Quick answer

To file a cyber libel case in the Philippines, preserve the online material and proof of who authored it, then file a sworn complaint-affidavit and supporting evidence with the proper City or Provincial Prosecutor’s Office. If the author is anonymous or technical evidence is needed, seek assistance from the NBI Cybercrime Division or the PNP Anti-Cybercrime Group—but do not assume that an investigative report, platform complaint, or demand letter stops prescription.

To defend a case, do not ignore a subpoena. Obtain the complete complaint, preserve your account and source records, and submit a detailed counter-affidavit by the stated deadline—normally at least 10 calendar days after receiving the subpoena and complete attachments. Challenge every unproven element, including authorship, publication to another person, identifiability, defamatory meaning, malice, venue, and timeliness.

The most urgent rule is the deadline: the Supreme Court has definitively held that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents. Online publication does not automatically create presumed or constructive notice. Filing the proper complaint or information interrupts prescription. The Court reaffirmed this rule with finality in April 2026 in Causing v. People.

What qualifies as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the law on written libel to defamatory material published through a computer system or similar information and communications technology.

The prosecution must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person to contempt.
Publication. At least one person other than the person defamed received, read, heard, or saw the imputation. A private message sent only to the person criticized ordinarily lacks this element; a group chat, public post, email copied to others, video, blog, or message sent to a third person may satisfy it.
Identifiability. The complainant must be named or reasonably identifiable from the words, images, context, or surrounding facts. Naming a broad group without identifying a particular member may be insufficient.
Malice. The applicable kind and required proof of malice depend on whether the statement is privileged and whether it concerns a private person, public official, public figure, or matter of public interest.
Use of a computer system or ICT. Examples include social-media posts and comments, online articles, websites, email, digitally transmitted images, and messages sent through online platforms.
Authorship or responsibility. It is not enough to show that a post came from an account carrying the respondent’s name. The evidence must connect the respondent to the account and the particular publication.

Words must be read as a whole and in their ordinary context. Rudeness, criticism, satire, hyperbole, or an insult is not automatically criminal libel. The question is whether the communication reasonably conveys a defamatory assertion about an identifiable person. Calling something an “opinion” is likewise not conclusive if it implies undisclosed or knowingly false facts.

General rule on malice—and the important exceptions

Under Article 354 of the Revised Penal Code, a defamatory imputation is generally presumed malicious even if true, unless good intention and justifiable motive are shown or the communication is privileged.

That general rule is subject to important constitutional and jurisprudential limits.

Statements about public officials, public figures, and public affairs

When the complainant is a public official or public figure and the challenged statement concerns public conduct or a matter of legitimate public interest, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Recklessness requires more than ordinary error, poor research, or even serious negligence; the evidence must support a high awareness of probable falsity or serious doubts about the truth. The prosecution carries this burden, as explained in Daquer v. People and Disini v. Secretary of Justice.

This protection leaves substantial room for criticism of government and public affairs. It does not protect a person who knowingly fabricates accusations or deliberately publishes while seriously doubting their truth.

Qualifiedly privileged communications

Malice is not presumed when a communication is qualifiedly privileged. Examples include:

A private communication made in the performance of a legal, moral, or social duty, directed to a person or authority with a corresponding interest or power to act.
A fair and true report, made in good faith and without added defamatory comments, of a non-confidential judicial, legislative, or other official proceeding.
Fair comment on matters of public interest recognized by Supreme Court jurisprudence.

Privilege is fact-sensitive. Broadcasting an accusation to an unnecessarily large audience, adding unsupported personal attacks, or communicating to people with no legitimate interest can defeat the claim of privilege. Qualified privilege may also be overcome by proof of actual malice.

Some communications—such as relevant statements made in judicial proceedings or constitutionally protected legislative speech—may receive absolute privilege. Their precise scope should be evaluated by counsel because relevance, context, and the speaker’s official function matter.

Truth is not automatically a complete defense

Article 361 permits proof of truth in a criminal libel case, but the ordinary defense requires both:

Proof that the material imputation is true; and
Proof that it was published with good motives and for justifiable ends.

The statute restricts proof of a non-criminal act or omission unless the imputation concerns a government employee and facts related to official duties. Public-interest and actual-malice doctrines may separately affect the analysis. A respondent should therefore preserve not only documents supporting truth but also evidence of verification, purpose, intended audience, and good faith.

Who may be charged?

Cyber libel principally applies to the author of the online defamatory publication. In Disini, the Supreme Court rejected criminal liability under the cybercrime law for people who merely receive a libelous post and react to it.

A person who adds a new defamatory accusation in a comment, caption, quote-post, edited video, or accompanying message may become the author of that new publication. A bare “like,” emoji reaction, or passive receipt is materially different from writing a new accusation.

