Quick answer

Cyber libel is not simply any harsh, embarrassing, or critical online statement. A criminal case generally requires proof that the respondent was the original author of an identifiable, defamatory imputation; published it to at least one third person through a computer system; and acted with the legally required malice.

To file, preserve the online evidence and proof of authorship, identify the correct venue, and submit a sworn complaint-affidavit with supporting evidence to the appropriate city, provincial, regional, or state prosecution office. The NBI Cybercrime Division or PNP Anti-Cybercrime Group may first investigate when the author is unknown or platform and subscriber data are needed.

To defend, do not ignore the prosecutor’s subpoena. Obtain the complete complaint, note the filing deadline, and submit a sworn counter-affidavit addressing authorship, publication, identifiability, defamatory meaning, malice, privilege, truth and proper motive, venue, and prescription. A motion to dismiss is not a substitute for the counter-affidavit.

The criminal offense generally prescribes in one year from discovery of the allegedly defamatory publication by the offended party, authorities, or their agents—not automatically from the date it was posted. The Supreme Court reaffirmed this rule with finality in April 2026 in Causing v. People. Because the discovery date and interruption of prescription can become factual disputes, both sides should preserve evidence of when the post was first found and when the complaint was filed.

What the prosecution must establish

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the law on written libel to unlawful defamatory acts committed through a computer system or similar means. The prosecution must establish:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. Someone other than the person defamed received, read, heard, or viewed it. A private message sent only to the person concerned ordinarily lacks this element, but a message sent to another person, a group chat, a restricted social-media audience, or the public may constitute publication.
Identifiability. The complainant need not always be named, but readers must reasonably be able to identify who was being referred to. Vague criticism of an unidentifiable group may be insufficient.
Malice. Article 354 of the Revised Penal Code generally presumes malice in a defamatory imputation unless good intention and justifiable motive are shown, subject to privileges and constitutional standards. Where the statement concerns a public officer’s official conduct or an appropriate public figure and a matter of public concern, the prosecution must prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false. Whether someone is a public figure, and whether the statement concerned official conduct or public affairs, depends on the circumstances.
Use of a computer system or similar technology. This includes publication through social media, websites, online forums, email, messaging services, or comparable digital means.
Responsibility for the publication. The evidence must connect the respondent to the account and the actual authorship or publication of the statement.

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but declared it unconstitutional as applied to people who merely receive and react to a post. Simple likes, reactions, or shares cannot automatically be prosecuted as aiding or abetting cyber libel. However, a person who adds a new defamatory caption or independently writes and publishes the accusation may be treated as the author of that new material.

Statements that are not automatically cyber libel

An unpleasant statement is not necessarily criminal. Important distinctions include:

Criticism versus factual accusation. Strong criticism, satire, rhetorical exaggeration, and opinion may be protected, particularly on public affairs. Calling something an “opinion” is not conclusive, however, if it reasonably conveys a false, verifiable factual accusation.
Truth with the required purpose. Under Article 361, truth may support acquittal when the matter was also published with good motives and for justifiable ends. Truth alone is not a universal defense. Special limits apply when proving the truth of an imputation involving an act or omission that is not itself a crime.
Private communications made in the performance of a duty. A good-faith communication to the proper person in the performance of a legal, moral, or social duty may be qualifiedly privileged. Excessive circulation or proof of actual malice can defeat the privilege.
Fair and true reports of official proceedings. A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or official proceeding may be privileged. Misquoting, materially distorting the record, or adding malicious accusations can remove the protection.
Lack of authorship. Account ownership by itself may not conclusively prove who made a particular post. Hacking, impersonation, shared access, fabricated screenshots, and unauthorized posting must be assessed through credible technical and contextual evidence.
No identifiable complainant, no third-party publication, or no defamatory meaning. Failure to prove any required element defeats the charge.

Privilege and actual malice are highly dependent on the exact words, complete thread, audience, subject, sources available to the author, and surrounding circumstances. A cropped screenshot rarely provides enough context for a reliable conclusion.

The one-year deadline

The Supreme Court’s current controlling ruling is that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. A public Facebook post does not create an automatic presumption that the complainant discovered it on the posting date.

Under Articles 90 and 91 of the Revised Penal Code:

the period begins when the crime is actually discovered;
the filing of the complaint or information interrupts prescription;
it may run again if proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused; and
the period does not run while the offender is absent from the Philippines.

