Quick answer

Posting someone’s personal information online without consent is not automatically illegal, but it may violate Philippine law depending on the information, who posted it, why it was posted, how it was obtained, the audience, and the harm caused.

Possible remedies include:

demanding removal, blocking, correction, or de-indexing;
reporting the post to the platform or website;
filing a complaint with the National Privacy Commission (NPC);
seeking damages and an injunction in court;
reporting a crime to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or a prosecutor; and
using special remedies for intimate images, gender-based harassment, identity theft, threats, defamation, or content involving a child.

Act quickly, but preserve the evidence before asking anyone to delete it.

Lack of consent is important—but it is not the only legal test

The Data Privacy Act of 2012 covers the collection, use, disclosure, storage, and other processing of information that identifies or can reasonably identify an individual.

Consent is one lawful basis for processing ordinary personal information. It is not the only one. Processing may also be lawful when necessary for a contract, legal obligation, vital interest, public-authority function, or legitimate interest that is not overridden by the person’s fundamental rights.

Sensitive personal information—such as health, education, sexual life, alleged offenses, government-issued identifiers, and certain political, religious, or personal-status information—receives stronger protection and may be processed only under the narrower grounds in Section 13 of the Act.

Even when processing has a lawful basis, it must still comply with transparency, legitimate purpose, and proportionality. Publishing a full address, identification document, medical record, telephone number, or relatives’ details may be excessive even if some disclosure was justified.

Important limits and exceptions

A successful claim does not follow merely because the person did not agree to the post.

An individual handling information solely in connection with personal, family, or household affairs is excluded from the Act’s definition of a personal information controller. A business, employer, school, lender, association, professional, government office, or person acting beyond purely household affairs is more likely to fall within the Act.
The Act contains exclusions and special rules for matters such as journalism, artistic or literary work, research, legal proceedings, and official investigations.
Freedom of speech, freedom of the press, public interest, and the rights of public figures may outweigh a removal request in an appropriate case.
Information previously made public does not automatically lose all protection. The NPC expressly recognizes that publicly available online data may still be the subject of an erasure request, including a request to remove or de-list search results.
Privacy expectations depend on the facts. Audience restrictions, privacy settings, how the information was obtained, and whether it was intended for a limited group can matter. The Supreme Court discussed these considerations in Vivares v. St. Theresa’s College.

Match the conduct to the possible remedy

What was posted or done	Laws or remedies that may apply
A company, school, employer, lender, professional, association, or government office published personal data without a sufficient basis	Data Privacy Act; NPC complaint; erasure, correction, blocking, indemnity, or enforcement order
A private person exposed or interfered with another’s private or family life	Articles 19, 20, 21, and 26 of the Civil Code; damages, prevention, or other court relief
Intimate or sexual images or recordings were shared	Anti-Photo and Video Voyeurism Act; Safe Spaces Act; Data Privacy Act; immediate law-enforcement and platform reporting
False factual accusations damaged a person’s reputation	Cyberlibel, if all criminal elements are present; an independent civil action for defamation or damages
Someone used another person’s name, account, photograph, or identifying data to impersonate or defraud	Computer-related identity theft, fraud, Data Privacy Act violations, or related offenses
Personal data was posted as part of gender-based intimidation, stalking, sexual harassment, or reputational harm	Safe Spaces Act, particularly Sections 12 to 14
The post included threats, extortion, live location, or information intended to facilitate physical harm	Applicable crimes under the Revised Penal Code and cybercrime laws; urgent police assistance and possible protective relief
Sexual content involves a child	Republic Act No. 11930 and other child-protection laws; do not download, forward, or circulate the material except as lawfully directed by authorities

These laws can overlap, but each has separate elements. A humiliating post is not necessarily cyberlibel; a truthful post may still raise privacy or Civil Code issues; and “doxxing” is not a single stand-alone offense under every circumstance.

What to do immediately

1. Address any immediate danger

Go directly to law enforcement if the post reveals a home address, real-time location, school, workplace, identification documents, financial credentials, or information that could facilitate stalking or violence.

Do the same if there are threats, extortion, intimate content, account takeover, impersonation, or material involving a child. Do not negotiate privately with a dangerous or coercive poster.

Change compromised passwords, enable multi-factor authentication, notify the relevant bank or government agency, and warn trusted family members or workplace security when necessary.

