Quick answer

A cyber libel case generally starts with a sworn complaint and supporting evidence filed with the proper Office of the City or Provincial Prosecutor. The prosecution must establish a defamatory online imputation, publication to at least one person other than the person defamed, an identifiable victim, malice, use of a computer system or information and communications technology, and the respondent’s responsibility as the author of the material.

If you are filing, preserve the post and evidence of authorship before requesting removal, identify the correct venue, and act quickly. The Supreme Court has now ruled with finality that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents—not automatically from the posting date. Filing the complaint or Information interrupts prescription, subject to Article 91 of the Revised Penal Code. The discovery date is often a disputed factual issue. See Causing v. People, G.R. No. 258524, April 8, 2026.

If you are defending, do not ignore a prosecutor’s subpoena. The current DOJ-NPS procedure normally gives a respondent at least 10 days from receipt to submit a sworn counter-affidavit and supporting evidence. Record the date and manner of service, obtain the complete complaint and attachments, and consult counsel immediately.

What counts as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the defamatory material is published through a computer system or similar technology. This can include social-media posts, online articles, blogs, emails, digital images, videos, and messages sent through online platforms.

The prosecution ultimately must prove every element beyond reasonable doubt:

Defamatory imputation. The words, images, or surrounding message impute a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication. At least one third person received, read, viewed, or heard the material. A post need not be viral. A message sent only to the person criticized ordinarily lacks publication, but sending it to another person or a group chat may satisfy this element.
Identification. The complainant must be named or sufficiently identifiable from the material and surrounding circumstances. Using initials, a nickname, a photograph, an office, or indirect clues can be enough if readers understood who was being discussed.
Malice. Depending on the circumstances, malice may be presumed from the defamatory character of the statement or must be proved as actual malice.
Use of ICT. The publication was made through a computer system, mobile phone, social-media platform, or comparable technology.
Authorship or legal responsibility. The evidence must reliably connect the respondent to the material.

The complete post matters. Courts assess the words in their ordinary meaning and in context, rather than isolating one phrase or accepting a strained interpretation.

General rules and important exceptions

Mere insult is not automatically cyber libel

A statement may be rude, unfair, sarcastic, exaggerated, or offensive without satisfying all the elements of libel. The question is whether, viewed as a whole and in context, it makes a defamatory imputation about an identifiable person and satisfies publication and malice requirements.

A private person and a public figure are treated differently

For a defamatory statement about a private person, Article 354 generally presumes malice unless the communication is privileged or good intention and justifiable motive are shown.

When the statement concerns a public official, public figure, or a matter of public interest, liability generally requires proof of actual malice—that the author knew the statement was false or acted with reckless disregard of whether it was false. This protection is not unlimited. A deliberate or recklessly false factual accusation is not immunized merely because its target holds public office.

Statements about a public official’s purely private life may also be treated differently from criticism concerning official conduct. The precise subject, context, factual basis, and language used are important.

Privileged communications

Potentially qualified privileged communications include:

A private communication made in the performance of a legal, moral, or social duty, sent only to persons with a corresponding interest or duty.
A fair and true report, made in good faith and without added comments, of a nonconfidential judicial, legislative, or official proceeding or an official act.
Fair comment on matters of public interest when based on true or substantially established facts.

Qualified privilege is not absolute. It can be defeated by proof of actual malice, unnecessary publication, lack of a corresponding duty or interest, or departure from a fair report.

Truth is not always enough by itself

In a criminal libel prosecution, truth is generally a defense only when accompanied by good motives and justifiable ends. Article 361 also restricts proof of a true imputation that does not constitute a crime, except when it concerns a government employee and facts related to official duties.

A defendant should therefore preserve not only evidence that the statement was true, but also evidence showing responsible verification, legitimate purpose, limited and appropriate publication, and absence of personal spite.

Likes, reactions, shares, and comments

In Disini v. Secretary of Justice, the Supreme Court limited cyber-libel liability to the author of the libelous statement and invalidated the application of the Cybercrime Prevention Act’s general aiding-or-abetting provision to online libel. Merely receiving, liking, reacting to, or sharing an existing post is not automatically cyber libel.

A person who adds a new defamatory caption, accusation, comment, edited image, or voice-over may, however, become the author of that new material. Liability must be assessed according to the person’s own words and acts.

