Quick answer

Cyber libel is committed when a person publishes through a computer system a defamatory statement that identifies another person or entity, reaches at least one third person, and is legally malicious. It is punishable under Section 4(c)(4) of the Cybercrime Prevention Act in relation to Articles 353 and 355 of the Revised Penal Code.

To file a case, preserve the complete online evidence immediately, document when the post was first discovered, establish who authored it, determine the proper venue, and file a sworn complaint with the appropriate prosecution office. Reporting the post to a platform, barangay, police desk, or the NBI should not be assumed to stop the filing deadline.

To defend a case, do not delete evidence or argue online. Obtain the complete complaint and annexes, observe the subpoena deadline, and submit a sworn counter-affidavit addressing authorship, publication, identification, defamatory meaning, malice, privilege, truth and motive, venue, and prescription. A prosecutor’s subpoena is not an arrest warrant, but ignoring it may allow the complaint to be resolved without the respondent’s evidence.

The Supreme Court has now definitively held that cyber libel prescribes in one year from discovery of the alleged defamatory material by the offended party, the authorities, or their agents—not automatically from the date it was posted. Filing the proper complaint or information interrupts prescription. Because the discovery date is often disputed, both sides should preserve proof of it and act well before the anniversary.

What the prosecution must prove

A conviction is not justified merely because an online post was insulting, embarrassing, unfair, or false. The prosecution must prove every element beyond reasonable doubt:

Defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Identification. The complainant must be identifiable from the words, images, surrounding facts, or context. Naming the person is not essential, but readers must reasonably understand who was being discussed. A vague statement about a large, undefined group may fail this element.
Publication. At least one person other than the complainant must receive, read, hear, or see the statement. A public post, group chat, email copied to others, website article, video, podcast, or comment thread may satisfy publication. A message sent only to the person criticized ordinarily lacks this element, although other laws may apply.
Malice. Article 354 generally presumes malice from a defamatory imputation unless it is privileged. That presumption is subject to constitutional limits, particularly for speech involving public officials, public figures, and matters of public interest.
Use of a computer system or similar technology. The publication must have been made through a computer system or information and communications technology.
Identity of the author. The prosecution must connect the respondent—not merely a display name, profile picture, or account handle—to the post.

In cases involving a public official or public figure and speech relevant to public conduct or public interest, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Personal hostility, strong language, or failure to conduct a perfect investigation does not by itself establish this constitutional standard.

Speech that is not automatically cyber libel

Opinion, criticism, and fair comment

Harsh criticism and unpopular opinions are not automatically criminal. Courts consider the entire publication, its ordinary meaning, whether it asserts verifiable facts, its factual basis, and its context.

Calling an official’s policy “reckless,” for example, is different from falsely asserting as fact that the official stole a particular fund. Adding “allegedly,” “I think,” or a question mark does not protect a statement that, read as a whole, makes a defamatory factual accusation.

Fair comment on matters of public interest may be privileged, but privilege is not a license to fabricate facts or publish with actual malice.

Privileged communications

Article 354 recognizes qualified privileges that include:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without added comments, of non-confidential judicial, legislative, or other official proceedings, acts of public officers in the exercise of their functions, or speeches delivered in those proceedings.

Privilege is fact-specific. Publication must generally be limited to people with a legitimate interest, and the protection may be lost through excessive publication or actual malice.

Truth

Truth is important but is not always a complete defense by itself. Under Article 361, the availability and effect of proof of truth depend on what was imputed and to whom. Acquittal requires that the matter be true and that it was published with good motives and for justifiable ends.

Keep the source documents that existed before publication. Evidence obtained only after the post may prove truth, but it may not establish what the author knew or reasonably relied upon when publishing.

Likes, shares, and comments

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but rejected automatic liability for people who merely receive and react to a post through actions such as liking or sharing it.

That does not immunize a person who writes a new defamatory caption or comment. The new words may be evaluated as that person’s own publication.

The one-year filing deadline

The controlling rule is the Supreme Court’s 2026 final resolution in Causing v. People:

Cyber libel prescribes in one year.
The period begins when the alleged defamatory material is discovered by the offended party, the authorities, or their agents.
Online publication does not create an automatic presumption that the complainant discovered the post on the posting date.
The filing of the proper complaint or information interrupts prescription.
If proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused, the period may run again under Article 91.
The period does not run while the offender is absent from the Philippines.

The discovery date is a factual issue. Preserve the message that first forwarded the post, the witness who showed it, notification records, emails, and the date on which the complainant actually opened or learned of the content.

