Finding your full name and home address posted online can feel frightening, especially when the post invites harassment, identifies family members, or suggests that strangers should visit your home. In the Philippines, this is often called doxxing. Philippine law does not treat every online posting of a name or address as one automatic crime, but the act may violate the Data Privacy Act, the Civil Code, cyber libel laws, laws against threats or harassment, and special protections for women and children. Your priorities are to preserve evidence, protect your immediate safety, request removal, and choose the proper legal remedy based on the purpose and content of the post.

Is Posting Someone’s Name and Address Online Illegal in the Philippines?

It depends on the circumstances.

A person’s name and residential address are personal information because they identify, or can reasonably identify, a specific individual. The Data Privacy Act of 2012, or Republic Act No. 10173, regulates the collection, use, disclosure, storage, and other processing of personal data.

However, the mere appearance of a name or address online does not automatically prove a criminal violation. Authorities will consider questions such as:

Where did the information come from?
Was there a lawful and legitimate reason for publishing it?
Was the disclosure necessary and proportionate to that purpose?
Was it posted to shame, threaten, intimidate, extort, stalk, or expose the person to danger?
Did the poster include false accusations?
Was the information obtained through hacking, deception, employment records, loan applications, government files, or another confidential source?
Was the post visible to the general public or only to a limited, appropriate audience?
Did the poster encourage others to contact, visit, attack, or harass the person?

The Data Privacy Act requires personal-data processing to observe transparency, legitimate purpose, and proportionality. It also penalizes conduct such as unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure when the legal requirements are present. (Lawphil)

A public warning that accurately identifies the registered address of a licensed business may be treated differently from a revenge post that exposes someone’s private residence and tells followers to “teach this person a lesson.” Context is critical.

Your Legal Rights When Your Address Is Exposed Online

Rights under the Data Privacy Act

Under RA 10173, a person whose data is being processed is called a data subject. Depending on the circumstances, a data subject may have the right to:

Be informed about how and why the information is being processed;
Object to certain processing;
Request access to the data being held;
Correct inaccurate information;
Request erasure, blocking, or removal when processing is unlawful or no longer necessary;
Claim damages for violations of data-privacy rights; and
File a complaint with the National Privacy Commission.

An individual social-media user may potentially be treated as a personal information controller when that person decides why and how another person’s data will be publicly disclosed. However, the Data Privacy Act contains exemptions, including certain processing connected with personal, family, or household affairs. A public or malicious disclosure to a broad online audience is not automatically protected by that exemption; the NPC must examine the actual purpose, audience, and circumstances.

The fact that some information may be obtainable elsewhere does not give everyone unlimited freedom to republish it for any purpose. Combining a name, exact address, photograph, employer, telephone number, family details, and accusations can create a much more serious safety and privacy risk than any individual detail viewed separately.

Civil damages and an injunction

Articles 19, 20, 21, and 26 of the Civil Code of the Philippines, Republic Act No. 386, may support a civil case even when the conduct does not fit a specific criminal offense.

Article 26 expressly requires every person to respect the dignity, personality, privacy, and peace of mind of others. It recognizes a cause of action for damages, prevention, and other relief for acts such as:

Prying into the privacy of another residence;
Meddling with or disturbing another person’s private or family life; and
Vexing or humiliating someone because of a personal condition.

Articles 19 to 21 also prohibit the abusive exercise of rights and deliberate conduct contrary to law, morals, good customs, or public policy that causes injury. A court may award actual damages, moral damages, and other appropriate relief when properly proved. A party may also seek injunctive relief—an order directing someone to stop or refrain from harmful conduct—when the legal requirements are satisfied. (Lawphil)

Cyber libel

Posting a name and address is not, by itself, cyber libel. Cyber libel generally requires a defamatory imputation—a statement accusing someone of a crime, defect, misconduct, or dishonorable act—that is published online and refers to an identifiable person.

Cyber libel is governed by Articles 353 and 355 of the Revised Penal Code, as applied through Section 4(c)(4) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175.

