Quick answer

A cyber libel case may arise when the original author uses a computer system to publish a malicious and defamatory imputation about an identifiable person to at least one third party. The prosecution must prove every element beyond reasonable doubt; an offensive, critical, mistaken, or unpopular online statement is not automatically cyber libel.

If you are filing, preserve the post and its surrounding digital evidence immediately, determine the proper venue, and file a sworn complaint with the appropriate prosecutor’s office. Act within one year from discovery of the alleged cyber libel. A platform report, takedown request, demand letter, or complaint to an investigator should not be assumed to stop the criminal prescriptive period.

If you are defending, do not ignore a prosecutor’s subpoena. Obtain the complete complaint and attachments, preserve your account and source materials, and submit a sworn, evidence-backed counter-affidavit by the stated deadline. Possible defenses include lack of authorship, identification, publication, defamatory meaning, or malice; privilege; truth with the legally required motives; improper venue; and prescription.

Cyber libel is governed principally by Section 4(c)(4) of the Cybercrime Prevention Act of 2012, together with Articles 353 to 362 of the Revised Penal Code.

What the prosecution must prove

The usual elements are:

Element	What it means in practice
Defamatory imputation	The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person to contempt. Meaning is assessed from the entire post and context, not an isolated word.
Publication	The imputation was communicated to someone other than the person allegedly defamed. A public post, group chat, email copied to others, or message shown to a third party may qualify.
Identification	The complainant was named or was sufficiently identifiable from the words, images, circumstances, or information known to readers. A name is not indispensable, but guesswork or a weak resemblance may be insufficient.
Malice	Malice may be presumed in an unprivileged defamatory imputation involving a private person, subject to defenses. When constitutional or qualified privilege applies, actual malice must be proved.
Use of a computer system	The publication was made through social media, a website, email, messaging service, or another computer or information-and-communications system.
Original authorship	The respondent authored the allegedly defamatory online statement, or authored a new defamatory assertion accompanying another post. Account ownership and actual authorship are factual issues that require evidence.

The Supreme Court stated these core libel elements and upheld cyber libel only as applied to an original author in Disini v. Secretary of Justice.

Likes, shares, reposts, and comments

A person is not criminally liable for cyber libel merely because they received a post and reacted to, liked, or simply shared it. In Disini, the Supreme Court invalidated cyber-libel liability for those who merely receive and react to the original post, and also invalidated “aiding or abetting” liability in relation to cyber libel.

The exception is important: a person who writes a new defamatory assertion in a caption, comment, quote-post, edited image, or follow-up story may be treated as the original author of that new content. Liability depends on the words actually added, their context, publication, identification, and malice—not merely the platform button used.

Statements that are not automatically cyber libel

The following require closer legal and factual analysis:

Criticism of government, public policy, professional performance, or a business;
Satire, rhetorical exaggeration, insults, or expressions of opinion;
A complaint sent only to an authorized person or office;
A fair and accurate report of a non-confidential official proceeding;
A post that does not identify the complainant;
A private message seen only by the complainant;
A post made from an account that was hacked, impersonated, or not controlled by the respondent; and
A simple share, like, reaction, or repost without a new defamatory assertion.

Calling a statement “opinion” does not settle the issue. An opinion may still imply undisclosed defamatory facts. Courts examine the language, surrounding facts, audience, and whether an ordinary reader would understand the statement as asserting verifiable facts.

The main defenses and exceptions

No defamatory imputation

Read the entire publication, including images, links, captions, preceding messages, and the exchange that followed. Ambiguous language should not be stripped of context. Mere annoyance, embarrassment, harshness, or vulgarity does not by itself establish the statutory tendency to cause dishonor, discredit, or contempt.

No publication to a third person

A statement communicated only to the person concerned generally lacks publication. Publication may exist, however, if another person received, read, heard, or was shown the communication.

The complainant was not identifiable

The prosecution must show that readers could reasonably identify the complainant. Evidence may include names, photographs, positions, relationships, locations, tagged accounts, or testimony from readers. It is not enough that the complainant personally believes the post referred to them.

The respondent was not the author

A profile name, screenshot, or account registration does not always prove who authored a particular post. Relevant evidence may include admissions, device records, account access history, linked contact information, writing context, witnesses, and properly obtained platform data.

A respondent claiming hacking or impersonation should preserve security alerts, login records, password-reset notices, reports to the platform, device records, and contemporaneous messages. A bare denial is usually less persuasive than documented evidence.

Privileged communication

Article 354 recognizes, among others:

A private communication made to another person in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of a non-confidential judicial, legislative, or other official proceeding, official statement, or act performed by a public officer.

Qualified privilege is not absolute immunity. The communication must be made on a proper occasion, to appropriate recipients, for a legitimate purpose, and without unnecessary or excessive publication. Liability may still follow if actual malice is proved.