2. Preserve the evidence before seeking deletion

Capture enough information to identify the content and establish when, where, and by whom it was posted:

full-page screenshots showing the post, account name, date, time, reactions, captions, and surrounding context;
the exact URL of the post, profile, page, group, website, or search result;
screen recordings showing how the content is reached;
the account’s username, numeric ID if visible, profile URL, and identifying details;
copies of messages, emails, notifications, and prior demands;
the original files, not only cropped or edited copies;
file metadata and downloaded account data, where lawfully available;
names of people who saw the post and can later execute affidavits;
proof of consequences, such as fraudulent transactions, threats, workplace action, medical expenses, counseling records, or lost income; and
a dated chronology stating when the post was discovered and what happened afterward.

Keep a working copy and an untouched backup. Do not annotate or alter the only copy. Philippine rules require electronic evidence to be authenticated, so the person who captured or personally saw it should be able to explain how it was obtained. See the Supreme Court’s Rules on Electronic Evidence.

For content likely to disappear, ask the PNP, NBI, DOJ Office of Cybercrime, or counsel promptly whether a formal preservation request or order should be pursued. A personal screenshot may not contain subscriber information or server records needed to identify an anonymous account.

3. Report the content to the platform

Use the platform’s most specific reporting category: privacy violation, disclosure of personal information, impersonation, intimate-image abuse, threat, harassment, or child safety.

List every relevant URL. A report against only the profile may leave copies, reposts, cached pages, or search results online. Save the report number, confirmation email, and platform response.

A platform report is practical but is not the same as an NPC or court order. Removal may depend on the platform’s rules, the governing law, the evidence submitted, and the platform’s ability to locate the content.

4. Send a focused written demand

When safe, write to the uploader and to the organization’s data protection officer or responsible office. The request should:

identify the exact content and URLs;
identify the personal data involved;
explain why the processing is unlawful, inaccurate, excessive, unauthorized, or no longer necessary;
request removal, blocking, correction, or destruction;
request that further sharing stop;
ask that prior recipients or relevant third-party indexes be notified, where applicable;
request de-indexing of search results when appropriate;
ask for the source, purpose, recipients, and lawful basis of the processing;
request written confirmation of the action taken; and
preserve proof that the request was received.

Do not include more sensitive data than necessary. Redact unrelated information from identification documents used to verify identity.

The NPC’s guidance on erasure or blocking recognizes removal where data is unlawfully obtained, used for an unauthorized purpose, no longer necessary, inaccurate, or otherwise unlawfully processed. A controller may refuse where continued processing remains necessary for a legal obligation, legal claim, legitimate business purpose, or overriding public interest.

Filing a complaint with the National Privacy Commission

An NPC complaint is appropriate when the facts involve personal-data processing covered by the Data Privacy Act, its implementing rules, or NPC issuances.

Exhaustion requirement

Under the 2021 NPC Rules of Procedure, as amended, the complainant must ordinarily first inform the personal information controller, processor, or concerned entity in writing and allow it to act.

The NPC may give the complaint due course when the respondent did not take timely or appropriate action or did not respond within 15 calendar days from receipt of the written notice.

The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent or mitigate, the absence of a plain and adequate remedy from the respondent, or patently illegal action. The waiver is discretionary and must be supported by allegations and proof.

What the complaint generally requires

The complaint should be a notarized complaint-assisted form or a verified complaint. It should include:

the complainant’s and respondent’s identities and contact information, as far as known;
a clear narration of material facts;
the specific violations and relief requested;
documentary evidence and witness affidavits;
all correspondence with the respondent;
proof of the respondent’s action or failure to act; and
a sworn certification against forum shopping.

If the respondent’s identity is unknown, state the circumstances and available information that may lead to identification. A parent representing a minor may submit the child’s birth certificate as proof of the relationship; other representatives may need the authorization required by the amended rules.

Complaints may be filed at an NPC office personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. Check the NPC’s current complaint page and forms before filing. Filing fees apply unless an exemption or waiver is available, including for a qualified indigent complainant.

Possible NPC relief

Depending on the evidence and legal issues, the NPC may order compliance, award indemnity under applicable Civil Code principles, impose a permanent ban on processing, impose administrative fines, compel appropriate action, or recommend criminal prosecution to the Department of Justice.

A complainant may move for a temporary ban on processing while the case is pending. This is not automatic: the amended rules require sufficient facts, a summary hearing or authorized alternative submission, and ordinarily a bond fixed by the investigating officer.

Civil remedies in court

Articles 19 to 21 of the Civil Code require people to act with justice, honesty, and good faith and provide compensation for unlawful or willfully harmful conduct.

