Quick answer

A Philippine cyber libel case begins with a sworn complaint and supporting evidence filed with the proper prosecution office. Because cyber libel carries a possible penalty exceeding six years, it ordinarily undergoes a regular preliminary investigation before any Information is filed in a designated Regional Trial Court.

To succeed, the prosecution must establish a defamatory imputation, publication to at least one third person, identification of the complainant, malice, use of a computer system, and the respondent’s responsibility for the publication. A respondent may defeat the charge by disproving any element or establishing an applicable defense, such as privileged communication, lack of authorship, lack of publication or identification, prescription, or—subject to strict legal conditions—truth published with good motives and for justifiable ends.

Act promptly. In Causing v. People, the Supreme Court held that cyber libel prescribes in one year from its discovery by the offended party, the authorities, or their agents. Online publication does not automatically create a presumption that the complainant discovered the post on the date it appeared. The discovery date is a factual matter requiring evidence, and filing the complaint or Information interrupts prescription under Article 91 of the Revised Penal Code. Read the Supreme Court’s final April 2026 resolution.

What counts as cyber libel

Section 4(c)(4) of the Cybercrime Prevention Act covers libel committed through a computer system or a similar means. This includes potentially defamatory material published through social media, websites, blogs, online forums, messaging groups, email, or comparable digital channels.

The basic elements are:

Element	What generally must be shown
Defamatory imputation	A statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication	Someone other than the person defamed received, read, heard, or saw the statement. A message sent only to the person concerned ordinarily does not injure reputation in the legal sense, although other laws may apply.
Identification	The complainant was named or was reasonably identifiable from the words, images, circumstances, or surrounding context. Naming the person is not always necessary.
Malice	The applicable form of malice must be established. The rules differ depending on whether the statement is privileged and whether the complainant is a private person, public officer, or public figure.
Use of a computer system	The publication was made through information and communications technology.
Authorship or responsibility	Admissible evidence connects the respondent to the assailed post or publication. Ownership of the displayed account name alone may not settle authorship if hacking, impersonation, shared access, or fabricated screenshots is credibly raised.

The post must be evaluated as a whole, in its language and context. Courts distinguish a defamatory factual imputation from criticism, satire, rhetorical exaggeration, or an opinion that does not assert or imply a false fact. Simply adding “in my opinion” will not protect what is substantively an accusation of fact.

Cyber libel generally applies to the original author of the online libel. In Disini v. Secretary of Justice, the Supreme Court rejected criminal liability under the cyber-libel provision for people who merely receive a post and react to it. A person who writes a new defamatory caption or independently republishes an accusation may present a different factual question; “share,” “repost,” and “comment” cases should therefore be assessed from the actual content and conduct, not the platform label alone. Read Disini.

Material published before the Cybercrime Prevention Act became effective cannot be punished retroactively as cyber libel. The Supreme Court applied this principle to a pre-law Facebook post in Peñalosa v. Ocampo Jr. Read the decision.

Malice, truth, and privileged communications

Private complainants

A defamatory imputation against a private person is generally presumed malicious unless it falls within a recognized privileged communication. This does not eliminate the prosecution’s obligation to prove guilt beyond reasonable doubt at trial, and the respondent may rebut the presumption with the circumstances and evidence.

Public officers and public figures

Speech about public affairs receives wider constitutional protection. When criticism concerns a public officer’s performance of official functions, a criminal libel case cannot prosper unless the prosecution proves actual malice—knowledge that the statement was false or reckless disregard of whether it was false. Public figures are likewise subject to a stricter malice standard under Disini.

This protection is substantial but not unlimited. Deliberately fabricating an accusation, relying on a source known to be unreliable, or consciously avoiding obvious contrary evidence can support a finding of actual malice. An honest error is not automatically actual malice, but “good faith” should be supported by records showing reasonable verification.