If prescription is not apparent from the face of the Information, the accused may have to prove the relevant discovery and filing dates. Comments, reactions, messages threatening suit, prior demand letters, reports to authorities, and other conduct showing knowledge of the post can be important.

An independent civil action for defamation is also generally subject to a one-year period under Article 1147 of the Civil Code. The calculation and interaction of criminal and civil remedies should be reviewed promptly. Do not delay filing while waiting for a platform response, apology, or private settlement.

Evidence to preserve immediately

Preserve evidence before requesting deletion or blocking the account. Keep:

full-screen screenshots showing the statement, account name, profile information, date, time, reactions, comments, audience or privacy setting, and visible URL;
the complete URL, post ID, username, account ID, email headers, or message identifiers;
a screen recording showing navigation from the account or page to the post;
the original downloaded files, images, videos, emails, or chat exports—not only edited copies;
the device on which the material was received or viewed;
the complete conversation or thread, including statements before and after the disputed words;
proof of the date of discovery, such as the first message forwarding the post;
affidavits from people who saw the material and understood it to refer to the complainant;
evidence connecting the account to the alleged author;
records showing verification efforts, sources, official documents, or the factual basis available to the author;
hacking alerts, login histories, recovery emails, police reports, and platform reports if authorship is disputed; and
proof of actual harm, such as lost contracts, disciplinary action, customer messages, medical records, or other properly documented consequences.

Do not crop away context, overwrite the original file, add annotations to the only copy, or rely solely on a forwarded screenshot. Electronic evidence must be shown to be authentic, reliable, and accurately reproduced. The Rules on Electronic Evidence and the Revised Rules on Evidence govern the treatment and authentication of electronic records.

Do not hack an account, obtain passwords without authority, impersonate anyone, or secretly access data to “prove” the case. That conduct may create separate criminal and evidentiary problems.

How to file a criminal complaint

1. Confirm the elements and deadline

Write down:

the exact allegedly defamatory words;
the language used and an accurate translation if needed;
who published them;
who viewed or received them;
why readers could identify the complainant;
the computer system or online service used;
the date of publication;
the date and circumstances of discovery; and
the filing date needed to remain within the one-year period.

Criticism that is merely offensive, a dispute supported only by conflicting assertions, or a complaint without admissible proof of authorship may not satisfy the required prosecutorial standard.

2. Identify the proper venue

Cyber-libellous criminal actions belong to a designated cybercrime branch of the Regional Trial Court. Under Section 2.1 of the Rule on Cybercrime Warrants, venue may lie in the province or city:

where the offense or any element occurred;
where any part of the computer system used was situated; or
where any damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. The Supreme Court discussed these rules in Tieng v. People.

Venue should not be based merely on convenience. State in the complaint the facts supporting the selected location, then file with the prosecution office having territorial authority corresponding to the proper court.

3. Seek technical investigation when necessary

The NBI and PNP are the principal law-enforcement authorities under Republic Act No. 10175. An investigation is particularly useful when:

the account is anonymous or fictitious;
subscriber, traffic, or platform data are needed;
hacking or impersonation is alleged;
relevant data may soon be deleted; or
evidence or a platform is located abroad.

A complainant cannot personally compel a service provider to disclose private subscriber information. Law enforcement may seek preservation orders and appropriate cybercrime warrants. Under Section 13 of Republic Act No. 10175, subscriber information and traffic data are subject to statutory preservation periods, while specified content data may be preserved after a law-enforcement order. Prompt reporting matters.

4. Prepare the complaint-affidavit

The sworn complaint should present facts rather than conclusions. It should:

identify the complainant and respondent, including available addresses;
reproduce the exact words complained of;
explain the complete context and audience;
identify the post, account, device, platform, and publication date;
explain how the respondent is connected to the account and post;
identify third parties who saw the publication;
explain why the complainant was identifiable;
state the discovery date and facts supporting venue;
address apparent privileges or public-interest issues honestly; and
list and authenticate the attached evidence.

Attach witness affidavits and properly marked supporting documents. Follow the chosen prosecution office’s current requirements for copies, documentary formatting, proof of service, fees, and electronic or physical filing. E-filing and virtual proceedings are recognized alternatives under the current DOJ rules, but use only the official channel and instructions of the particular prosecution office.

