Quick answer

A cyber libel case may be filed when an identifiable person or organization is dishonored or discredited by a malicious statement published through a computer system, and the prosecution can connect the accused to the original online publication. A harsh opinion, insult, negative review, or false statement is not automatically cyber libel; every legal element must be established.

A complainant should preserve the complete online evidence and file a sworn complaint with the proper city, provincial, regional, or state prosecution office—normally within one year from discovery of the publication. A police report, platform report, demand letter, or barangay complaint should not be assumed to stop that period.

A respondent should never ignore a prosecutor’s subpoena. The counter-affidavit should address authorship, the exact words and context, publication to another person, identification, malice, privilege, truth where legally available, prescription, and venue. Once an information reaches court, arrest, bail, arraignment, and motion deadlines can arise quickly.

Cyber libel remains a criminal offense under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, read with Articles 353 to 355 and 361 of the Revised Penal Code.

What the prosecution must prove

The prosecution must establish all of the following:

A defamatory imputation. The statement must attribute a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose someone to contempt. Courts read the entire statement in its context and in its plain, natural, and ordinary meaning—not by isolating a provocative word.
Publication. The statement must have been communicated to at least one person other than the person allegedly defamed. A message sent only to the complainant ordinarily lacks this element, although a group chat, public post, restricted social-media group, email copied to others, or message deliberately shown to another person may qualify.
Identification. The complainant must be named or identifiable from the words and surrounding circumstances. A nickname, photograph, position, workplace, relationship, or combination of details may be enough even when no full name appears.
Malice. For a private complainant, malice is generally presumed from a defamatory statement unless the communication is privileged. When the complainant is a public official or public figure and the stricter constitutional standard applies, the prosecution must prove actual malice—knowledge of falsity or reckless disregard of whether the statement was false. Mere negligence is not necessarily actual malice.
Use of a computer system or ICT. This includes social-media posts, websites, blogs, online videos, emails, and similar digital publications.
Authorship and identity of the offender. The prosecution must prove that the respondent was the original author of the defamatory online publication. A name and profile photograph alone may not settle authorship, particularly where hacking, impersonation, shared access, or a dummy account is genuinely in issue.

The Supreme Court’s guideposts permit authorship or account control to be established through direct or circumstantial evidence, including admissions, observations of account use, information known only to the alleged author, distinctive language, prior account activity, consistent conduct, platform or telecommunications records, geolocation, and device examinations. Technical evidence is useful but is not indispensable. See the Supreme Court’s official summary of XXX v. People, G.R. No. 274842.

Who may be liable for likes, shares, and comments?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as to the original author, but declared it unconstitutional as applied to people who simply receive and react to the post. It also invalidated the Cybercrime Prevention Act’s aiding-or-abetting provision as applied to cyber libel.

A mere like, uncomplicated share, or reaction to someone else’s post therefore should not be treated as authorship of the original libel. The result changes when a person adds a new defamatory allegation. A comment such as a fresh accusation of theft or abuse may itself be an original online publication and must be evaluated separately.

The one-year filing period

The Supreme Court has definitively held that cyber libel prescribes in one year from the date it is discovered by the offended party, the authorities, or their agents. The Court affirmed this rule en banc in its April 8, 2026 resolution in Causing v. People, G.R. No. 258524.

Under Article 91 of the Revised Penal Code, prescription is interrupted by filing the complaint or information. Current jurisprudence treats filing with the prosecution office as the event that institutes criminal proceedings for this purpose.

Because the discovery date can itself be disputed:

Record when and how the complainant first learned of the post.
Identify the first person who sent or showed it to the complainant.
Preserve that person’s message and obtain an affidavit if appropriate.
Do not wait until the anniversary date.
Do not assume that continuing online availability creates a fresh one-year period.
Do not rely on a demand letter, platform report, police blotter, takedown request, or settlement discussion to interrupt prescription.

Article 91 also contains rules on interrupted proceedings and an offender’s absence from the Philippines. Exact computation should be reviewed by counsel using the publication, discovery, filing, travel, and procedural records.

Evidence to preserve immediately

Capture the evidence before requesting deletion or confronting the account holder.