Do not wait for a takedown request, demand letter, platform response, or lengthy private investigation before filing. An NBI or police report may assist investigation, but a complainant facing prescription should ensure that the sworn criminal complaint is timely filed with the proper prosecution office and formally docketed.

A separate civil action for defamation is also generally subject to a one-year limitation under Article 1147 of the Civil Code. Its accrual and its interaction with a criminal complaint should be assessed promptly.

How to preserve the online evidence

Screenshots are useful, but a cropped screenshot standing alone can be challenged as incomplete, altered, or unrelated to the respondent. Preserve:

The complete URL, account handle, profile URL, page or group name, and any visible account ID;
The full post, article, video, caption, thread, preceding discussion, comments, and replies;
Visible publication dates, edit labels, timestamps, and the device’s time zone;
Screen recordings showing navigation from the profile or page to the post;
Original downloaded photos, audio, video, emails, or files without editing or recompression;
The device on which the content was received or viewed;
Notifications, direct messages, emails, or chats through which the post was discovered;
Names and sworn accounts of third persons who saw the publication;
Earlier messages, admissions, or interactions connecting the account to its user;
Documents supporting or disproving the accusation;
Platform reports, takedown notices, demand letters, replies, corrections, and apologies;
Proof of harm relevant to civil damages or venue, such as lost contracts, employer communications, customer messages, or medical records.

Keep an untouched copy and a working copy. Record who collected each item, when, from what device, and how it was stored. Do not hack an account, guess a password, impersonate another person, or secretly obtain data through unlawful access.

Under the Rules on Electronic Evidence, the party offering a private electronic document must prove its authenticity and reliability. Printing or notarizing a screenshot does not by itself prove who authored it or that it is complete.

Where content may disappear or an anonymous account must be identified, promptly ask an investigator or prosecutor about lawful preservation and cybercrime-warrant procedures. Service providers may hold subscriber, traffic, or content data only for limited periods.

Proving who controlled an account

A familiar name or photograph is relevant but not conclusive because dummy and compromised accounts exist. The Supreme Court’s 2025 guideposts allow authorship, ownership, or access to be shown through a combination of circumstances, including:

An admission of account ownership, access, or authorship;
A witness who saw the person use the account or compose the post;
Information in the post known only to the person or a small group;
Distinctive language or writing characteristics;
Consistent past posts, messages, conduct, and account interactions;
Internet-service-provider, telecommunications, platform, or device-forensic records;
Geolocation and other technical attributes; and
Other facts reliably connecting the account and content to the accused.

Complainants should not rely only on the profile name. Respondents who claim hacking or impersonation should preserve security alerts, login histories, recovery emails, police or platform reports, device records, and evidence showing when access was lost. A bare denial may carry little weight if contradicted by several independent circumstances.

How to file a criminal complaint

1. Review the exact statement

Quote or attach the specific words, images, audio, or video claimed to be defamatory. Explain their context, meaning, identification of the complainant, publication to third persons, and why the respondent is believed to be the author.

Avoid filing a complaint based only on insults or conclusions. The affidavit and supporting evidence must establish every element and the identity of the responsible person.

2. Determine the correct venue

Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action belongs in the designated cybercrime court of the province or city:

Where the offense or any element occurred;
Where any part of the computer system used was situated; or
Where any damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of other courts. Venue in a criminal case is jurisdictional and must be alleged and proven; mere nationwide accessibility should not be treated as permission to choose any convenient city.

The complaint is initially filed with the prosecution office whose territorial jurisdiction corresponds to the proper court venue. Because the locations of the author, device, servers, complainant, and alleged damage may differ, venue should be reviewed before filing.

3. Prepare the complaint package

Under the current DOJ-National Prosecution Service rules, a regular preliminary-investigation complaint generally includes:

The original complaint-affidavit;
Two duplicate copies for the prosecution office, plus a copy for every respondent;
A completed NPS Investigation Data Form;
Affidavits of witnesses; and
All supporting documentary, electronic, and other evidence.

The complaint-affidavit should state the parties’ names and addresses, the date and place of the offense, the material facts, discovery date, authorship basis, venue facts, and supporting evidence. It must be properly sworn before a prosecutor, authorized government officer, or notary, as applicable.

Receiving-office checklists, fees, copy requirements, and available electronic-filing procedures may change. Confirm them directly with the relevant prosecution office. If filing electronically, obtain confirmation that the complaint was accepted and docketed; a sent email alone is not reliable proof of filing.