Truth is not always enough by itself

Article 361 of the Revised Penal Code does not make truth an unconditional defense in every situation. Where proof of truth is legally admissible, the accused generally must also show that publication was prompted by good motives and made for justifiable ends. Special treatment applies to truthful imputations concerning government employees and facts related to their official duties.

Preserve the records supporting both accuracy and purpose: official documents, source communications, interview notes, requests for comment, corrections considered, and the public-interest reason for publishing.

Privileged communications

Article 354 recognizes qualified privileges that may include:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments or remarks, of qualifying judicial, legislative, or other official proceedings that are not confidential.

Privilege is closely tied to necessity, audience, relevance, fairness, and good faith. A complaint sent to the proper authority may be privileged while broadcasting the same accusation to an unnecessary public audience may not be. Where qualified privilege applies, the prosecution must prove actual malice.

The one-year deadline

The controlling rule as of August 10, 2026 is that cyber libel prescribes in one year from discovery of the crime by the offended party, the authorities, or their agents.

Important qualifications include:

The publication date and discovery date may be different.
A public social-media post does not, by that fact alone, create constructive notice to the complainant on the posting date.
The party relying on prescription should be prepared to prove the relevant discovery date.
Filing the complaint or Information interrupts prescription. The period may run again if the proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.
Removing a post does not necessarily determine when the offense was discovered.
An edit, new upload, or independent republication may raise separate questions. Do not assume that every view restarts the period—or that every later alteration is legally irrelevant.

A complainant approaching the one-year mark should obtain legal assistance immediately rather than wait for a platform response, demand-letter deadline, or completed private investigation.

Where to file

The Rule on Cybercrime Warrants provides that criminal actions for offenses under Sections 4 and 5 of Republic Act No. 10175 may be filed in the designated cybercrime court of the province or city:

Where the offense or any of its elements occurred;
Where any part of the computer system used is situated; or
Where damage to the natural or juridical person occurred.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Venue remains a technical, fact-sensitive issue. The complaint-affidavit should state concrete facts connecting the selected place to the publication, computer system, complainant, or damage—not merely a preferred address.

The preliminary complaint is ordinarily filed with the City or Provincial Prosecutor having territorial jurisdiction over the proper venue. A complainant may also seek investigative assistance from the NBI Cybercrime Division or PNP Anti-Cybercrime Group, especially if the poster is anonymous, account attribution is disputed, or provider records must be preserved or obtained through legal process.

Private individuals cannot compel a platform, telecommunications company, or other service provider to disclose protected subscriber, traffic, or content data merely by sending a demand. Law-enforcement preservation orders and court-issued cybercrime warrants are governed by Republic Act No. 10175 and the Supreme Court’s Rule on Cybercrime Warrants.

How to file the complaint

1. Preserve the publication before confronting the poster

Capture more than a cropped screenshot. Preserve:

The complete post, article, message, image, video, or audio;
The full URL, profile URL, account handle, displayed account name, and available account identifier;
The date, time, and time-zone information shown;
The complete thread and surrounding conversation;
Comments, shares, quoted reposts, reactions, and visible audience settings;
A screen recording showing how the page was reached;
Original downloaded files and the device used to view them;
Messages or notices showing when and how the complainant first discovered the material; and
Evidence that third persons saw it and understood it to refer to the complainant.

Keep untouched originals and working copies. Do not add annotations to the only copy, alter metadata, fabricate engagement figures, or access another person’s account without authority.

2. Identify witnesses and damage evidence

Obtain affidavits from people who personally saw the publication and recognized the complainant. Preserve messages from customers, employers, relatives, colleagues, or community members reacting to the allegation.

For claimed damages, keep termination notices, cancelled contracts, customer communications, medical or counseling records where relevant, receipts, and other competent evidence. Embarrassment or reputational injury may be real, but specific financial damages should not be estimated or invented.

