Quick answer

Cyber libel is traditional libel committed through a computer system—such as a social-media post, online article, blog, email, or group chat. To file a criminal case, the complainant generally submits a sworn complaint and supporting evidence to the prosecutor’s office with territorial authority. To defend one, the respondent should answer the prosecutor’s subpoena with a timely, evidence-backed counter-affidavit.

A hurtful or critical online statement is not automatically cyber libel. The evidence must support every element of libel, use of a computer system, and the accused’s identity as the author. Privileged communication, fair comment on matters of public interest, lack of publication or identification, truth published with good motives and justifiable ends, lack of malice where actual malice must be proved, improper venue, and prescription may be relevant defenses.

Act quickly. The Supreme Court has confirmed that criminal cyber libel generally prescribes in one year from discovery by the offended party, the authorities, or their agents. Discovery, publication, interruption of prescription, and venue can involve disputed facts, so neither side should rely on a rough date calculation.

What the prosecution must establish

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the act is committed through a computer system or a similar technological means.

The evidence must establish:

A defamatory imputation. The statement imputes a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose an identifiable natural or juridical person to contempt. Courts assess the complete statement, its ordinary meaning, tone, context, and surrounding circumstances—not an isolated word alone.
Publication. Someone other than the person defamed received, read, saw, or heard the statement. A message sent only to the offended person ordinarily lacks publication; a public post, group message, forwarded email, or message sent to another person may satisfy it.
Identification. The offended person need not always be named, but the words and surrounding facts must enable readers familiar with the circumstances to identify that person.
Malice. Article 354 generally presumes malice in a defamatory imputation, even if true, unless good intention and justifiable motive are shown. The presumption changes when the communication is privileged or constitutional protections require proof of actual malice.
Use of a computer system or information and communications technology. The defamatory material must have been published online or through the relevant technology.
Authorship or responsibility. The prosecution must connect the accused—not merely a screen name—to the publication. Account records, admissions, witness testimony, device evidence, connected contact details, and lawfully obtained provider data may be relevant.

The applicable definitions and general defenses appear in Articles 353 to 361 of the Revised Penal Code.

Important limits and exceptions

Simple reactions are not treated like original authorship

In Disini v. Secretary of Justice, the Supreme Court sustained cyber libel as applied to the original author but rejected liability based merely on aiding or abetting through ordinary receipt of and reaction to a post. A simple “like” or comparable reaction is therefore not the same as authoring the defamatory statement.

That rule should not be stretched too far. A person who adds a defamatory caption, accusation, fabricated material, or substantive comment may have created a new publication of their own. Liability depends on what that person actually wrote, uploaded, or caused to be published.

Privileged communications

Article 354 recognizes qualified privilege for:

A private communication made in the performance of a legal, moral, or social duty; and
A fair and true report, made in good faith and without comments or remarks, of a non-confidential judicial, legislative, or other official proceeding, statement, report, speech, or official act.

Qualified privilege does not provide blanket immunity. It generally removes the presumption of malice, leaving the complainant or prosecution to prove actual malice or bad faith. Excessive publication, irrelevant personal attacks, fabrication, or publication to people with no legitimate interest may defeat the claimed privilege.

Some communications—such as statements made in the course of judicial proceedings that are pertinent to the case—may receive stronger protection. The exact scope depends on the speaker, occasion, audience, relevance, and purpose.

Public officials, public figures, and matters of public interest

Criticism of public conduct receives substantial constitutional protection. Fair comment is protected when it is an opinion reasonably inferred from established facts on a matter of public interest. For a public official or public figure, liability may require proof that a false factual allegation was published with knowledge of its falsity or reckless disregard of whether it was false.

Merely labeling an accusation “opinion” is not decisive. A statement framed as an opinion can still imply undisclosed or fabricated facts. Conversely, forceful, unpleasant, or mistaken commentary is not necessarily actionable when it is a reasonable inference from disclosed, established facts.

Truth is not always enough by itself

Under Article 361, truth may be offered in a criminal libel case. As a general rule, acquittal based on truth also requires proof that publication was made with good motives and for justifiable ends. Special rules govern proof of non-criminal acts and statements about government employees’ official duties.

Keep the records supporting both the truth of the statement and the legitimate reason for communicating it. Suspicion, rumor, an anonymous message, or “everyone knows it” is not a substitute for admissible evidence.

Posts made before the law applied

A publication made before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. Later publication or republication may present a different issue, depending on who performed it and when. Leaving old material accessible online should not automatically be treated as a fresh publication without examining the actual acts and controlling evidence.

Deadlines that matter

Criminal complaint: generally one year from discovery

In its April 8, 2026 resolution in Causing v. People, the Supreme Court reaffirmed that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents—not automatically from the upload date. Publication and discovery may coincide, but the Court refused to presume that every online statement is discovered as soon as it is posted.