Examples that may raise cyber-libel issues include:

Posting someone’s address beside a false accusation that the person is a scammer, thief, adulterer, or criminal;
Publishing fabricated allegations and encouraging neighbors or employers to confront the person;
Reposting a defamatory accusation with additional commentary that adopts or reinforces it.

Truth is not always a complete answer by itself. Philippine libel law also considers whether the publication was made with good motives and for justifiable ends, as well as whether it falls within a privileged communication.

Time is important. In its 2026 ruling in Causing v. People, the Supreme Court held that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents, subject to evidentiary issues in the particular case. A person considering a cyber-libel complaint should not allow negotiations or barangay proceedings to consume that period. (Lawphil)

Threats, coercion, and harassment

A post may support other criminal complaints when it includes or accompanies:

A threat to kill, injure, abduct, burn property, or commit another wrong;
Instructions encouraging people to go to the victim’s house;
Demands for money, sexual favors, withdrawal of a complaint, or another act;
Repeated unwanted contact or surveillance;
Impersonation, account hacking, or access to private messages;
Persistent conduct intended to alarm, annoy, torment, or humiliate.

Depending on the exact words and actions, offenses such as grave threats, grave coercion, unjust vexation, identity-related fraud, illegal access, or other crimes under the Revised Penal Code and RA 10175 may be considered. Investigators and prosecutors determine the proper charge based on the evidence; a complaint should describe the facts accurately rather than insist on one legal label.

Gender-based online harassment

The Safe Spaces Act, Republic Act No. 11313 of 2019, penalizes specified forms of gender-based online sexual harassment. It may apply when the disclosure is sexual or gender-based and involves conduct such as threats, unwanted sexual remarks, invasion of privacy, impersonation, or the posting of material intended to harm a victim’s reputation.

It does not apply to every hostile post. The gender or sexual element must be present. (Lawphil)

Abuse by a spouse or dating partner

When the poster is a husband, former husband, boyfriend, former boyfriend, or a person with whom the victim has or had a dating or sexual relationship, the conduct may fall under the Anti-Violence Against Women and Their Children Act, Republic Act No. 9262 of 2004.

Publicly exposing a woman’s address as part of stalking, threats, humiliation, control, or repeated harassment may form part of psychological violence or another prohibited act. A victim may seek a barangay protection order, temporary protection order, or permanent protection order when the statutory requirements are present.

What to Do Immediately

1. Preserve the evidence before requesting removal

Online material can be deleted, edited, restricted, or hidden without warning. Save evidence before contacting the poster.

Collect:

Full screenshots showing the entire post, not only the offensive sentence;
The account name, username, profile photograph, and profile link;
The exact URL of each post, comment, video, story, or group discussion;
The date and time you first saw it;
Comments, reactions, shares, reposts, and messages showing how widely it spread;
Screen recordings showing how you reached the post from the profile or group;
Notifications, emails, or messages sent by people who saw it;
Any threats, attempted visits, calls, deliveries, or harassment that followed;
Copies saved as PDF or printed with the web address visible; and
The original phone or computer on which the material was viewed.

Do not crop, annotate, or edit your only copy. Keep an untouched version. Screenshots can be challenged, so preserving the URL, surrounding content, original device, and testimony of witnesses makes the evidence stronger.

Create a simple incident log:

Date and time	What happened	Account or person involved	Evidence saved
15 July, 8:40 p.m.	Address posted publicly	Account username	Screenshot, URL
15 July, 9:10 p.m.	Comment told users to visit house	Commenter username	Screen recording
16 July, 7:30 a.m.	Unknown person called household	Unknown number	Call log, affidavit

2. Assess whether anyone is in immediate danger

Treat the situation as urgent when the post includes:

An exact home location;
Photographs of the house, gate, vehicle, or children;
Threats or violent language;
Instructions to visit or attack the address;
Real-time location information;
Work schedules or information showing when the victim is alone;
A history of stalking, domestic violence, or physical confrontation.

Contact the nearest police station or emergency services when there is an immediate threat. Inform household members, building security, the barangay, school officials, or the employer’s security office as appropriate.

A barangay or police blotter creates an initial record, but it is not the same as filing and prosecuting a criminal case. Ask what additional affidavit, referral, or prosecutor filing is required.