Preserve:

Full-page screenshots showing the exact post, account name, profile, date, time, privacy setting, URL, reactions, comments, and surrounding discussion.
A screen recording that starts from the account profile and navigates to the post.
The original URL, post ID, username, profile link, and any archived or cached copy.
Original images, videos, voice recordings, emails, and downloaded files with metadata intact.
The device used to view or receive the publication.
Messages showing when the post was first discovered.
Names and contact details of people who saw the publication.
Evidence linking the account to its alleged operator, such as prior messages, admissions, distinctive expressions, connected accounts, or known contact details.
For a respondent, login alerts, access histories, password-reset notices, evidence of hacking, shared-account arrangements, work records, device records, and communications showing who had access.
Proof of resulting harm, if damages will be claimed: lost customers, cancelled transactions, employment records, medical or psychological records, and relevant communications.

Avoid cropped screenshots when the omitted context could matter. Do not annotate, enhance, overwrite, or repeatedly resave the only copy. Keep an untouched original and document who collected it, when, and how.

If platform or subscriber records may identify an anonymous account, approach the NBI Cybercrime Division or an appropriate police anti-cybercrime unit promptly. Law-enforcement preservation measures and court-authorized disclosure may be necessary. Private parties generally cannot compel a platform or telecommunications provider to disclose protected subscriber, traffic, or content data on their own.

The NBI publishes an online complaint page and official guidance on investigative assistance for victims of computer crimes. Reporting to an investigative agency, however, is not a substitute for timely filing with the proper prosecution office.

How to file a complaint

1. Evaluate the exact publication

Quote the precise words complained of and preserve the complete context. Explain who could identify the complainant, who received or viewed the material, why it was defamatory, and what connects the respondent to its authorship.

If the language is Filipino, Cebuano, Ilocano, or another Philippine language, retain the original wording and provide an accurate English translation where needed. Explain slang, local expressions, images, and contextual references rather than assuming their meaning is self-evident.

2. Determine the proper venue

Cybercrime actions under Sections 4 and 5 of the Cybercrime Prevention Act belong in a designated Regional Trial Court acting as a cybercrime court. Under Section 2.1 of the Rule on Cybercrime Warrants, the action may be filed where:

the offense or any element occurred;
any part of the computer system used is situated; or
damage to the natural or juridical person took place.

The court where the action is first properly filed acquires jurisdiction to the exclusion of the others. The complaint should therefore go to the prosecution office corresponding to a legally supportable venue, with facts showing why that location is proper. Mere online accessibility in a chosen city should not be used as a convenient but unsupported venue. The rule is reproduced in the Supreme Court’s discussion in Tieng v. People.

3. Prepare a sworn, evidence-supported complaint

The filing normally includes:

the current National Prosecution Service Investigation Data Form;
a complaint-affidavit stating facts based on personal knowledge;
witness affidavits;
authenticated or properly identified electronic and documentary evidence;
the respondent’s address, if known; and
the required copies, identification, and filing requirements of the receiving office.

Requirements and available filing methods can change. Confirm them with the relevant prosecution office and consult the DOJ’s official preliminary-investigation filing requirements and forms page.

A bare screenshot and an assertion that “this account belongs to the respondent” may be inadequate. The complaint should be capable of proving every element and authorship with admissible, credible, preservable evidence.

4. Participate in the preliminary investigation

Cyber libel undergoes regular preliminary investigation under the 2024 DOJ–National Prosecution Service Rules. These rules require prima facie evidence with reasonable certainty of conviction—evidence that is admissible, credible, preservable, and capable of establishing the offense and the responsible person if left uncontradicted. The Supreme Court upheld these rules in Meking v. Remulla, G.R. No. 280455.

If the complaint survives initial evaluation, the prosecutor issues a subpoena with the complaint and attachments. The respondent is directed to submit a counter-affidavit on the scheduled date, which should allow at least ten calendar days from receipt. Extensions are limited and should never be assumed.

The prosecutor may call a clarificatory hearing, require additional evidence, or use available virtual procedures. Preliminary investigation is ordinarily affidavit-based; it is not a full trial with party-led cross-examination.

5. Act promptly on the resolution

If the prosecutor finds the required evidence, an information is filed in the designated RTC. The judge then independently evaluates judicial probable cause and may dismiss the case, require additional evidence, issue a summons where allowed, or issue a warrant of arrest.