The same material should not be charged twice as traditional and online libel

Cyber libel is the online means of committing the same underlying offense of libel. The State cannot obtain separate convictions for traditional libel and cyber libel based solely on the same defamatory material and publication. Distinct publications or newly authored material require a fact-specific analysis.

The one-year deadline

The controlling rule is now:

Cyber libel prescribes in one year.
The period begins when the alleged crime is discovered by the offended party, the authorities, or their agents.
A public post does not create an automatic legal presumption that the complainant discovered it on the posting date.
Filing the complaint or Information interrupts prescription.
The period may run again if the proceeding terminates without conviction or acquittal or is unjustifiably stopped for a reason not attributable to the accused.
Prescription does not run while the offender is absent from the Philippines, under Article 91.

Discovery must be proved from the facts. Relevant evidence can include the first screenshot, the date a friend forwarded the post, a comment or reaction by the complainant, a demand letter, a message threatening suit, an incident report, or other conduct demonstrating knowledge.

Do not wait until the final days. Questions about the discovery date, valid filing, venue, and interruption of prescription can determine whether a case survives.

A separate civil action for defamation is also generally subject to a one-year prescriptive period under Article 1147 of the Civil Code, although its accrual and any applicable interruption or tolling require separate analysis.

How to file a cyber libel complaint

1. Preserve the material before seeking removal

Save evidence in a way that shows both the content and its online context:

Full screenshots showing the exact words, images, account name, profile details, date and time, URL, post identifier, and visible audience or privacy setting.
A screen recording that begins with the account profile and navigates to the post.
The original image, video, audio, email, or downloadable file.
The complete conversation or thread, including material before and after the disputed statement.
Comments, reactions, shares, and other indications that third persons viewed the material.
The device used to access or receive the material, if practical.
A written record of when, where, and from whom you first learned about it.
Messages or records connecting the account to the suspected author.

Keep an untouched master copy and make working copies. Record who collected each item, when it was collected, and how it was stored. Do not crop away account details or edit files in a way that changes metadata.

Screenshots are useful but are not automatically conclusive. Under the Rules on Electronic Evidence, the party offering an electronic document must establish its authenticity, integrity, and reliability. A witness with personal knowledge, platform or device records, admissions, account information, metadata, or lawfully obtained provider data may be needed. The Supreme Court explains these requirements in RCBC Bankard Services Corp. v. Oracion.

2. Identify witnesses and proof of harm

Ask people who personally saw the material to record:

How and when they saw it.
The account or link through which they accessed it.
Whom they understood the post to concern.
Whether they knew the suspected author’s account.

Preserve documentary proof of resulting harm, such as lost contracts, employment consequences, canceled transactions, threats, professional complaints, medical expenses, or communications reflecting reputational damage. Actual financial loss is not an element of the crime, but it may matter to damages.

3. Address anonymous or fake accounts promptly

If authorship is uncertain, consider requesting investigative assistance from the NBI Cybercrime Division or another authorized cybercrime law-enforcement unit. The NBI’s official procedure is available through its Cybercrime Division citizens’ charter.

Authorized law-enforcement officers—not private complainants acting alone—may seek preservation and disclosure orders or cybercrime warrants for relevant subscriber, traffic, or computer data. Under Sections 13 and 14 of RA 10175, certain provider data have limited preservation periods, making delay risky.

Do not hack an account, obtain passwords through deception, install spyware, or secretly access another person’s private device. Unlawfully acquired information can create separate legal problems and evidentiary objections.

4. Determine the proper venue

Cybercrime venue is jurisdictional and should not be guessed. Under the Rule on Cybercrime Warrants, a cybercrime action may be filed in the designated cybercrime court of the city or province where:

The offense or any element occurred;
Any part of the computer system used is situated; or
Damage to the natural or juridical person occurred.

The court where the criminal action is first validly filed acquires jurisdiction to the exclusion of the others. Mere internet accessibility in a place does not automatically make every court in the country a proper venue.

The complaint for preliminary investigation should therefore be filed with the prosecution office corresponding to a legally supportable venue. State the specific venue facts in the complaint. Cross-border posts, mobile publication, multiple complainants, and uncertain device locations require particular care.

5. Prepare the complaint-affidavit

The complaint-affidavit should clearly and chronologically state:

The complainant’s and respondent’s identifying information and addresses, if known.
The exact defamatory material, not merely a summary.
The URL, platform, account, posting date, and manner of online publication.
Why the statement refers to the complainant.
Who saw or received it.
Why the respondent is believed to be the author.
When and how the complainant or authorities discovered it.
Facts establishing proper venue.
Facts addressing malice, falsity, privilege, and anticipated defenses.
The relief and prosecution requested.