3. Reduce the immediate security risk

Consider practical safety measures while removal requests are pending:

Make social-media profiles private;
Hide telephone numbers, email addresses, relatives, workplaces, and school information;
Change passwords and enable two-factor authentication;
Review active login sessions and revoke unfamiliar devices;
Ask relatives not to tag the victim’s current location;
Remove photographs showing house numbers, landmarks, vehicle plates, or daily routines;
Alert banks and mobile providers if IDs or financial details were exposed;
Temporarily vary predictable travel routines;
Preserve suspicious deliveries, calls, and messages as evidence.

Do not publicly announce every security measure being taken.

4. Report the post through the platform

Use the platform’s reporting categories for privacy violations, harassment, threats, sharing personal information, impersonation, or non-consensual images.

In the report:

Identify the exact information exposed;
State that it is a residential address or other sensitive location;
Explain any threat or risk of physical harm;
Identify children or vulnerable persons affected;
Attach the strongest screenshot;
Save the platform’s confirmation or reference number.

Report the original post and significant reposts separately. Removing one post does not automatically remove screenshots or copies uploaded by other users.

Search engines may continue displaying an old snippet after the source is removed. Once the webpage is deleted or changed, request removal of outdated cached results from the relevant search engine.

5. Send a written demand for removal

A clear written notice can resolve the problem and is important if an NPC complaint later becomes necessary.

The notice should:

Identify the posts and URLs;
State which personal data was disclosed;
Explain briefly why the disclosure is unauthorized, excessive, inaccurate, threatening, or harmful;
Demand removal, cessation of further sharing, and deletion of stored copies where appropriate;
Request preservation of account and publication records for possible proceedings;
Set a reasonable deadline;
Instruct the recipient not to contact the victim except in writing; and
Preserve proof of delivery.

Avoid unnecessary arguments, insults, threats, or public retaliation. A hostile exchange may create new evidence against both sides.

How to File a Complaint with the National Privacy Commission

The NPC may investigate violations of the Data Privacy Act and related issuances. It may award indemnity in matters affecting personal data, issue compliance or cease-and-desist orders, impose temporary or permanent restrictions on processing, and recommend criminal prosecution when warranted. (National Privacy Commission)

NPC exhaustion requirement

Before filing, the complainant generally must inform the respondent in writing about the privacy violation and give the respondent an opportunity to address it.

The NPC states that a complaint should show that:

The respondent failed to take timely or appropriate action; or
The respondent gave no response within 15 calendar days after receiving the written notice.

Proof of the notice and its receipt must be attached. A deficient complaint or one unsupported by evidence may be dismissed outright. (National Privacy Commission)

Documents normally needed

Prepare:

The current NPC complaint-affidavit or a properly verified complaint;
Government-issued identification;
Screenshots, URLs, recordings, and printed posts;
Copies of the written demand;
Proof that the respondent received it;
The respondent’s reply, if any;
Witness affidavits;
Proof of resulting loss, harassment, or security incidents;
A special power of attorney if someone is filing for the victim; and
Other documents connecting the respondent to the account or disclosure.

Use the current form from the NPC’s formal complaint page. The NPC introduced a new complaint-affidavit template effective 1 July 2025, so an old downloaded form may no longer be accepted. (National Privacy Commission)

The complaint must be notarized. It may be submitted personally, by registered mail, courier, or authorized electronic filing. Electronic documents should follow the NPC’s format and signing requirements. (National Privacy Commission)

Requesting a temporary ban

Where continued processing creates serious harm, the complainant may apply for a temporary ban on the processing of personal data.

The application generally requires:

Facts showing an urgent need to preserve the complainant’s rights;
Supporting documents;
Judicial affidavits;
A bond in an amount fixed by the investigating officer, unless an exemption applies; and
Compliance with the NPC’s procedural rules.

The NPC indicates that the temporary-ban process may involve a summary hearing or position papers and may occur approximately one to two weeks after filing, although the result and timing are not guaranteed. (National Privacy Commission)

Filing a Police or Criminal Complaint

Report the matter to the Philippine National Police, including an appropriate cybercrime unit, the NBI cybercrime authorities, or the prosecutor’s office when the post involves threats, defamatory accusations, hacking, fraud, coercion, sexual harassment, stalking, or other criminal conduct.