Article 26 requires respect for another person’s dignity, personality, privacy, and peace of mind. It makes prying into privacy, disturbing private or family life, and similar conduct actionable for damages, prevention, and other relief, even when the act is not criminal.

Depending on the case, a lawyer may seek:

actual or compensatory damages supported by proof;
moral damages;
exemplary damages where legally justified;
an injunction requiring conduct to stop or preventing further disclosure; and
other appropriate relief.

A temporary restraining order or preliminary injunction is discretionary. The applicant must satisfy the applicable procedural and evidentiary requirements, and a bond may be required. Courts must also consider freedom of expression, public interest, prior-restraint concerns, and whether the requested order is specific and proportionate.

Prescription depends on the cause of action. Under Articles 1146 and 1147 of the Civil Code, an action for injury to rights or quasi-delict generally must be filed within four years, while an action for defamation must be filed within one year. The correct classification and starting date can be disputed, so do not wait for the outer deadline.

When the post may be a crime

Data Privacy Act offenses

The Data Privacy Act contains separate offenses for unauthorized processing, processing for unauthorized purposes, malicious disclosure, unauthorized disclosure, intentional breach, and related conduct.

For example, unauthorized processing of ordinary personal information is punishable by imprisonment of one to three years and a fine of ₱500,000 to ₱2 million. Unauthorized processing of sensitive personal information carries three to six years and a fine of ₱500,000 to ₱4 million.

These penalties do not apply simply because consent was absent. Prosecutors must establish the elements of the particular offense, including the lack of authority under the Act or another law.

Intimate images and recordings

The Anti-Photo and Video Voyeurism Act of 2009 prohibits specified acts involving images of sexual activity or private areas taken under circumstances involving a reasonable expectation of privacy. It also prohibits copying, distributing, publishing, broadcasting, showing, or exhibiting covered recordings without the required written consent.

Consent to the original recording does not by itself authorize later copying or publication. A violation is punishable by imprisonment of three to seven years, a fine of ₱100,000 to ₱500,000, or both, at the court’s discretion.

Do not repost an intimate image to denounce it. Give evidence securely to counsel, the platform, or authorities.

Gender-based online sexual harassment

Sections 12 to 14 of the Safe Spaces Act cover qualifying online conduct that terrorizes, intimidates, or is likely to cause mental, emotional, or psychological distress or fear for personal safety. The law lists conduct such as sexual or gender-based threats and remarks, cyberstalking, nonconsensual sharing of sexual media, unauthorized recording and sharing of information, impersonation, and posting lies to harm a victim’s reputation.

The penalty is prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both, at the court’s discretion. The PNP Anti-Cybercrime Group is designated to receive complaints concerning gender-based online sexual harassment.

The provision is not a general penalty for every unauthorized upload. The gender-based and harassment-related elements must be established.

Cyberlibel

A post may constitute cyberlibel when it contains a public and malicious imputation satisfying the elements of libel and is published through a computer system. Embarrassment, criticism, or lack of consent alone is insufficient.

In Disini v. Secretary of Justice, the Supreme Court upheld cyberlibel with respect to the original author but not people who merely receive and react to the post through ordinary likes, comments, or shares. Liability for a person who creates a new defamatory statement must still be assessed from that person’s own words and acts.

The Supreme Court’s April 8, 2026 en banc resolution in Causing v. People confirms that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents. Because the discovery date may itself require proof, seek advice immediately.

Identity theft, threats, and other offenses

Using another person’s identifying information without right may constitute computer-related identity theft under the Cybercrime Prevention Act. Threats, coercion, extortion, fraud, stalking, or account intrusion may trigger other provisions of the Revised Penal Code, special laws, or cybercrime laws.

Report possible cybercrime to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the DOJ Office of Cybercrime. Bring the device used to view the content when requested, together with the preserved files, URLs, chronology, identification, and witness information.

Special situations

The poster is a spouse, former partner, or dating partner

If the disclosure forms part of threats, stalking, humiliation, coercive control, or psychological abuse by a current or former spouse or a person with whom the victim has or had a sexual or dating relationship, remedies under the Anti-Violence Against Women and Their Children Act may also be relevant. A VAWC desk, Women and Children Protection Desk, or lawyer can assess whether a barangay, temporary, or permanent protection order is available.

The conduct happened in a workplace or school

Notify the data protection officer and the organization’s formal grievance mechanism. For gender-based sexual harassment, employers and educational institutions have duties under the Safe Spaces Act, including maintaining an internal mechanism or Committee on Decorum and Investigation and protecting complainants from retaliation.