Truth, good motives, and justifiable ends

Truth is not an unlimited defense in every private-person libel case. Article 361 generally requires proof both that the imputation was true and that it was published with good motives and for justifiable ends.

The Code also limits proof of the truth of an imputation involving an act or omission that is not a crime, except where the statement concerns a government employee and facts related to official duties. Cases involving public officials, public figures, or public concerns must also be examined under constitutional free-speech standards.

Public officials and public figures

When the allegedly defamatory statement concerns a public official’s official conduct or a public figure in a matter of public concern, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false.

Reckless disregard is more than carelessness. It requires evidence of a high degree of awareness of probable falsity or serious doubts about the statement’s truth. The Supreme Court discussed this heightened standard in Disini and in Tulfo v. People.

Prescription

The Supreme Court has now definitively ruled that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. It rejected both a 15-year period and an automatic rule that discovery occurs on the date of online publication. Social-media publication alone does not create constructive notice because visibility may be restricted by privacy settings.

The April 8, 2026 en banc resolution in Causing v. People affirmed that:

The period is one year from actual discovery;
Publication and discovery may fall on the same day, but need not do so;
Filing the criminal complaint or information interrupts prescription;
The period may run again if proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused; and
Prescription generally does not run while the offender is absent from the Philippines.

The discovery date is a factual issue. Preserve evidence showing when the complainant, authorities, or their agents first learned of the post. If prescription is not apparent from the Information, the accused ordinarily bears the burden of presenting evidence supporting that defense.

Improper venue

A cyber libel prosecution must be brought before the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where any of the damage to a natural or juridical person took place.

The court where the criminal action is first validly filed acquires jurisdiction to the exclusion of the others. Mere online accessibility everywhere should not replace specific venue allegations and proof. Venue should be examined before filing and challenged promptly when defective.

Duplicate charges for the same libel

The same defamatory material cannot be used to punish the accused separately for traditional libel and cyber libel when the charges concern one and the same offense. Disini held that charging both for identical material violates the protection against double jeopardy.

Non-retroactivity

An online post made before the cyber-libel provision became effective cannot be punished retroactively under Republic Act No. 10175. The actual date and any later, genuinely new publication must be examined separately.

How to file a cyber libel complaint

1. Record the discovery date

Write down:

The exact date, time, and manner in which you first discovered the post;
Who showed or sent it to you;
The message, email, or notification through which you learned about it; and
Whether authorities or your authorized representative discovered it earlier.

Preserve the document or message establishing discovery. Do not wait for the post to go viral. The one-year criminal deadline may already be running.

2. Preserve the complete digital evidence

Before seeking removal, capture:

The full post, not only the allegedly defamatory sentence;
The account name, username, profile URL, account ID if visible, and profile details;
The direct URL of each post, comment, video, image, or message;
Date, time, time zone, audience or privacy setting, and number of visible reactions or shares;
The complete thread and surrounding conversation;
Images, audio, video, captions, hyperlinks, and attached documents;
A screen recording showing navigation from the profile to the publication;
The original electronic files, downloads, exports, and unedited screenshots; and
The names and affidavits of people who personally saw the publication.

Keep the original phone or computer and make read-only backup copies. Do not crop, annotate, rename, recompress, or repeatedly forward the only copy. Create separate working copies for highlighting.

Electronic documents must be authenticated and shown to be reliable. Under the Rules on Electronic Evidence, the party offering a private electronic document bears the burden of proving its authenticity. A screenshot is useful, but it may not be sufficient by itself when authorship, integrity, or context is disputed.

3. Identify evidence for every element

Prepare evidence showing:

What exact statement is defamatory;
Who could identify you from it;
Which third parties saw it;
Why the respondent is the original author;
Why the publication was malicious or outside any privilege;
How a computer system was used;
Why the chosen venue is proper; and
When the offense was discovered.

If you claim actual financial loss, preserve contracts, client messages, cancellation records, employment documents, receipts, and other proof connecting the loss to the publication. Do not invent an estimate or assume that reputational harm automatically proves a specific peso amount.

4. Seek investigative help if the author is unknown

Anonymous or impersonating accounts may require subscriber information, traffic data, or device examination that a private person cannot lawfully obtain alone. You may seek assistance from the NBI Cybercrime Division or the DOJ Office of Cybercrime.

Law-enforcement authorities can pursue preservation and disclosure through the procedures in Republic Act No. 10175 and the Rule on Cybercrime Warrants. Content data subject to a lawful preservation order is generally preserved for six months, with a possible one-time six-month extension. Disclosure of protected data ordinarily requires judicial authorization.

An investigative report is valuable, but do not assume that reporting to an agency or platform has interrupted the one-year period. Confirm that a formal complaint has been filed with the proper prosecution office.