4. Consider investigative assistance

A complainant may seek assistance from the NBI Cybercrime Division or a Regional Cybercrime Center. The NBI’s process includes a complaint form, sworn statements, supporting documents, and examination of relevant devices when appropriate. The DOJ Office of Cybercrime also acts on cybercrime complaints and referrals.

Investigation can help identify an anonymous author and preserve provider data, but do not let it consume the one-year period without confirming that the criminal complaint has been filed in the proper forum.

5. Participate in preliminary investigation

Cyber libel carries a penalty that places it under the DOJ’s regular preliminary-investigation process. The prosecutor applies the current standard of prima facie evidence with reasonable certainty of conviction.

If the complaint is sufficient, the prosecutor issues a subpoena with the complaint and annexes. The respondent’s submission date must be at least 10 days from receipt of the subpoena and complaint. The prosecutor may then consider the matter submitted, conduct a physical or virtual clarificatory hearing, or require a reply-affidavit and rejoinder-affidavit. When required, those responsive affidavits must observe the periods fixed by the prosecutor and the DOJ rules.

The prosecutor either dismisses the complaint or recommends filing an information. An aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. Further DOJ review is governed by separate, strict rules and does not automatically suspend a court case; obtain counsel immediately.

6. If an information is filed

The information is filed in the designated Regional Trial Court acting as a cybercrime court. The judge independently determines probable cause for issuing a warrant of arrest.

A warrant is not issued merely because someone complained. If a warrant is issued, the accused may generally apply for bail because cyber libel is bailable before conviction. Arraignment, pretrial, trial, and any civil claim deemed instituted with the criminal action then follow.

The private complainant supplies evidence and may participate through private counsel where permitted, but the criminal prosecution is brought in the name of the People of the Philippines. A later affidavit of desistance does not automatically require dismissal.

How to defend a complaint

Act immediately upon receiving a subpoena

Read the subpoena’s date, filing instructions, and attachments. Note the actual date and manner of service. If the complaint or annexes are incomplete, promptly request the missing material and document the request.

Do not assume that filing a motion to dismiss suspends the deadline. Under the DOJ rules, a motion to dismiss in place of a counter-affidavit is generally not allowed unless it is verified and contains the respondent’s defenses, in which case it may be treated as the counter-affidavit.

Prepare an element-by-element counter-affidavit

Address, with admissible supporting evidence:

Whether the respondent authored or controlled the account;
The complete context and ordinary meaning of the statement;
Whether the complainant was identifiable;
Whether any third person received the statement;
Whether the communication was privileged;
Whether the statement concerned a public official, public figure, or public matter requiring proof of actual malice;
The factual sources available before publication;
Truth, good motives, and justifiable ends where legally applicable;
Whether the complaint was filed within one year from the provable discovery date;
Whether venue is properly alleged and supported;
Whether the post predates the effectivity of the Cybercrime Prevention Act;
Inconsistencies between the complaint, annexes, account, post, and technical records; and
Any unlawful or unreliable method used to obtain the evidence.

Attach sworn witness affidavits and records rather than relying on argument alone. A preliminary investigation is ordinarily decided on written submissions; it is not the time to hold back a complete defense in the hope of explaining later.

Preserve, do not manipulate

Do not delete the account, wipe a device, alter the post, manufacture a correction date, ask witnesses to change their accounts, or pressure the complainant. Consult counsel before editing or taking down disputed content so the original can first be preserved and the legal effect assessed.

Avoid retaliatory posts. New statements may create separate evidence, additional counts, or other offenses.

If investigators seek devices or account access

Ask to see and copy the warrant, identify the issuing court, and note its exact scope. Contact counsel immediately. Do not obstruct a lawful search, but do not casually consent to a broader search, disclose passwords, or surrender unrelated data without legal advice.

Document the devices and property taken, the officers involved, and the inventory or receipt. Challenges to a cybercrime warrant are highly technical and time-sensitive.

If arrested or invited for questioning

An invitation can become custodial questioning depending on the circumstances. State respectfully that you wish to remain silent and consult a lawyer. Do not sign an affidavit, consent form, account-access form, or admission you do not understand.

If arrested, ask for counsel and prompt assistance with bail. Qualified applicants may seek help from the Public Attorney’s Office, the IBP National Center for Legal Aid, or the judiciary’s Unified Legal Aid Service.

Possible penalties and civil liability

The statutory imprisonment range for cyber libel is one degree higher than ordinary libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years. The sentence ultimately imposed depends on the applicable penalty rules, circumstances, and the Indeterminate Sentence Law.