3. Prepare a detailed complaint-affidavit

Under the 2024 DOJ-NPS Rules, the complaint-affidavit should state the parties’ names and addresses, the date and place of the alleged offense, and a clear account of how it was committed. It must be sworn before an authorized officer and supported by witness affidavits and available documentary, electronic, and object evidence.

For a regular preliminary investigation, the filing packet generally consists of:

The original complaint-affidavit;
Two duplicate copies for the official file;
Additional copies corresponding to the number of respondents;
The completed NPS Investigation Data Form; and
Properly identified and organized supporting evidence.

Check the receiving prosecution office’s current administrative requirements before filing. An incomplete submission may be returned for the missing evidence before docketing.

4. Address every element

The affidavit should explain, using facts rather than conclusions:

The exact words, images, or conduct alleged to be defamatory;
Why an ordinary reader would understand them as defamatory;
How the complainant was identified;
Who else saw or received them;
Why the respondent is believed to be the author;
How a computer system was used;
The relevant venue facts;
When and how the publication was discovered; and
Why privilege, good faith, or another obvious defense does not apply.

5. Seek technical assistance when necessary

If attribution depends on subscriber data, IP information, account records, or forensic examination, promptly approach the NBI or PNP cybercrime unit. Ask counsel or the investigator whether a preservation order is necessary. Provider data may be deleted under retention policies, and delay can make attribution impossible even when a screenshot survives.

The NBI publishes a procedure for investigative assistance to victims of computer crimes. The DOJ also maintains an official page on reporting cybercrime incidents.

6. Participate in the preliminary investigation

Cyber libel’s prescribed imprisonment reaches eight years, so it falls within the regular preliminary-investigation rules for offenses punishable by at least six years and one day.

The current DOJ process generally provides that:

Within five calendar days from receiving the complete records, the investigating prosecutor either recommends dismissal or issues subpoenas.
The hearing date should not exceed 30 days from the prosecutor’s receipt of the complete records.
The respondent must receive at least 10 days from receipt of the subpoena and complaint to prepare the counter-affidavit.
A clarificatory hearing, if needed after the counter-affidavit, may be set within 10 calendar days.
A reply and rejoinder, when required, must each be filed within 10 calendar days from receipt of the pleading answered.
Extensions are exceptional and, when justified, may not exceed 10 days.
A preliminary-investigation complaint should ordinarily be resolved within 60 calendar days from assignment, subject to a maximum 30-day extension in the specified exceptional cases.

These periods come from DOJ Department Circular No. 015, whose validity was upheld by the Supreme Court. Administrative processing may still take longer, but parties should comply strictly with their own deadlines. Read the Supreme Court ruling upholding the rules.

How to respond to or defend the complaint

Do not ignore the subpoena

Record the exact date of receipt and immediately obtain the complaint, all annexes, and the envelope or proof of service. Failure to appear or submit a counter-affidavit despite proper service may cause the prosecutor to resolve the complaint on the complainant’s evidence alone.

A motion to dismiss generally cannot replace a counter-affidavit. If verified by the respondent and containing the defenses, it may instead be treated as the counter-affidavit.

Preserve defense evidence before changing anything

Keep:

The original device and account data;
Login history, security alerts, recovery emails, and proof of unauthorized access;
Drafts and publication timestamps;
Sources, official records, interview notes, and verification efforts;
Communications showing context, consent, privilege, or limited audience;
Requests for comment and responses;
Analytics showing the actual scope of publication;
Any correction, deletion, retraction, or apology; and
Evidence concerning the complainant’s actual discovery date.

Do not destroy the post, wipe the device, reset the account, coach witnesses, or fabricate a hacking claim. If the material remains online and continuing harm is possible, preserve it properly and obtain advice on removal, correction, or retraction. Deletion does not automatically erase criminal liability, while a prompt correction or apology may still matter to prosecutorial judgment, damages, or penalty.