Attach witness affidavits and organized, labeled exhibits. Under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, the original complaint, a copy for each respondent, and the NPS Investigation Data Form are ordinarily required. Confirm the receiving office’s current filing checklist and whether it permits electronic filing.

6. Participate in the preliminary investigation

The prosecutor first determines whether the complaint and evidence establish prima facie evidence with reasonable certainty of conviction. This means the evidence must be admissible, credible, preservable, and capable of establishing every element and the responsible person if left uncontradicted. The Supreme Court upheld this DOJ standard in Meking v. Remulla, G.R. No. 280455, November 11, 2025.

The respondent will receive a subpoena with the complaint and attachments and will be given at least 10 days from receipt to submit a counter-affidavit. The prosecutor may require reply and rejoinder affidavits or conduct a clarificatory hearing.

The current rules generally direct resolution of a complete regular preliminary-investigation record within 60 calendar days, with a possible 30-day extension for a complex case. These are case-processing periods, not a guarantee that every office will release its resolution on that date.

How to defend a cyber libel complaint

1. Treat the subpoena deadline as urgent

Write down the exact date, time, address, and manner in which the subpoena was received. Obtain every page of the complaint, witness affidavits, and exhibits.

The subpoena must allow at least 10 days from receipt for the counter-affidavit. An extension is not automatic and is allowed only when the interests of justice require it, such as reasonable time to obtain counsel or verify the authenticity of evidence. File any request before the deadline and comply unless an extension is actually granted.

A motion to dismiss generally cannot substitute for the counter-affidavit. If the respondent fails to answer after proper service, the prosecutor may resolve the complaint using the complainant’s evidence alone.

2. Preserve your own evidence

Before deleting or changing anything, preserve:

The complete original post and surrounding thread.
Drafts, source materials, notes, research, and records consulted.
Messages showing how the material was created or obtained.
Account-security records, login alerts, device history, and evidence of hacking or impersonation.
Communications showing the post’s intended audience and purpose.
Documents supporting truth, verification, good motive, or public interest.
Proof of when the complainant first learned about the material.

After preservation, seek advice about taking the material down. Deletion does not erase an already completed publication, but leaving harmful material online may increase practical damage.

3. Test every element

A proper defense is evidence-based. Relevant issues may include:

The statement is not defamatory when read as a whole.
It is rhetorical opinion or fair comment based on disclosed, true facts.
The complainant is not identifiable.
No third person received the communication.
The respondent did not create or publish the material.
The account was fake, compromised, or controlled by someone else.
The evidence does not reliably authenticate the post or identify its author.
The communication was privileged.
The statement was true and published with good motives and for justifiable ends.
Actual malice cannot be proved in a matter involving a public official, public figure, or public concern.
The complaint was filed in the wrong venue.
The action prescribed more than one year after provable discovery.
The material predates the effectivity of RA 10175.

Avoid a bare denial. Explain the relevant facts under oath and attach the records and witness affidavits needed to support each defense.

4. Do not litigate the case on social media

Do not threaten the complainant, attack witnesses, recruit people to repeat the accusation, or post supposedly “clarifying” statements without advice. A new caption, accusation, repost, or edited video can create new evidence or a separate issue.

Communicate through counsel when discussing correction, retraction, apology, removal, or settlement. An apology or affidavit of desistance does not automatically terminate a criminal case, because prosecution is controlled by the State. It may nevertheless affect malice, damages, mitigation, or the parties’ practical resolution.

5. Use available remedies promptly

An aggrieved party may generally move for reconsideration of the prosecutor’s resolution within 15 days from receipt under the 2024 DOJ-NPS Rules. Further review may be available through the DOJ or the courts, but the correct remedy and deadline depend on the issuing office, the stage of the case, and whether an Information has already been filed.

Once an Information is filed, the Regional Trial Court independently determines judicial probable cause. If a warrant is issued, cyber libel is generally bailable before conviction, but the court determines the bail amount and conditions. A warrant, arrest, arraignment notice, or court order requires immediate legal assistance.

Possible penalties and civil liability

Cyber libel carries a penalty one degree higher than traditional libel. Depending on the circumstances and applicable sentencing rules, imprisonment may fall within four years, two months and one day to eight years.

