported by evidence.

Can the complainant file in any city because the internet is nationwide?

No. The chosen venue must have one of the connections specified by the Rule on Cybercrime Warrants: an element of the offense, part of the computer system used, or the place where damage occurred.

Will an apology automatically dismiss the case?

No. The complainant’s forgiveness or desistance may be considered, but dismissal remains subject to the prosecutor’s or court’s authority.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Cyber-libel outcomes depend heavily on the exact words, audience, authorship evidence, discovery date, venue, documents, and procedural history. Sources and current rules were checked as of August 5, 2026.