Build the counter-affidavit around the elements

Depending on the evidence, defenses may include:

The respondent did not create or control the post;
The account was hacked, cloned, impersonated, or used by another person;
The screenshot is incomplete, altered, unauthenticated, or missing material context;
No third person received or understood the statement;
The complainant was not named or reasonably identifiable;
The words were not defamatory in their full context;
The statement was protected criticism or fair comment on a matter of public concern;
The communication was privileged;
Actual malice cannot be proved where the stricter standard applies;
Admissible evidence establishes truth, good motives, and justifiable ends;
The case has prescribed;
Venue was improperly laid; or
The alleged act occurred before the cyber-libel provision could apply.

Avoid relying only on “freedom of speech.” Constitutional protection is evaluated through the precise elements, status of the complainant, subject matter, privilege, and evidence of actual malice.

Follow the filing formalities

The respondent ordinarily files the original counter-affidavit and two duplicates and furnishes the complainant a copy. Personal appearance may be dispensed with if the affidavit was properly subscribed and sworn before an authorized prosecutor, government officer, or, when allowed, a notary public.

A motion for reconsideration of the prosecutor’s resolution may be filed within 15 days from receipt. A petition for review may also be available under the applicable DOJ appeal rules. If an Information has already been filed, the reviewing remedy does not automatically suspend the court case; the proper motion must also be filed in court. Because arraignment and review rules can affect available remedies, obtain counsel immediately upon receiving an adverse resolution.

If an Information is filed in court

The Information is filed in a designated Regional Trial Court. The judge independently evaluates probable cause and may dismiss the case, require additional evidence, or issue a warrant of arrest.

Before conviction, a person charged with cyber libel is generally entitled to bail as a matter of right because the offense is not punishable by reclusion perpetua or life imprisonment. This does not mean a warrant can be ignored. Counsel should coordinate lawful surrender, booking, and bail instead of waiting for an unexpected arrest.

Potential objections such as prescription, lack of jurisdiction, or defective allegations may need to be raised through the correct pretrial remedy and, in some circumstances, before plea. An accused should not enter a plea or assume that a pending DOJ review has stopped the court proceedings without legal advice.

At trial, the prosecution must establish guilt beyond reasonable doubt. A finding during preliminary investigation is not a conviction.

Possible penalties and civil liability

Under Section 6 of Republic Act No. 10175, the penalty for online libel is one degree higher than that for traditional written libel. For offenses governed by the current amended fine levels, the prescribed alternatives are:

Imprisonment of prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years;
A fine ranging from ₱40,000 to ₱1,500,000; or
Both imprisonment and a fine.

The offense date, modifying circumstances, the Indeterminate Sentence Law, and other sentencing rules can affect the final sentence. The Supreme Court has confirmed that a court may impose a fine alone where the circumstances justify it, but this is discretionary—not an entitlement—and imprisonment remains available. See the Supreme Court’s ruling on penalties for online libel.

Civil liability and damages may accompany the criminal case. An independent civil action for defamation may also be possible under Article 33 of the Civil Code, subject to its own rules, proof requirements, venue, and prescriptive period. A complainant should obtain advice before waiving, reserving, separately filing, or settling civil claims.

Electronic evidence: screenshots are useful but not automatically conclusive

The Rules on Electronic Evidence require authentication. The party offering an electronic document must show that it is what the party claims it to be. For messages and other ephemeral electronic communications, testimony from a participant or a person with personal knowledge is particularly important.

Strengthen the evidence by preserving:

The original electronic file rather than only a printout;
The device and account from which it was obtained;
Metadata and platform-generated records where available;
A witness who personally viewed or received the content;
A documented collection and custody history; and
Forensic copies or hash values when investigators consider them necessary.

A screenshot may be admitted when properly authenticated, but a cropped image with no URL, witness, device, or context is easier to challenge. Read the Supreme Court’s Rules on Electronic Evidence.