Under Articles 90 and 91 of the Revised Penal Code:

Filing the proper complaint or information interrupts prescription.
The period may run again if the proceedings terminate without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.
The period does not run while the offender is absent from the Philippines.

The date of discovery must be supported by evidence. Save the message through which the post was first reported, the notification, email, screenshot, affidavit, or other record showing when and how it was found. A filing in the wrong place or an incomplete filing near the deadline creates serious risk.

Independent civil action: generally one year

Article 33 of the Civil Code permits a civil action for damages independent of the criminal prosecution. Civil actions for defamation are generally subject to a one-year limitation period under Article 1147, ordinarily counted from accrual of the cause of action. Rules on accrual, interruption, reservation, and the civil liability included with a criminal case require case-specific advice.

A demand letter, takedown request, apology negotiation, or platform report should not be assumed to stop either limitation period.

Where a case is filed

The criminal complaint is normally lodged for investigation with the appropriate Office of the City or Provincial Prosecutor. If sufficient evidence is found, the prosecutor files an information in the designated cybercrime Regional Trial Court.

Section 2.1 of the Rule on Cybercrime Warrants permits a criminal action under Sections 4 or 5 of the Cybercrime Prevention Act to be filed in the designated cybercrime court of the province or city:

Where the offense or any element was committed;
Where any part of the computer system used is situated; or
Where damage to a natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Venue must be alleged and supported by concrete facts. Mere nationwide accessibility of a post should not be used as a license to file wherever convenient.

How to file a criminal complaint

1. Preserve the material before requesting removal

Capture the complete publication, not just the insulting sentence. Preserve:

Full screenshots showing the account name, profile image, date, time, reactions, comments, and surrounding text;
The direct post, page, profile, video, or message URL;
A screen recording showing how the material is accessed;
The original image, video, audio, email, chat export, or downloaded page where available;
The device on which it was received or viewed;
The date, time, time zone, and circumstances of discovery;
Earlier and later versions, edits, comments, shares, and deletion notices;
Platform reports and their confirmation or reference numbers.

Do not crop away important context, annotate the only copy, or repeatedly repost the accusation to “document” it. Make working copies and retain the untouched originals.

2. Identify the precise defamatory statement

Quote or reproduce only what is necessary in the evidence and complaint. For each statement, explain:

What it communicates in context;
Why it refers to the complainant;
Who else saw or received it;
Why it is false or otherwise unlawful;
How and when it was discovered; and
What evidence connects the account to the respondent.

General allegations that a page is “destroying my reputation” are rarely enough. The prosecutor must be able to test each element against specific evidence.

3. Secure witnesses and corroborating records

Useful witnesses may include people who saw the post, recognized the complainant, received the message, communicated with the account owner, or can explain the account’s ownership and publication.

Preserve records of actual consequences, such as:

Messages referring to the accusation;
Employer, customer, school, or business communications;
Lost engagements or cancelled contracts;
Relevant medical or counseling records;
Expenses incurred in addressing the publication; and
Evidence of the publisher’s threats, admissions, hostility, prior knowledge, or refusal to correct a demonstrated falsehood.

Damages alone do not prove criminal liability, but they may help establish publication, identification, venue, motive, and civil damages.

4. Consider lawful technical assistance

A private complainant usually cannot compel a platform to reveal subscriber or traffic data. The NBI or PNP cybercrime units may investigate and seek preservation or disclosure through the procedures and court warrants authorized by law.

The NBI’s official computer-crime assistance page describes its complaint process. Reporting to investigators can be valuable when the author is anonymous, data may disappear, or forensic examination is needed. It does not replace filing with the proper prosecutor within the prescriptive period.

Do not hack an account, impersonate another person, obtain passwords without authority, install spyware, or secretly access a device. Illegally acquired material can create separate criminal, privacy, and evidentiary problems.

5. Prepare and file the complaint-affidavit

Under DOJ Department Circular No. 15, series of 2024, the filing ordinarily includes:

A properly sworn complaint-affidavit;
A completed NPS Investigation Data Form;
Witness affidavits;
Documentary, electronic, and other supporting evidence;
The original, two official-file duplicate copies, and the required copies for each respondent; and
The parties’ complete addresses and the date and place of the alleged offense.

The complaint should state the facts from personal knowledge, identify attached exhibits, explain venue and discovery, and address every element. Check the receiving office’s current local checklist and bring additional copies if required. Do not rely on email filing unless the prosecution office has confirmed or authorized the applicable electronic procedure.

6. Participate in the preliminary investigation

The prosecutor determines whether the evidence establishes prima facie evidence with reasonable certainty of conviction. This requires evidence that is admissible, credible, capable of preservation and presentation at trial, and sufficient—if uncontradicted—to establish every element and the responsible person’s identity.