Bring:

A chronological written account;
Valid identification;
Printed and electronic copies of the posts;
URLs and account details;
The original device, if requested;
Witnesses or their affidavits;
Records of threats, calls, visits, or financial loss; and
Any police or barangay blotter entry.

Investigators may seek preservation of relevant computer data. RA 10175 provides mechanisms for preserving traffic data, subscriber information, and content data through proper law-enforcement processes. Private individuals normally cannot compel a social-media platform to reveal a user’s identity merely by sending a demand; formal legal process may be required. (Lawphil)

Avoid assuming that the person named on an account is necessarily the person operating it. Fake profiles, compromised accounts, shared devices, and impersonation are common evidentiary issues.

When Barangay Conciliation May Be Required

Under Section 412 of the Local Government Code, Republic Act No. 7160, prior barangay conciliation may be a condition before filing certain court or government proceedings involving individuals who actually reside in the same city or municipality.

Barangay proceedings are not universally required. Exceptions may apply, including urgent cases, proceedings involving provisional remedies, disputes outside the Lupon’s authority, and situations where delay could cause the claim to prescribe.

Do not assume that a barangay settlement attempt stops every legal deadline. This is particularly important for cyber libel’s one-year prescriptive period and applications for urgent protection. (Lawphil)

Costs and Realistic Timelines

Step	Likely cost	Practical timing
Preserve screenshots and URLs	Usually free	Immediately
Platform report	Free	Hours to several weeks; no guaranteed result
Police or barangay blotter	Generally no filing charge	Often recorded the same day
Written demand	Printing, courier, or notarial costs if notarized	Send as soon as evidence is preserved
NPC exhaustion period	Delivery expenses	Allow 15 calendar days from receipt
NPC complaint	Current NPC fees, copying, courier, and notarization may apply	No guaranteed completion date
Temporary-ban request	Possible filing costs and bond	NPC indicates roughly one to two weeks for the application process
Prosecutor complaint	Copies, affidavits, notarization, and professional fees if represented	Commonly requires multiple submissions
Civil court case	Filing fees based on the relief and damages claimed	Frequently takes months or longer

Platform removal is often the fastest practical remedy, but it does not necessarily identify the poster, compensate the victim, or prevent reposting. Government and court proceedings provide stronger compulsory remedies but require properly authenticated evidence and take longer.

Special Situations

The address came from an employer, lender, condominium, or government office

The situation is more serious when an organization or its employee obtained the address through:

Employment records;
Customer or borrower files;
Medical records;
School records;
Government databases;
Condominium or subdivision records;
Delivery or booking information; or
Account-verification documents.

Send the written complaint to the organization’s data protection officer, request an investigation, and ask the organization to preserve access logs and internal records. The organization may face responsibility for its own processing, security failures, employee conduct, or failure to respond appropriately.

The post concerns an unpaid debt

A creditor may use lawful collection methods, but publicly shaming a borrower, contacting unrelated persons, exposing contact lists, or publishing personal details can raise serious privacy and harassment issues. The existence of a debt does not automatically authorize public disclosure of the borrower’s address or other personal data.

A child’s address was posted

Preserve the evidence without repeatedly circulating the child’s information. Inform the child’s parent or guardian, school, barangay, and the PNP Women and Children Protection Desk where appropriate. Conduct that threatens, degrades, exploits, or endangers a child may also raise issues under the Special Protection of Children Against Abuse, Exploitation and Discrimination Act, RA 7610. (Lawphil)

The victim or poster is abroad

A victim abroad can preserve evidence, report the content to the platform, and authorize a Philippine representative through a special power of attorney when permitted.

Documents executed abroad may need to be:

Notarized before a Philippine embassy or consulate; or
Notarized locally and apostilled in a country that is party to the Apostille Convention.