An aggrieved party may generally move for reconsideration of the prosecutor’s resolution within 15 days from receipt under DOJ Department Circular No. 15. A petition for review may also be available under the applicable DOJ appeal rules. Filing a review does not automatically stop court proceedings; immediate legal advice is important, particularly if an information has already been filed.

How to defend a complaint

Do not ignore the subpoena

Failure to file a counter-affidavit allows the prosecutor to resolve the complaint using the complainant’s evidence alone. Immediately record:

the date and manner the subpoena was received;
the stated filing or hearing date;
every attachment actually provided; and
any missing, unreadable, or voluminous evidence.

Ask for access to evidence not furnished with the subpoena. If additional time is genuinely necessary, seek it promptly and explain the concrete reason; approval is discretionary.

Preserve the account and devices

Do not delete posts, wipe devices, fabricate screenshots, alter logs, or coach witnesses. Secure the account, change compromised credentials where appropriate, preserve security notifications, and document who had access. Stop discussing the allegations publicly. A defensive social-media campaign can create additional evidence or a separate defamatory publication.

Address every element in the counter-affidavit

Possible defenses, depending on the evidence, include:

The words are not defamatory when read in full context.
The language is criticism, satire, rhetorical exaggeration, or opinion that does not assert or imply a provably defamatory fact.
No third person received or understood the communication.
The complainant was not named and could not reasonably be identified.
The respondent did not own, control, access, or author the account or post.
The respondent merely received, liked, or shared another person’s content without creating a new defamatory allegation.
The action prescribed before the complaint was filed.
Venue is unsupported by the facts.
The communication was privileged.
The statement was true and made with good motives and for justifiable ends, where Article 361 permits that defense.
The complainant is a public official or public figure and the required actual malice is absent.
The evidence is incomplete, altered, unauthenticated, hearsay, or incapable of proving authorship and the elements with reasonable certainty of conviction.

A simple denial or assertion that an account was “probably hacked” is rarely persuasive without supporting facts. Explain who else had access, when the compromise occurred, what security alerts appeared, what steps were taken, and whether device, platform, workplace, location, or witness records corroborate the account.

Review the information before entering a plea

Once the case reaches court, counsel should promptly examine whether the information alleges the offense, authorship, publication, discovery date, and proper territorial jurisdiction. Grounds such as prescription, failure to charge an offense, or lack of jurisdiction may require action before arraignment. Entering a plea can waive some objections.

Cyber libel is bailable before conviction. If a warrant has been issued, counsel can coordinate a lawful voluntary surrender and bail application. Do not evade service or attempt to negotiate with law-enforcement personnel informally.

Privilege, truth, and public-interest speech

Privileged communications

Article 354 recognizes qualified privilege for:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments or remarks, of non-confidential judicial, legislative, or official proceedings, statements made in them, or acts performed by public officers in their functions.

Privilege is not a license to publish accusations to an unnecessarily broad audience. Relevance, good faith, proper recipients, excessive publication, and malice in fact remain important.

Truth is not an automatic defense

Under Article 361, proving truth generally must be accompanied by proof that publication was made with good motives and for justifiable ends. Special rules govern when the imputation is not a crime and concerns a government employee’s official duties. “It was true” should therefore never be treated as a complete defense without examining the nature of the accusation, supporting records, purpose, and audience.

Public officials and public figures

Public affairs receive broader constitutional protection. Where the stricter rule applies, actual malice means that the author knew the statement was false or acted with a high degree of awareness of probable falsity. Failure to investigate perfectly, standing alone, does not necessarily establish actual malice.

This protection does not excuse knowingly false accusations, invented sources, manipulated evidence, or personal attacks unrelated to public conduct.

Possible penalties and civil liability

For cyber libel, the imprisonment range is one degree higher than for traditional written libel: four years, two months, and one day to eight years. For offenses governed by the amended fine in Article 355, the Supreme Court has calculated the cyber-libel fine at ₱40,000 to ₱1,500,000. Depending on the circumstances and the applicable law at the time of the offense, the court may impose imprisonment, a fine, or both.

The Supreme Court has confirmed that a court may impose a fine alone; imprisonment is not mandatory in every conviction. See People v. Soliman, G.R. No. 256700.