The respondent will ordinarily receive the complaint and attachments with a subpoena and may file a counter-affidavit. The prosecutor may call a clarificatory hearing or require a reply and rejoinder. The parties must monitor notices and keep their addresses current.

How to defend a complaint

1. Record when and how the subpoena was received

Keep the envelope, registry record, receiving copy, email headers, and the subpoena itself. Under the 2024 DOJ rules, the date set for the respondent’s counter-affidavit must be at least 10 days from receipt of the subpoena and complaint.

The counter-affidavit is normally due on the scheduled preliminary-investigation hearing. Extensions are not automatic. An extension may be allowed in the interest of justice for a meritorious reason—such as obtaining counsel or examining voluminous or technical records—but cannot exceed 10 days.

Ignoring the subpoena permits the prosecutor to treat the complaint as submitted for resolution.

2. Obtain the complete record

Confirm that you received the complaint-affidavit, witness affidavits, screenshots, files, URLs, and other attachments. Ask counsel to compare the copies with the prosecutor’s record. Missing or illegible evidence should be raised promptly, without substituting a prohibited request for a bill of particulars for the required counter-affidavit.

3. Preserve your account, devices, and full context

Do not destroy messages, wipe devices, close accounts, alter logs, coach witnesses, or fabricate a later explanation. Preserve:

The original post and edit history;
Drafts and source documents;
The complete conversation or thread;
Account-security and login records;
Evidence of hacking, spoofing, parody, or impersonation, if genuinely relevant;
The factual sources consulted before publication;
Communications showing purpose, audience, and good faith; and
Records showing when the complainant or authorities actually discovered the post.

If ongoing publication creates additional harm, obtain legal advice about removal or correction after making a defensible preservation copy. Deletion may reduce ongoing harm, but it does not erase a completed publication or automatically prove innocence or guilt.

4. Answer each element with admissible evidence

A useful counter-affidavit addresses, as applicable:

Authorship: Did the respondent create or control the account and publish the exact statement?
Defamatory meaning: Is the challenged material a factual accusation, rhetorical language, satire, or opinion based on disclosed facts?
Publication: Was it communicated to a third person?
Identification: Could readers reasonably identify the complainant?
Computer-system use: Does the evidence establish the technological means alleged?
Malice: Is the statement privileged, fair comment, or supported by good-faith investigation?
Truth and purpose: What records establish truth, good motives, and justifiable ends?
Public status and public concern: Does the actual-malice or fair-comment standard apply?
Venue: What fact connects the case to the chosen place?
Prescription: When was the statement discovered, and what interrupted the period?
Prior publication or simple reaction: Is the respondent merely a recipient/reactor, or did they write a new statement?

Bare denial is usually weaker than documents, sworn witness accounts, original files, and a coherent chronology.

5. Follow the affidavit deadlines

If the prosecutor allows further pleadings, a reply-affidavit or rejoinder-affidavit must generally be filed within 10 calendar days from receipt of the pleading being answered. The rejoinder is the last pleading.

A motion to dismiss cannot ordinarily replace the counter-affidavit. If verified and containing the respondent’s defenses, it may instead be treated as the counter-affidavit.

6. Act immediately on the prosecutor’s resolution

An aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review is governed by separate DOJ rules and technical requirements; filing one does not by itself guarantee that court proceedings will stop. Obtain counsel as soon as the resolution arrives.

If an information has already been filed, defenses involving a defective information, improper venue, prescription, or other grounds for a motion to quash must be evaluated before plea because some objections can be waived if not timely raised.

What happens after the prosecutor’s investigation

A prosecutor’s finding against the respondent does not itself amount to a conviction or automatic arrest. If an information is filed:

The RTC independently evaluates judicial probable cause.
The court may dismiss the case, require additional evidence, or issue a warrant of arrest if it finds probable cause.
Cyber libel is ordinarily bailable before conviction. Bail conditions and amount are set by the court.
The accused is arraigned and enters a plea.
Pretrial identifies the issues, witnesses, evidence, admissions, and stipulations.
At trial, the prosecution must prove guilt beyond reasonable doubt. The defense may present its evidence after the prosecution rests.
The court may acquit or convict and determine criminal and civil liability.

The prosecutor’s current administrative target is generally to resolve a preliminary-investigation complaint within 60 calendar days from assignment, subject to a possible 30-day extension in specified cases. Delay does not automatically dismiss the complaint.

Possible penalties and civil liability

For conduct governed by the current amended fine schedule, cyber libel carries a penalty one degree higher than traditional libel. The imprisonment range is generally prisión correccional in its maximum period to prisión mayor in its minimum period—four years, two months and one day to eight years.