Authorship can be established by direct or circumstantial evidence, including:

An admission of account ownership, access, or authorship;
A witness who saw the person use the account or compose the post;
Details in the communication known only to the suspected author or a small group;
Distinctive language or writing patterns;
Connections to the person’s email address, mobile number, other accounts, device, location, or provider records;
Conduct consistent with the message; and
Other evidence that, taken together, proves access or authorship.

These guideposts were stated by the Supreme Court in XXX v. People, G.R. No. 274842. A profile name and photograph are relevant but may not, by themselves, conclusively prove who wrote a particular post.

The one-year deadline

Cyber libel prescribes in one year from actual discovery by the offended party, the authorities, or their agents. Publication and discovery may occur on the same date, but they are not legally presumed to coincide.

Evidence of discovery can include:

The date someone sent the post to the complainant;
The complainant’s first screenshot or account download;
A reply, reaction, comment, or direct confrontation;
A demand, threat of legal action, or platform report;
A report to an employer, lawyer, police officer, or government agency; and
Earlier messages showing that the complainant or an agent already knew about the material.

A public privacy setting does not automatically prove that the complainant saw a post when it was uploaded. Conversely, a complainant cannot safely choose an artificial discovery date if earlier conduct proves knowledge.

The formal filing of the complaint or information interrupts prescription. A private demand, settlement discussion, takedown request, or platform report is not a substitute for timely filing with the proper prosecution office. If law enforcement is still investigating as the one-year date approaches, obtain immediate legal advice about filing a sufficiently supported prosecutor’s complaint before time expires.

Prescription is often a factual defense. Unless it is apparent from the information, the accused may need evidence proving an earlier discovery date. The defense is not necessarily lost by arraignment, but it should be raised as early and precisely as possible.

A separate civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. The starting point, interruption, and interaction with the criminal case can depend on the particular cause of action and procedural choices.

How to file a cyber libel complaint

1. Preserve the evidence before requesting deletion

Capture the material while it remains available. Do not edit the files or rely only on a cropped screenshot.

Preserve:

The complete post, article, video, caption, comment thread, or conversation;
The full URL, account name, profile URL, unique account or post identifier if visible, and platform;
Date and time displayed, including the device’s time zone;
Privacy or audience setting, reactions, shares, comments, and view information;
A screen recording showing navigation from the profile or page to the specific publication;
Original downloaded photos, videos, audio, email, or account data;
The device on which the material was received or first viewed;
The identity and contact information of people who saw or received it;
Proof of the date of discovery;
Documents showing falsity, reputational harm, lost work or business, medical treatment, or other claimed damage; and
Any communication connecting the suspected author to the account.

Keep an untouched copy and a working copy. Record who collected each item, when, from what device, and how it was stored. Electronic documents must be authenticated; a printout is not automatically sufficient merely because it came from a computer. The governing standards appear in the Rules on Electronic Evidence.

Do not hack an account, impersonate another person, secretly intercept communications, or obtain evidence through unlawful access.

2. Identify the proper place to file

Cybercrime cases fall within the jurisdiction of a designated Regional Trial Court cybercrime court. Under the Rule on Cybercrime Warrants, venue may be based on the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of other courts. The Supreme Court discussed this rule in Tieng v. Judge Palacio-Alaras.

Ordinarily, the complaint-affidavit is first filed with the City or Provincial Prosecutor’s Office corresponding to a legally supportable venue. State the concrete connection—not merely that the post could be opened anywhere in the Philippines. Venue allegations should identify where the author acted, where the relevant device or system was situated, or where specific damage occurred.

3. Prepare a complete complaint-affidavit

The complaint-affidavit should be sworn before a prosecutor or other official authorized to administer oaths, or before a notary when permitted. It should clearly state:

The complainant’s identity and contact details;
The respondent’s known identity, address, account details, and other identifying information;
The exact words, images, or statements complained of, with an accurate translation where necessary;
Why the statement is defamatory and how the complainant is identifiable;
When and how it was published to another person;
When, where, and how it was discovered;
Facts linking the respondent to the account and publication;
Facts supporting malice or actual malice, when required;
Why the selected prosecution office and eventual court have proper venue;
The harm caused; and
A chronological list of attached evidence and witness affidavits.

Avoid conclusions such as “the respondent committed cyber libel” without the underlying facts. Each element should have corresponding admissible evidence.

4. Use investigators when identity or platform records are needed

The NBI and PNP are the law-enforcement agencies specifically tasked by RA 10175 with cybercrime investigations. The NBI Cybercrime Division’s citizen guidance provides for a complaint sheet, interview, sworn statements, submission of supporting documents, and examination of a relevant device.