A court may instead impose a fine or impose both imprisonment and a fine. For offenses governed by the amended fine levels, the Supreme Court has held that the fine for online libel ranges from ₱40,000 to ₱1,500,000. See People v. Soliman, G.R. No. 256700, April 25, 2023.

Supreme Court Administrative Circular No. 08-2008 recognizes a preference for a fine rather than imprisonment in appropriate libel cases, but it does not remove imprisonment from the law or compel a fine-only sentence.

Civil liability may include proven actual, moral, and exemplary damages. Defamation can also support an independent civil action under Article 33 of the Civil Code, which proceeds under the civil standard of preponderance of evidence. Double recovery for the same injury is not allowed.

Common mistakes

Waiting for the platform to finish a takedown review while the one-year period is running.
Saving only a cropped screenshot without the URL, profile, date, thread, or witness who saw it.
Assuming that notarizing a screenshot automatically proves authenticity or authorship.
Treating every offensive statement as libel without checking identification, publication, malice, and privilege.
Assuming truth alone always ends the case.
Filing against everyone who liked, reacted to, or passively shared a post.
Filing in the most convenient city without facts establishing venue.
Naming the account holder without evidence that the person authored or controlled the post.
Ignoring the discovery date and evidence relevant to prescription.
Filing a motion to dismiss instead of a complete counter-affidavit.
Missing a subpoena, reconsideration, or court deadline while waiting for an informal settlement.
Obtaining evidence through unauthorized access to a device or account.
Retaliating online, contacting witnesses aggressively, or publishing confidential case papers.
Assuming deletion, apology, settlement, or an affidavit of desistance automatically extinguishes criminal liability.

When legal help is urgent

Speak with a Philippine criminal-litigation lawyer immediately if:

The one-year prescriptive period may expire soon.
You have received a subpoena and the counter-affidavit deadline is approaching.
A prosecutor has filed an Information or a court has issued a warrant, summons, or arraignment notice.
The account is anonymous, fake, compromised, or likely to be deleted.
Provider records or other volatile electronic evidence must be preserved.
The case involves a journalist, public official, public figure, whistleblower, workplace report, official proceeding, or privileged communication.
The post was made or hosted abroad, or the parties and devices are in different places.
The material also contains threats, intimate images, personal data, extortion demands, or allegations involving a child.

Qualified persons who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility, merit, and conflict-of-interest rules.

FAQ

Must the post be public or viral?

No. Publication exists when the material is communicated to at least one person other than the person defamed. A private group, email chain, or group chat can be sufficient.

Can a person be defamed without being named?

Yes. It is enough if readers familiar with the circumstances could reasonably identify the person. Identification must be proved, not merely asserted.

Is sharing or liking a post automatically cyber libel?

No. Mere receipt, reaction, or sharing is not automatically punishable as cyber libel. A person may nevertheless be responsible for new defamatory words, captions, edits, or accusations that the person authored.

Does deleting the post prevent a case?

No. Deletion does not undo a publication already seen by another person. Preserve the evidence first, then obtain advice about removal.

Is barangay conciliation required?

Generally, no. Cyber libel’s potential imprisonment and fine exceed the limits for offenses within mandatory Katarungang Pambarangay conciliation under Section 408 of the Local Government Code. The parties may still explore a voluntary, lawful settlement, but barangay proceedings do not replace timely filing where prescription is running.

Can I file only a civil case?

Yes, depending on the facts. Article 33 permits an independent civil action for defamation using the preponderance-of-evidence standard. A civil defamation action ordinarily has its own one-year prescriptive period, so prompt advice remains important.

Is a prosecutor’s subpoena already an arrest warrant?

No. A subpoena directs the respondent to participate in the preliminary investigation. An arrest warrant is issued by a judge after an Information is filed and the court independently finds probable cause.

Can the complainant withdraw the criminal case after an apology or settlement?

The complainant may express desistance or settle the civil aspect, but cannot unilaterally guarantee dismissal of the criminal case. The prosecutor and, after filing, the court control the criminal proceeding.

What if the author is abroad?

Philippine jurisdiction may exist when statutory connections under Section 21 of RA 10175 are present, including specified Philippine elements, computer systems, damage, or nationality. Service, evidence collection, mutual legal assistance, and enforcement can make cross-border cases substantially more complex.

Official sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Cyber libel depends heavily on the exact words, context, authorship evidence, discovery date, venue, and procedural record. The controlling sources and procedures were checked as of August 4, 2026.