In People v. Soliman, the Supreme Court held that a court may impose a fine instead of imprisonment. Applying Republic Act No. 10951 and the one-degree increase, it identified the current cyber-libel fine range as ₱40,000 to ₱1,500,000. Depending on the facts and governing law at the time of the offense, the court may impose imprisonment, a fine, or both.

A conviction can also include civil liability. Separately, the injured party may pursue an independent civil action under Article 33 of the Civil Code, where the standard is preponderance of evidence rather than proof beyond reasonable doubt.

An apology, correction, deletion, settlement, or affidavit of desistance may affect practical resolution, damages, or sentencing, but it does not automatically extinguish a public criminal offense or compel the prosecutor or court to dismiss it.

Common mistakes

Waiting for a platform’s response while the one-year period is running;
Assuming the period always begins on the upload date—or that it never begins until a formal demand;
Filing in a convenient city without evidence supporting venue;
Submitting cropped screenshots with no URL, timestamp, context, or authenticating witness;
Treating a display name as conclusive proof of authorship;
Reposting the accusation and creating wider publication;
Assuming every harsh criticism is defamatory;
Assuming “it is true” is complete without evidence of truth, motive, and justifiable purpose;
Assuming “opinion only” protects an accusation implying undisclosed facts;
Ignoring a subpoena or waiting until the hearing date to find counsel;
Deleting accounts, devices, messages, or source materials;
Contacting the other party with threats, harassment, or a demand for payment tied to threatened publication;
Assuming an affidavit of desistance guarantees dismissal; and
Discussing the pending case online in a way that creates new defamatory publications, intimidates witnesses, or prejudices proceedings.

When legal help is urgent

Speak with a Philippine lawyer immediately when:

The one-year criminal or civil deadline may expire soon;
You received a prosecutor’s subpoena, resolution, information, or arrest warrant;
The post or account is being deleted and provider data may disappear;
The author is anonymous and lawful disclosure or forensic work is needed;
Police request a statement, device, password, consent to a search, or access to an account;
A search or cybercrime warrant is being executed;
The dispute involves a journalist, public official, public figure, confidential source, minor, intimate image, or privileged document;
The online conduct also includes threats, stalking, doxxing, identity theft, extortion, or unlawful access; or
Settlement discussions could affect pending criminal or civil proceedings.

Indigent persons may apply to the Public Attorney’s Office subject to its qualification and merit rules. The Integrated Bar of the Philippines also maintains legal-aid contact channels.

Frequently asked questions

Is a negative review cyber libel?

Not automatically. The exact words, factual basis, context, audience, identification, malice, and purpose matter. A genuine account of personal experience supported by records is different from a fabricated accusation of crime.

Can I file without first sending a demand letter?

Yes. A demand, correction request, or takedown notice is not a general prerequisite to a criminal cyber-libel complaint. It may nevertheless produce evidence of notice, response, good faith, or continuing harm. Do not let negotiations consume the prescriptive period.

Is one screenshot enough?

It may be evidence, but a screenshot alone can leave authorship, authenticity, context, publication, and date unresolved. Preserve the URL, original device and files, complete thread, discovery evidence, and testimony from someone with personal knowledge. The Rules on Electronic Evidence contain authentication requirements for electronic material.

Can an anonymous account be charged?

Potentially, but the responsible person must still be identified and connected to the publication. Law enforcement may seek provider or device evidence through lawful preservation, disclosure, search, seizure, and examination procedures.

Should a respondent delete the post?

Do not destroy evidence. Preserve an authentic, complete copy and consult counsel promptly about correction, retraction, restriction, or removal. Removing content may limit continuing harm, but it does not undo an earlier publication.

Does sharing a post automatically create criminal liability?

No. Disini excluded people who merely receive and react to the original post. A person who writes a new defamatory caption, comment, or accusation may be treated as the author of that new material.

Can both ordinary libel and cyber libel be imposed for the same online act?

Disini rejected cumulative liability under Section 7 of the Cybercrime Prevention Act insofar as the same act would be punished as both traditional and cyber libel. The exact charge, number of publications, and double-jeopardy consequences should be examined by counsel.

Will filing a complaint cause immediate arrest?

No. The prosecutor first conducts the appropriate investigation. If an information is filed, the court independently determines judicial probable cause before issuing an arrest warrant.

Is barangay conciliation always required?

No. Whether barangay proceedings apply depends on the parties, residence, offense, penalty, and statutory exclusions. Because cyber libel carries a penalty exceeding the ordinary Katarungang Pambarangay threshold, it is generally not treated as a dispute requiring prior barangay conciliation, but related civil demands may need separate analysis.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Cyber-libel questions depend heavily on the exact words, evidence, dates, authorship, audience, venue, and procedural history. Sources and procedures were checked through July 27, 2026.