The Supreme Court has held that a court may impose a fine instead of imprisonment. Under its current computation, the alternative fine for online libel ranges from ₱40,000 to ₱1,500,000. Imprisonment remains legally available, and the law also permits both imprisonment and fine where warranted; a fine-only outcome is not guaranteed.

Civil indemnity and proven moral, actual, temperate, or exemplary damages may also be awarded when legally justified. An independent civil action for defamation may proceed under Article 33 of the Civil Code on a preponderance of evidence, but there can be no double recovery for the same act.

Disini prevents double punishment of a single act as both ordinary libel and cyber libel. Distinct posts or independently authored defamatory statements may, however, present separate factual questions and possible counts.

Common mistakes

Counting one year from the posting date without investigating the legally relevant discovery date;
Waiting for a platform takedown, apology, demand-letter response, or completed NBI investigation before filing;
Assuming that a police or platform report automatically interrupts prescription;
Filing in a city merely because the post could be accessed there;
Submitting cropped screenshots without URLs, context, originals, or an authenticating witness;
Treating a profile name as conclusive proof of authorship;
Assuming truth alone is always a complete defense;
Calling an accusation “opinion” while presenting it as a verifiable fact;
Assuming “allegedly” cures an otherwise false factual charge;
Naming everyone who liked or shared a post without evidence that each authored a new defamatory statement;
Ignoring a prosecutor’s subpoena because it is not a court summons;
Filing only a motion to dismiss instead of a complete sworn counter-affidavit;
Deleting posts, messages, devices, or login histories after receiving a demand or subpoena;
Posting the complaint, counter-affidavit, or evidence publicly and creating further legal or privacy problems; and
Assuming an apology, settlement, or affidavit of desistance automatically ends a criminal case.

When legal help is urgent

Consult a Philippine lawyer immediately when:

The first anniversary of discovery is approaching;
The account is anonymous, compromised, or rapidly deleting content;
Provider or device data may soon be lost;
A subpoena, prosecutor’s resolution, information, arraignment notice, or warrant has been received;
Police or NBI officers seek an interview, device, password, or consent to search;
The disputed statement accuses someone of a serious crime or corruption;
The complainant is a public official or the case concerns journalism or public-interest reporting;
Several people, posts, platforms, or provinces are involved;
The post includes threats, doxxing, intimate material, a child, or fabricated records, because other criminal and protective laws may apply; or
A party is considering a correction, takedown, settlement, or public response that could affect evidence or liability.

Frequently asked questions

Must I send a demand letter before filing?

No. A demand, correction request, or takedown notice is not a statutory prerequisite to a cyber-libel complaint. It may be strategically useful, but it must not cause the one-year period to expire.

Is a false post automatically cyber libel?

No. The statement must also be defamatory, identifiable, published to a third person, malicious under the applicable standard, made through a computer system, and attributable to the accused.

Can a true statement still create liability?

Potentially. Philippine libel law does not treat truth as an automatic defense in every situation. Article 361 also requires good motives and justifiable ends for acquittal when the truth defense applies.

Is a private Facebook group or group chat “publication”?

It can be. Publication requires communication to at least one person other than the complainant; it does not require a fully public account.

Is one private message to the complainant cyber libel?

Ordinarily, not without communication to a third person, because publication is missing. Threats, harassment, coercion, sexual harassment, or other offenses may still apply.

Can I sue an anonymous account?

An investigation may begin using the account’s identifying details and preserved evidence, but the responsible person must ultimately be identified and connected to the content. Seek prompt investigative assistance because provider records may be time-limited.

Can I ignore a prosecutor’s subpoena?

That is risky. If properly served and no justified response is filed, the prosecutor may decide the complaint on the existing record.

Does deleting the post end the case?

No. Deletion does not erase an already completed publication. It may reduce continuing harm, but deleting or altering evidence after notice of a dispute can damage credibility and complicate the case.

Will the accused automatically be jailed?

No. A complaint does not equal conviction, and a prosecutor’s subpoena is not an arrest warrant. If an information is filed, the judge independently determines probable cause. Cyber libel is bailable before conviction, and a court may ultimately impose a fine instead of imprisonment.

Can the parties settle?

They may discuss correction, apology, takedown, damages, or desistance with counsel. Because the criminal case belongs to the State, a private settlement or affidavit of desistance does not automatically compel the prosecutor or court to dismiss it.

Official legal sources

This article provides general Philippine legal information, not advice for a particular case. Cyber-libel outcomes depend heavily on the exact words, complete context, authorship evidence, discovery date, venue, documents, and procedural history. Law and official guidance were checked through 1 August 2026.