The specific receiving office may impose additional requirements. (Philippine Embassy in New Delhi)

The Data Privacy Act has limited extraterritorial provisions, but enforcing Philippine orders against an anonymous poster or platform entirely abroad can be slower and may require cross-border legal assistance. (Lawphil)

Common Mistakes to Avoid

Requesting deletion before saving evidence.
Posting the other person’s address in retaliation.
Editing or cropping the only copy of a screenshot.
Assuming a fake account’s display name proves the poster’s identity.
Making public accusations that cannot be proved.
Sending threats or abusive messages in response.
Waiting months while assuming the platform report suspended legal deadlines.
Filing an NPC complaint without first completing the 15-day written-notice requirement.
Submitting only isolated screenshots without URLs, context, dates, or account details.
Treating a police blotter as though a prosecutor’s complaint has already been filed.
Forwarding the exposed information to many people “for awareness,” thereby increasing the privacy harm.
Paying an unknown person who promises to “hack” the poster or recover account data.

Frequently Asked Questions

Can I force Facebook or another platform to remove my address?

You can report the post and request removal under the platform’s privacy, harassment, or personal-information rules. A Philippine court or the NPC may issue stronger relief in a proper case, but removal is not automatic simply because a demand was sent.

Is posting my address automatically a Data Privacy Act violation?

Not automatically. The NPC will examine the poster, source of the data, purpose, lawful basis, audience, proportionality, exemptions, and resulting harm. A malicious public disclosure that exposes someone to harassment or danger is substantially different from a necessary disclosure made for a legitimate legal purpose.

What if the address is already publicly available?

Public availability does not necessarily authorize every new use or republication. The purpose, context, additional information, audience, and risk created by the new post still matter.

Can I file cyber libel if the post contains only my name and address?

Usually, the name and address alone are not defamatory. Cyber libel requires a defamatory imputation. If the post falsely accuses you of a crime, dishonesty, immorality, or another discreditable act, cyber libel may become relevant.

Should I go to the barangay, police, NBI, or NPC?

The correct office depends on the problem:

Immediate threats or danger: police and emergency services;
Privacy misuse or unauthorized disclosure: NPC;
Hacking or cybercrime: PNP or NBI cybercrime authorities;
Local dispute between residents: barangay conciliation may apply;
Damages or an injunction: the proper court;
Domestic or dating-partner abuse: barangay, police, prosecutor, or Family Court protection-order procedures.

Several remedies may be pursued at the same time when legally appropriate.

Can I sue even if no criminal case is filed?

Yes. Civil Code Articles 19, 20, 21, and 26 may support an independent civil claim for damages, prevention, or other relief even if the conduct is not prosecuted as a crime.

Can the poster be arrested immediately?

Not merely because you submitted a report. Arrest normally requires a warrant unless a recognized warrantless-arrest situation exists. Investigators must determine the offense, gather evidence, identify the responsible person, and follow criminal procedure.

What if the post has already been deleted?

A complaint may still be possible if you preserved reliable evidence. Keep screenshots, URLs, messages, witness accounts, platform notices, and the original device. The deletion may stop further exposure but does not necessarily erase liability for harm already caused.

Can I ask the NPC for emergency removal?

You may consider an application for a temporary ban on processing together with or during an NPC complaint. It requires supporting facts, affidavits, and potentially a bond, and the NPC decides whether the strict requirements are met.

Key Takeaways

A name and home address are personal information, but liability depends on the source, purpose, audience, accompanying statements, and harm.
Preserve complete evidence before asking anyone to delete the post.
Treat threats, calls to visit the address, stalking, and exposure of children as urgent safety concerns.
Report the content to the platform and send a documented written removal request.
An NPC complaint generally requires prior written notice and 15 calendar days for the respondent to act or reply.
Civil Code Articles 19 to 21 and 26 may support damages, prevention, or injunctive relief.
Cyber libel applies only when the post includes a defamatory imputation; its one-year prescriptive period requires prompt attention.
Other remedies may apply under laws covering threats, coercion, gender-based harassment, domestic violence, hacking, and child abuse.
A police or barangay blotter records the incident but does not automatically begin a prosecutor’s case.
Do not retaliate by publishing the poster’s personal information or making accusations that cannot be proved.