Law enforcement can seek preservation and, with the necessary warrant, disclosure of subscriber, traffic, or other computer data. RA 10175 generally requires service providers to preserve traffic data and subscriber information for at least six months from the transaction and content data for six months from a law-enforcement preservation order, subject to a one-time six-month extension. Early action matters when an account is anonymous, a post is disappearing, or provider records are needed.

An NBI or PNP investigation can strengthen the case, but do not assume that reporting to an investigator alone interrupts the one-year period. Confirm with counsel whether a formal complaint must already be filed with the proper prosecutor.

5. Participate in preliminary investigation

Cyber libel is subject to regular preliminary investigation because its prescribed imprisonment range extends beyond six years. Under DOJ Department Circular No. 15, series of 2024—the 2024 DOJ-NPS Rules—the prosecutor applies the standard of prima facie evidence with reasonable certainty of conviction. The Supreme Court upheld these rules in Meking v. Remulla.

The present administrative timetable generally provides:

Initial prosecutor review and issuance of subpoena, when warranted, within five calendar days from receipt of the records;
A preliminary-investigation hearing within 30 days from receipt of the case records;
At least 10 calendar days for the respondent to submit a counter-affidavit after receiving the complete papers;
Resolution within 60 calendar days from receipt of the complete case record, with a possible additional 30 days for a complex case; and
Review and approval by the head of the prosecution office before promulgation.

These are case-processing periods; a missed internal target does not automatically produce a dismissal or conviction.

If the complaint is dismissed or an information is recommended, an aggrieved party may generally move for reconsideration within 15 days from receipt of the resolution. A further petition for review is governed by DOJ rules and may require a separate motion to suspend court proceedings. Seek counsel immediately because filing a review does not by itself guarantee that an already-filed court case will stop.

How to defend against a cyber libel complaint

Act immediately upon receiving a subpoena

Record the date and manner of service. Confirm that the subpoena includes the complaint-affidavit and attachments. The response period is short and is normally counted in calendar days.

Do not answer through an angry public post, contact witnesses to influence their testimony, delete account data, or alter the challenged material. Preserve it privately and discuss any public correction or apology with counsel.

Submit evidence, not a bare denial

A counter-affidavit should respond paragraph by paragraph and attach supporting documents and witness affidavits. Depending on the facts, address:

Authorship: The account was impersonated, shared, compromised, or operated by someone else; or the evidence does not connect you to the specific post.
Publication: No third person received the communication.
Identifiability: The complainant was not named or reasonably identifiable.
Defamatory meaning: The words, read in full context, were not factual defamatory imputations.
Malice: The publication was made in good faith, after verification, or without knowledge of falsity or serious doubts about the truth.
Public-official or public-interest speech: The prosecution cannot prove actual malice.
Privilege: The communication was properly limited to someone with a corresponding duty or interest, was a fair report of official proceedings, or was protected fair comment.
Truth and justification: Reliable evidence establishes truth, good motives, and justifiable ends.
Prescription: Evidence proves that the complainant, an agent, or authorities discovered the material more than one year before formal filing.
Venue: The selected place has no adequately alleged or proven connection to an element, computer system, or damage.
Authentication: Screenshots, translations, account records, or alleged electronic documents lack integrity, completeness, reliability, or a competent authenticating witness.
Double jeopardy or duplicate charging: Identical material should not be punished separately as both traditional libel and cyber libel. Disini recognized that they are the same offense when based on the same publication.

Preserve drafts, source documents, interview notes, public records, correspondence with editors, fact-checking efforts, account security alerts, device logs, correction history, and any evidence of the complainant’s earlier knowledge.

If an information has already been filed in court

The RTC independently determines whether judicial probable cause exists and may issue a warrant. Cyber libel is bailable as a matter of right before conviction because it is not punishable by death, reclusion perpetua, or life imprisonment. The court sets the bail amount and conditions.

Counsel should promptly evaluate:

A motion to quash, ordinarily before plea;
Defects in the information, jurisdiction, and venue;
Prescription or extinguishment of criminal liability;
A request for a bill of particulars;
Inspection of material prosecution evidence;
Exclusion of illegally obtained or unauthenticated evidence;
A demurrer to evidence after the prosecution rests; and
Preservation of objections for appeal.

Do not enter a plea without understanding its consequences. The accused has the right to counsel, to remain silent, to confront witnesses, to compulsory process, and to be presumed innocent until guilt is proved beyond reasonable doubt.