5. Prepare the complaint-affidavit

The complaint-affidavit should clearly state:

The parties’ names and addresses, if known;
The date and place of the offense;
The date and manner of discovery;
The exact words, images, or recordings complained of;
The surrounding context;
How the complainant was identified;
Who received or viewed the publication;
Facts linking the respondent to authorship;
Facts supporting malice and answering any apparent privilege;
The basis for venue; and
A numbered list of supporting evidence and witness affidavits.

The affidavit must be sworn before an authorized officer. Follow the current DOJ filing checklist for preliminary investigation, including the Investigation Data Form, required copies, affidavits, and supporting documents. Confirm the receiving office’s current rules before relying on email or electronic filing; the 2024 rules permit e-filing alternatives, but local implementation and authorized addresses may differ.

6. File with the proper prosecutor’s office

File with the Office of the City or Provincial Prosecutor corresponding to a legally supportable cybercrime venue, or with another proper National Prosecution Service office when its jurisdiction applies. Cyber libel carries a potential maximum imprisonment of eight years, so it falls within the regular preliminary-investigation process under the 2024 DOJ-NPS Rules.

The investigating prosecutor determines whether the evidence establishes a prima facie case with reasonable certainty of conviction—meaning evidence that is admissible, credible, preservable, and capable of proving all elements and the responsible person if left uncontradicted. The Supreme Court upheld this framework in Meking v. Remulla.

7. Participate in preliminary investigation

If the complaint is sufficient in form and supported by complete evidence, the prosecutor may issue a subpoena requiring the respondent to submit a counter-affidavit. Clarificatory proceedings or further affidavits may be required when necessary.

If the prosecutor finds sufficient evidence, an Information is filed in the designated cybercrime Regional Trial Court. The judge then makes an independent determination of probable cause and may dismiss the case, require further evidence, or issue the appropriate process, including a warrant of arrest when legally justified.

How to defend against a cyber libel complaint

1. Treat every subpoena and court notice as urgent

A prosecutor’s subpoena is not itself an arrest warrant, but ignoring it can cause the complaint to be resolved using only the complainant’s evidence. Record the date and method of receipt and obtain the complaint, affidavits, and all attachments.

Under the 2024 DOJ-NPS Rules, the preliminary-investigation hearing and deadline for the counter-affidavit must give the respondent at least 10 days from receipt of the subpoena and complaint. An extension is exceptional, must be justified by the interests of justice, and may not exceed 10 days.

2. Preserve, rather than delete, your evidence

Keep:

The original account and device records;
The full post and conversation;
Drafts, source documents, notes, and research;
Messages showing why the statement was made and to whom;
Official records relied upon;
Communications showing efforts to verify information;
Account-security and login records;
Witness information; and
Evidence of the complainant’s earlier discovery.

Do not fabricate evidence, alter dates, coach witnesses, destroy devices, or delete the only copy. If a takedown is appropriate, preserve the evidence first and document when and why removal occurred.

3. Build an element-by-element counter-affidavit

A useful counter-affidavit does more than deny the accusation. It should identify which elements are missing and attach admissible support. Depending on the facts, address:

Exact authorship and account control;
Whether the post was altered or taken out of context;
Whether any third person received it;
Whether the complainant was identifiable;
Whether the language asserted facts or was contextual criticism, satire, or rhetorical expression;
Truth, source verification, good motives, and justifiable ends;
Public-official, public-figure, or public-concern status;
Legal, moral, or social duty and limited recipients;
Fair-report privilege;
Discovery date and prescription;
Territorial and venue defects; and
Any duplicate prosecution for the same material.

Affidavits and attachments should be organized, marked, and explained. Evidence that is merely attached without showing its relevance may carry little weight.

4. Do not substitute an unsworn motion for the counter-affidavit

The 2024 DOJ-NPS Rules generally do not allow a motion to dismiss in place of a counter-affidavit. A verified motion containing the respondent’s defenses may instead be treated as the counter-affidavit. Preserve all factual and legal defenses in the proper sworn submission.

5. Use post-resolution remedies promptly

An aggrieved party may generally move for reconsideration of a prosecutor’s resolution within 15 days from receipt. A petition for review may also be available under the applicable DOJ rules, depending on which prosecution office issued the resolution.

Once an Information has been filed in court, a DOJ review or motion does not automatically suspend the criminal proceeding. Counsel should determine whether a motion to suspend proceedings must also be filed in court. Never miss an arraignment or other court date while waiting for prosecutorial review.

6. Address arrest, bail, and device searches lawfully

Cyber libel does not carry reclusion perpetua or life imprisonment, so bail is generally a matter of right before conviction by the RTC. If a warrant has issued, obtain counsel, arrange voluntary surrender when advised, and post the court-fixed bail rather than evade service.