Civil liability for damages may accompany the criminal action. Under the Rules of Criminal Procedure, the civil action arising from the offense is generally deemed instituted with the criminal case unless it is waived, reserved, or previously filed. Separate civil remedies for defamatory falsehoods may also exist, but venue, prescription, reservation, and consolidation rules require careful handling.

The same online publication should not be charged simultaneously as both ordinary libel and cyber libel. Disini held that doing so for the same defamatory material violates the rule against double jeopardy.

Common mistakes

Waiting for a platform to respond while the one-year period runs.
Treating a police blotter, demand letter, or barangay proceeding as the formal prosecutorial filing.
Capturing only a cropped sentence without the URL, profile, date, audience, or surrounding thread.
Assuming a profile name and photograph conclusively prove authorship.
Accusing every liker or sharer instead of identifying the original author or a genuinely new defamatory publication.
Assuming falsity alone proves cyber libel.
Assuming truth alone guarantees acquittal.
Filing in a convenient city without factual support for venue.
Missing the counter-affidavit or reconsideration deadline.
Deleting the post or account before preserving evidence.
Posting threats, counter-accusations, or supposed “exposés” while the dispute is pending.
Paying an unofficial intermediary who promises to delete records, stop a warrant, or guarantee dismissal.

When legal help is urgent

Seek a Philippine criminal-law practitioner immediately when:

the one-year anniversary of discovery is approaching;
a subpoena, prosecutor’s resolution, information, summons, or warrant has been received;
the account is anonymous, hacked, deleted, or controlled from abroad;
subscriber or platform records may soon be unavailable;
the post concerns a journalist, public official, public figure, election, or matter of public interest;
several people or corporate accounts had access to the account;
there are related threats, stalking, doxxing, sexual content, extortion, identity theft, or violence;
the complainant seeks substantial damages;
a takedown, apology, or settlement is being negotiated; or
the same act has been charged under multiple criminal laws.

If there is an immediate threat to life or safety, contact emergency services or the police first. Preserve the threatening material separately because it may constitute an offense distinct from cyber libel.

Frequently asked questions

Is a demand letter required before filing?

No. It may help request correction, apology, takedown, or settlement, but it is not an element or prerequisite of cyber libel and should not be allowed to consume the prescriptive period.

Is one screenshot enough?

Sometimes it may support a complaint, but it may not prove context, publication, authenticity, authorship, or the discovery date. Preserve the complete post, account, URL, metadata, witnesses, and original device whenever possible.

Does deleting or apologizing erase criminal liability?

No. Deletion or apology does not undo a completed publication. It may affect settlement, damages, credibility, or the eventual penalty, but it does not automatically dismiss a criminal case.

Can the parties settle?

They may discuss retraction, apology, damages, and desistance. However, cyber libel is prosecuted in the name of the People of the Philippines. Once a case is filed, an affidavit of desistance does not automatically bind the prosecutor or court.

Can an anonymous account be charged?

Yes, if investigation identifies the person responsible and the evidence proves authorship. Preservation requests, platform records, subscriber information, device evidence, admissions, and circumstantial evidence may be relevant. A warrant is generally required for compelled disclosure of protected computer data.

Does a private group chat count as publication?

It can. Publication requires communication to a third person, not publication to the entire internet. The limited audience may still affect privilege, malice, damages, and context.

Can I be liable for repeating another person’s accusation?

A simple reaction or share is treated differently from original authorship under Disini. But adding a fresh defamatory accusation, adopting it in a new factual narrative, or creating a separate defamatory post may expose the new author to liability.

Can a case be filed over a post made abroad?

Possibly. Section 21 of the Cybercrime Prevention Act provides jurisdiction in specified circumstances, including offenses by Filipino nationals regardless of place and cases where an element, relevant computer system, or damage has the required Philippine connection. Venue and access to foreign evidence remain fact-dependent.

When does the one-year period begin?

From actual discovery by the offended party, authorities, or their agents—not automatically from the public-posting date. The party asserting a discovery date should be prepared to prove it.

Official legal references

This article provides general legal information, not advice for a particular complaint, defense, or deadline. Cyber-libel outcomes depend on the exact words, audience, documents, authorship evidence, discovery date, and procedural record. Consult a Philippine lawyer for case-specific advice. Law and official sources checked as of August 4, 2026.