After an adverse judgment or appealable final order, the ordinary criminal appeal period is 15 days from promulgation or notice. A timely motion for new trial or reconsideration suspends the running of that period until notice of its denial. Missing the appeal deadline can make a conviction final.

Possible penalties and civil liability

For conduct governed by the fines introduced through RA 10951, cyber libel may be punished by:

Imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period—approximately four years, two months and one day to eight years;
A fine from ₱40,000 to ₱1,500,000; or
Both imprisonment and fine.

Civil damages may be imposed in addition.

The Supreme Court held in De Lima v. Guerrero/Soliman, G.R. No. 256700 that a court may impose a fine alone in an appropriate online-libel case. The judiciary’s preference for considering a fine does not abolish imprisonment; the sentencing court retains discretion based on the circumstances.

The law in force when the material was published, constitutional rules against unfavorable retroactivity, mitigating or aggravating circumstances, and the exact offense charged can affect the final penalty.

Common mistakes

Waiting for a platform to respond while the one-year criminal period runs.
Treating a demand letter or settlement negotiation as a formal case filing.
Saving only a cropped screenshot with no URL, date, account context, or witness.
Assuming a name and profile picture conclusively prove authorship.
Filing wherever the post can be accessed instead of establishing proper venue.
Treating every insult, criticism, bad review, or embarrassing statement as criminal libel.
Assuming truth alone always guarantees acquittal.
Ignoring actual-malice requirements in public-official or public-interest cases.
Charging everyone who liked, received, or reacted to a post.
Deleting or editing material after learning of a complaint.
Ignoring a subpoena or filing an unsupported one-page denial.
Repeating the accusation in a demand letter, press statement, or retaliatory post.
Assuming an apology, deletion, settlement, or affidavit of desistance automatically ends the public criminal action.
Obtaining evidence by hacking, unlawful interception, impersonation, or unauthorized access.

When legal help is urgent

Seek a criminal lawyer immediately when:

The one-year anniversary of discovery is approaching;
A subpoena gives a counter-affidavit deadline;
A warrant, arrest, search, or device examination is threatened or underway;
An information has been filed or arraignment scheduled;
The author is anonymous and provider data may disappear;
The case involves journalism, whistleblowing, official misconduct, elections, or another major public-interest issue;
The publication contains threats, doxxing, intimate images, sexual harassment, or material involving a child, which may trigger other laws;
The post or author is abroad;
Several people had access to the account; or
A conviction or appeal deadline is involved.

Qualified persons may seek assistance from the Public Attorney’s Office. The Supreme Court also lists public legal-assistance options in its legal-assistance guide, while the IBP National Center for Legal Aid may assist eligible applicants.

Frequently asked questions

Can a Facebook, TikTok, YouTube, X, blog, or group-chat post be cyber libel?

Yes, if all elements are established, including publication to a third person, identifiability, defamatory meaning, malice under the applicable standard, authorship, and use of a computer system.

Is a private message cyber libel?

A message sent only to the person criticized ordinarily lacks publication. If it was sent to another person, copied to others, or posted in a group, publication may exist.

Is sharing or liking a libelous post automatically criminal?

No. Mere receipt or reaction is not enough under Disini. A person who adds a new defamatory assertion may be treated as the author of that new publication.

Can a complaint be filed anywhere the post is visible?

No. Accessibility everywhere is not unlimited venue. The chosen province or city must have a legally supportable connection to an element, the computer system used, or the damage caused.

When does the one-year period begin?

From actual discovery by the offended party, the authorities, or their agents—not automatically from upload. Publication and discovery may nevertheless be the same date if the evidence shows immediate knowledge.

Does deleting the post end liability?

No. Deletion does not erase a completed publication. It may affect continuing harm or sentencing considerations, but preserved copies and provider records may remain available.

Does an affidavit of desistance automatically dismiss the case?

No. Once the public criminal action is underway, the prosecutor or court is not automatically bound by the complainant’s change of mind. Desistance may affect evidence or civil claims, but it does not itself erase the alleged offense.

May I criticize a government official online?

Yes. Speech on public affairs receives strong constitutional protection, and actual malice must be proved in an appropriate public-official or public-figure case. That protection does not extend to knowingly false factual accusations or publication made while seriously doubting their truth.

Is cyber libel punishable only by imprisonment?

No. The court may impose imprisonment, a fine, or both. A fine alone is legally possible but is not guaranteed.

Are screenshots enough?

They may be useful, but their weight depends on completeness, authenticity, context, attribution, and supporting testimony. Preserve the original device, URLs, full conversation, account data, and witnesses whenever possible.

This article provides general Philippine legal information, not advice for a particular case or substitute for reviewing the complaint, publication, and evidence with counsel. Laws and primary authorities were checked through 25 July 2026.