If investigators seek a phone, computer, password, or account data, ask for counsel and the legal basis for the request. Computer-data searches and examinations commonly require an appropriate cybercrime warrant, although recognized exceptions to the warrant requirement may apply. Do not physically resist, conceal evidence, or obstruct a lawful investigation.

Possible penalties and civil liability

For an offense governed by the current penalty provisions, cyber libel may be punished by:

Imprisonment from prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day up to eight years;
A fine from ₱40,000 to ₱1,500,000; or
Both, depending on the judgment and circumstances.

A conviction does not invariably result in imprisonment. In People v. Soliman, the Supreme Court confirmed that a court may impose a fine alone in an appropriate online-libel case. The preference for a fine under judicial guidelines does not remove imprisonment from the law or guarantee a fine-only sentence.

Civil damages may also be claimed, but no single amount applies to every case. Actual damages require proof. Moral, exemplary, and other damages depend on the pleadings, evidence, applicable law, and judicial findings.

A separate civil action for defamation is generally subject to a one-year period. Its accrual, interruption, venue, and relationship to the criminal case can be complicated. A written extrajudicial demand may interrupt civil prescription under the Civil Code, but it does not substitute for timely institution of the criminal case.

Common mistakes

Waiting for a platform to respond before filing;
Assuming a demand letter stops criminal prescription;
Saving only cropped screenshots without URLs or context;
Failing to prove the discovery date;
Filing wherever the post can be viewed, without a specific venue basis;
Charging everyone who liked or shared the post;
Treating truth as an automatic defense without addressing motive and purpose;
Assuming all criticism of a public officer is privileged;
Ignoring a subpoena because it is not an arrest warrant;
Filing an unsworn denial without supporting evidence;
Deleting the post, account, messages, or device before preservation;
Obtaining account data through hacking, impersonation, or unauthorized access;
Assuming an affidavit of desistance automatically ends the criminal case; and
Missing the 15-day period for reconsideration or appeal.

When legal help is urgent

Seek a Philippine lawyer immediately if:

The one-year period is close to expiring;
A disappearing or anonymous account requires platform preservation;
You have received a prosecutor’s subpoena with a near deadline;
An Information, warrant of arrest, or search warrant has been issued;
A device has been seized or investigators request account access;
The case involves a journalist, whistleblower, public official, public figure, or confidential source;
Several related posts or complainants create possible multiple charges;
The publication occurred partly outside the Philippines; or
Criminal and separate civil cases have been filed in different places.

Qualified indigent persons may seek assistance from the Public Attorney’s Office or the Supreme Court’s Unified Legal Aid Service.

Frequently asked questions

Is a screenshot enough to file a case?

It can support a complaint, but it may not be enough to prove authenticity, authorship, completeness, publication, or context. Preserve URLs, account details, original files, the device, full-page captures, screen recordings, and testimony from people who personally saw the post.

Does deleting the post prevent a case?

No. Deletion does not erase an offense that was already published, and copies or platform records may remain. Preserve evidence before removal. Prompt correction, retraction, or apology may be relevant to motive, damages, or resolution, but does not automatically extinguish criminal liability.

Is a demand letter required?

No. A demand, correction request, or takedown request may be useful, but it is not a prerequisite to a criminal complaint and does not stop the one-year criminal prescriptive period.

Can a group-chat message be cyber libel?

Yes, if it contains a defamatory imputation, identifies the complainant, is sent to at least one person other than the complainant, is malicious, and satisfies the other elements. A communication made only to proper recipients in the performance of a legal, moral, or social duty may be qualifiedly privileged.

Can someone be charged only for sharing a post?

A simple share, repost, like, or reaction is not punishable as cyber libel under Disini. A person who adds a new defamatory accusation may, however, be prosecuted as the original author of that new statement.

Can a public official file cyber libel?

Yes. Public office does not remove protection from defamation. But when the statement concerns official conduct or a public issue, the prosecution must prove actual malice rather than rely only on presumed malice.

Does an affidavit of desistance automatically dismiss the case?

No. Cyber libel is prosecuted in the name of the People of the Philippines. A desistance may be considered, but the prosecutor or court determines the effect, and the criminal case may continue if the evidence supports it.

What if more than one year has passed since publication?

The controlling date is discovery, not necessarily publication. If the complainant or authorities discovered the post later, the complaint may still be timely. The party asserting prescription should preserve evidence of the true discovery date and any event that interrupted the period.

How long do I have to appeal a conviction?

A criminal appeal is generally taken within 15 days from promulgation of the judgment or notice of the final order, subject to interruption by a timely motion for new trial or reconsideration and other applicable rules. Obtain appellate advice immediately because the proper mode and receiving court depend on the judgment issued.

Official references

This article provides general legal information, not advice for a particular case. Outcomes depend on the exact post, audience, parties, evidence, dates, venue, and procedural history. The law and official procedures cited here were checked through July 26, 2026.