For elementary or secondary students, online conduct may also fall under the school’s Anti-Bullying Act procedures when the statutory and regulatory requirements are met.

The account is anonymous or the poster is abroad

Do not try to hack, deceive, or publicly expose a suspected person. Preserve the account identifiers and ask law enforcement about subscriber-data preservation and lawful disclosure procedures.

The Data Privacy Act has limited extraterritorial application where the statutory Philippine connection exists. Cross-border identification and enforcement may nevertheless require platform cooperation, international assistance, or action through the DOJ Office of Cybercrime.

Writ of habeas data

A writ of habeas data is not a routine social-media takedown remedy. Under the Rule on the Writ of Habeas Data, the unlawful gathering or storage of information must violate or threaten privacy in relation to life, liberty, or security. A petition must explain that connection and the prior steps taken to secure the data. Legal advice is essential before using this extraordinary remedy.

Common mistakes to avoid

Asking for deletion before preserving the post and account details.
Assuming every nonconsensual post is automatically a Data Privacy Act crime.
Treating truthful information as automatically lawful or automatically defamatory.
Reposting private or intimate material while trying to expose the uploader.
Sending threats, hacking the account, or impersonating someone to obtain evidence.
Relying only on cropped screenshots without URLs, dates, context, or a witness who can authenticate them.
Waiting for an anonymous account to disappear before seeking preservation assistance.
Filing an incomplete NPC complaint without the prior written notice, proof of receipt, evidence, affidavits, or certification against forum shopping.
Filing overlapping cases in different forums without disclosing them.
Naming only the platform when the person or organization controlling the original processing can be identified.
Missing the one-year periods that can apply to cyberlibel and civil defamation.

When legal help is urgent

Seek a lawyer or law-enforcement assistance immediately when:

the post contains an address, live location, identification document, financial credential, or information exposing a child;
there are threats, stalking, extortion, or fear of physical harm;
intimate or sexual content is being circulated;
the poster is demanding money, sexual acts, or another concession in exchange for removal;
a government office, employer, hospital, school, lender, or other organization appears to have leaked records;
an anonymous account must be identified before records disappear;
an urgent injunction, protection order, or temporary NPC processing ban may be needed; or
the post may be defamatory and the one-year prescriptive period is running.

A person may make an initial platform report, erasure request, or NPC inquiry without counsel. Legal assistance is strongly advisable for injunctions, criminal complaints, disputed public-interest issues, anonymous respondents, and claims involving several possible forums.

Frequently asked questions

Can I demand removal even if the information is true?

Yes. Truth does not automatically defeat a privacy or data-protection claim. The issue may be whether disclosure had a lawful basis, served a legitimate purpose, was proportionate, or concerned an overriding public interest. Truth and good motives are separately relevant to defamation.

Does putting information on Facebook make it free for anyone to reuse?

No. Public availability may reduce a person’s reasonable expectation of privacy in some circumstances, but it does not create unlimited permission to collect, combine, republish, or exploit personal data. The purpose, scope, audience, and resulting harm still matter.

Can the NPC order a social-media post removed?

The NPC can issue compliance and enforcement orders against entities or persons subject to its jurisdiction, including bans on personal-data processing. Whether it can grant effective relief in a particular platform dispute depends on the respondent, applicable law, and evidence.

Can I sue everyone who shared the post?

Not automatically. Each person’s conduct and the law invoked must be assessed separately. For cyberlibel, ordinary recipients who merely react to an original post are not criminally liable on that basis under Disini. A person who creates a new unlawful disclosure, threat, impersonation, or defamatory statement may present a different case.

What if the uploader deletes the post?

Deletion may reduce ongoing harm but does not necessarily erase prior liability. Preserve proof of the original post, its reach, the deletion, and any resulting damage. Other copies, cached results, or platform records may still exist.

Is an apology enough?

An apology may help resolve the dispute but does not automatically waive legal rights. Any settlement should clearly address deletion, further sharing, copies, confidentiality, correction, compensation, and enforcement. Obtain legal advice before signing a release or quitclaim.

Where should I start?

Start with safety, evidence preservation, and a platform report. Then send a precise written removal or erasure request unless doing so would be unsafe. Choose the NPC, law enforcement, an internal workplace or school process, or court action according to the identity of the poster, the kind of information, and the harm involved.

Official sources

This article provides general legal information, not legal advice or a prediction of any case. Outcomes depend on the complete facts, documents, parties, evidence, and procedural history. Laws, rules, and official guidance were checked as of August 10, 2026.