5. Participate in preliminary investigation

The prosecutor first evaluates whether the complaint and evidence justify further proceedings. If so, the respondent receives a subpoena with the complaint and attachments and is directed to submit a counter-affidavit.

The 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings require prima facie evidence with reasonable certainty of conviction—evidence that is admissible, credible, capable of preservation, and sufficient, if uncontroverted, to establish every element and the responsible person. The Supreme Court upheld those rules in Meking v. Remulla.

The prosecutor may require reply or rejoinder affidavits, additional evidence, or a clarificatory hearing. If the required standard is met, an Information is filed in the proper RTC. The judge then independently determines probable cause for any arrest warrant. Guilt at trial must still be proven beyond reasonable doubt.

6. Decide how to pursue civil liability

Civil liability arising from the alleged offense is generally deemed included when the criminal action is instituted unless it is waived, reserved for separate filing, or was filed earlier. Independent civil remedies for defamation may also be available, but double recovery is prohibited. A lawyer should determine the appropriate remedy before the applicable one-year period expires.

How to defend the complaint

1. Act from the date the subpoena is received

Keep the envelope, email headers, receiving stamp, and all attachments. The subpoena should provide the scheduled hearing and filing date and ordinarily must allow at least ten days from receipt for preparation. Follow the date stated in the subpoena unless counsel obtains a valid written extension.

Extensions are exceptional under the current DOJ rules and ordinarily require a concrete interest-of-justice ground, such as obtaining counsel, examining voluminous records, or addressing genuinely technical issues. Never assume that an informal request has extended the deadline.

2. Obtain the complete record

Confirm that you received:

the complaint-affidavit;
every supporting affidavit;
all screenshots, files, and annexes;
the prosecutor’s docket number;
the exact offense alleged; and
the evidence offered to connect you to the account or publication.

Request access to omitted or voluminous evidence through the prosecutor. Do not respond publicly to the complainant or republish the accusation as part of an online “defense.”

3. Preserve your own evidence

Before deleting or editing anything, preserve the account data, full thread, drafts, source documents, login history, messages, and original files. Ask counsel whether the harmful content should then be taken down. Deletion does not erase a completed offense, but prompt removal and a sincere correction or apology may become relevant to harm, civil resolution, or sentencing.

4. Build the counter-affidavit around the required elements

Respond point by point and support each material assertion. Possible defenses, when supported by the facts, include:

you did not author or publish the material;
the screenshot is fabricated, incomplete, altered, or unauthenticated;
the account was hacked, impersonated, or accessible to others;
no third person received the communication;
the complainant was not reasonably identifiable;
the words, read in full context, were not defamatory;
the statement was a protected opinion rather than a false factual accusation;
the communication was privileged;
the report was fair, true, made in good faith, and without improper additions;
the facts were true and published with good motives and for justifiable ends;
the subject was a public officer or public figure and actual malice cannot be proved;
venue is unsupported;
the complaint was filed after prescription; or
the complainant’s evidence cannot meet the DOJ’s current reasonable-certainty-of-conviction standard.

Provide the complete factual basis available when the statement was published. Later-discovered evidence may prove truth, but contemporaneous records of verification, sources, requests for comment, corrections, and good-faith purpose can be especially important to malice.

5. File and serve properly

The counter-affidavit must be sworn and accompanied by witness affidavits and supporting evidence. File the required copies, furnish the complainant as directed, and retain stamped or electronic proof of filing and service. Failure to submit a counter-affidavit may cause the prosecutor to resolve the complaint using only the complainant’s evidence.

6. Monitor the resolution and court filings

An aggrieved party may file a motion for reconsideration of a regular preliminary-investigation resolution within 15 days from receipt under DOJ Department Circular No. 15. A petition for review may also be available, but its proper reviewing authority, requirements, and effect depend on the issuing office and whether an Information has already been filed. A petition for review does not by itself guarantee that court proceedings will stop.

Once an Information is filed, defenses such as lack of jurisdiction, prescription apparent from the charge, failure to allege an offense, or double jeopardy may require a timely court motion—often before arraignment. Have counsel assess these immediately.