Common mistakes

Waiting for the post to “go viral” before preserving or reporting it.
Counting one year only from publication without investigating and documenting discovery.
Filing in a convenient city without pleading the facts that establish venue.
Submitting screenshots with no URL, context, original file, or authenticating witness.
Assuming a fake-looking name means the real author cannot be identified through lawful process.
Treating every insult, harsh opinion, or negative review as cyber libel.
Assuming truth alone always defeats the charge.
Posting a public counterattack that creates another possible defamation complaint.
Ignoring a subpoena because no court case has yet been filed.
Filing an unsworn denial instead of a compliant counter-affidavit.
Deleting devices, messages, drafts, or account records after learning of the complaint.
Assuming an affidavit of desistance, private settlement, apology, or platform takedown automatically ends the criminal case. Cyber libel is prosecuted in the name of the People of the Philippines; the prosecutor or court determines the legal effect of later developments.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The one-year prescriptive period may expire soon;
A subpoena, prosecutor’s resolution, Information, warrant, or arraignment notice has been received;
The respondent is anonymous or vital provider records may disappear;
A phone, computer, or account is the subject of a search, seizure, disclosure, or examination request;
The publication concerns a public officer, journalist, whistleblower, election, official proceeding, or confidential source;
The account may have been hacked or impersonated;
The dispute involves a child, intimate images, threats, stalking, doxxing, extortion, or gender-based online conduct, because other and more urgent laws may apply; or
Either party is considering a public apology, retraction, settlement, or new post that could affect the case.

If law-enforcement officers execute a warrant, do not obstruct them or destroy data. Ask to read the warrant, note its stated scope, request an inventory of seized items, and contact counsel promptly. Questions about privileged, unrelated, or overly broad data should be raised through lawful procedures.

Frequently asked questions

Is a demand letter required before filing?

No general rule makes a demand letter or takedown request a prerequisite to a cyber libel complaint. One may still be useful for stopping harm, obtaining a correction, or exploring settlement, but it should not be allowed to consume the prescriptive period.

Is one screenshot enough?

Possibly, but it may not prove authorship, completeness, publication, or authenticity by itself. Preserve the original device, URL, account details, context, metadata, and testimony of people who personally saw the material.

Can I file even if the account is anonymous?

Yes, but the evidence must eventually identify the responsible person. Seek NBI or PNP cybercrime assistance quickly so investigators can consider preservation measures and an application for the appropriate cybercrime warrant.

Are private messages cyber libel?

A message sent only to the person criticized ordinarily lacks publication to a third person. A group chat, copied email, forwarded message, or message shown to others may satisfy publication. Threats, harassment, unjust vexation, gender-based sexual harassment, or other offenses may apply even when libel does not.

Are likes and reactions punishable?

A person who merely receives and reacts to an online libel is not treated as the original author under Disini. Liability becomes more fact-dependent when the person writes a fresh defamatory statement or republishes the allegation with new content.

Does deleting the post end the case?

No. Deletion may stop further circulation and may be relevant to damages or sentencing, but it does not erase a completed publication. Preserve an evidentiary copy before taking corrective action.

Can an apology or affidavit of desistance dismiss the charge?

Not automatically. It may influence the complainant, prosecutor, damages, or penalty, but the criminal action belongs to the State once instituted. Any settlement should be documented carefully and should not involve coercion, false testimony, or suppression of evidence.

How long does the prosecutor have to resolve the complaint?

The 2024 DOJ-NPS Rules generally direct resolution within 60 calendar days from assignment, with a maximum 30-day extension for specified cases. This is an administrative period; parties must continue monitoring the case and comply with every notice even if resolution takes longer.

Can both ordinary libel and cyber libel be imposed for the same online publication?

The Supreme Court invalidated double punishment under both the Revised Penal Code and the Cybercrime Prevention Act for the same libelous act. Other genuinely distinct conduct or offenses may still be charged when their separate elements are supported by evidence.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber libel depends heavily on the exact publication, evidence, discovery date, parties’ status, venue, and procedural record. Sources and current rules were checked as of August 10, 2026.