Possible penalties and consequences

Cyber libel carries a penalty one degree higher than traditional written libel. Depending on the circumstances, a conviction may result in:

imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period—generally four years, two months and one day to eight years;
a fine from ₱40,000 to ₱1,500,000; or
both imprisonment and a fine, plus civil liability.

In People v. Soliman, the Supreme Court held that a court may impose a fine alone instead of imprisonment in a proper case. Fine-only treatment is discretionary, not an entitlement, and imprisonment remains legally available.

The same online publication cannot be punished once as traditional libel and again as cyber libel. Disini held that charging both for the same offense would violate the prohibition against double jeopardy.

Common mistakes

Waiting for the post to be deleted before preserving it.
Counting prescription only from the posting date without investigating discovery.
Filing in the complainant’s preferred city without facts supporting cybercrime venue.
Submitting cropped screenshots with no URL, account details, context, or authenticating witness.
Assuming that account ownership conclusively proves authorship.
Treating truth alone as an automatic defense.
Assuming every “opinion” is protected even when it implies a false factual accusation.
Reposting the disputed accusation while demanding sympathy online.
Threatening publication or criminal prosecution solely to obtain money.
Ignoring a prosecutor’s subpoena or filing a bare motion to dismiss instead of a counter-affidavit.
Contacting witnesses to pressure them, deleting account records, or fabricating supporting material.
Assuming an affidavit of desistance automatically terminates the criminal case. The State controls the prosecution, although a lawful settlement may affect civil issues and the practical course of the case.
Treating a platform report, barangay complaint, police blotter, or demand letter as necessarily equivalent to filing the criminal complaint with the proper prosecutorial authority.

When legal help is urgent

Seek a Philippine lawyer immediately when:

the one-year prescriptive period is close;
a prosecutor’s subpoena or resolution has been received;
an Information or arrest warrant may already have been issued;
the author is anonymous and provider data may disappear;
the case involves a journalist, public officer, election issue, or matter of public concern;
the publication was edited, reposted, or made across several platforms;
evidence, parties, or platforms are outside the Philippines;
hacking, identity theft, intimate images, threats, stalking, or doxxing are also involved; or
the complainant seeks substantial damages or the publication has caused employment, business, or safety consequences.

Cyber libel is bailable before conviction, but the amount and procedure are determined by the court. Do not evade a warrant. Counsel can verify the case, arrange an orderly response or voluntary surrender where appropriate, and assist with bail.

Those unable to retain private counsel may inquire with the Public Attorney’s Office or the local Integrated Bar of the Philippines legal-aid office, subject to eligibility and case-merit requirements.

Frequently asked questions

Is a demand letter required before filing?

No. A demand for deletion, correction, or apology may be useful, but it is not a universal prerequisite to a criminal complaint and does not suspend the one-year deadline.

Is a public post required?

No. Publication to one third person may be enough. A group chat, restricted audience, email copied to others, or private message sent to someone other than the complainant may satisfy publication.

Can a business file a cyber-libel complaint?

A juridical person may be defamed if the imputation tends to discredit it. The complaint must still prove identifiability, publication, defamatory meaning, malice, authorship, and the online medium.

Are likes and shares criminal?

Mere receipt and reaction—including simple likes, comments, or shares—cannot automatically be punished as aiding or abetting cyber libel under Disini. A person who creates and publishes new defamatory wording may face liability for that independent content.

Does deleting the post end the case?

No. Publication may already have completed the offense. Preserve the evidence first. Deletion, correction, or apology may nevertheless reduce harm and may be relevant to the eventual disposition or penalty.

Can a true accusation still be libelous?

Potentially. Article 361 generally requires both truth and publication with good motives and for justifiable ends. The nature of the imputation and whether it concerns a government employee’s official duties also matter.

Does a complainant automatically win after the prosecutor files an Information?

No. The prosecutor’s decision concerns whether the case should proceed. The court independently evaluates probable cause for an arrest warrant, and the prosecution must prove guilt beyond reasonable doubt at trial.

Can a case be dismissed because it was filed too late?

Yes, if prescription is established. Cyber libel prescribes in one year from discovery, subject to interruption and the other rules in Article 91. If the relevant dates are disputed, evidence and a hearing may be necessary.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case. Outcomes depend on the exact words, complete context, evidence, dates, venue, and procedural history. Law and official procedures were checked against primary sources current as of August 24, 2026.