Quick answer

Cyber libel is committed when a person uses a computer system or information and communications technology to publish a defamatory and malicious imputation that identifies another person and is communicated to at least one third party. It is punishable under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, in relation to Articles 353 and 355 of the Revised Penal Code.

A complainant should preserve the complete online evidence, establish every element of libel and the poster’s identity, and file a sworn complaint with the proper prosecution office without waiting for a platform investigation. A respondent should not ignore a prosecutor’s subpoena: preserve the complete context and account records, obtain the complaint and all attachments, and file a detailed counter-affidavit by the stated deadline.

The most urgent deadline is prescription. The Supreme Court has definitively ruled that cyber libel prescribes in one year from discovery of the defamatory material by the offended party, the authorities, or their agents—not automatically from the date it was posted. A properly filed criminal complaint or information interrupts prescription. A demand letter, platform report, or informal police inquiry should not be assumed to do so. The latest ruling is the Supreme Court’s April 8, 2026 Resolution in Causing v. People.

What the prosecution must establish

A cyber-libel case generally requires proof of:

A defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. At least one person other than the person defamed received, read, viewed, or heard the statement. A private message sent only to the person being criticized normally lacks this element, although sending the same message to others may constitute publication.
Identification. The complainant must be named or reasonably identifiable from the words, images, surrounding facts, or context. Naming a broad or indefinite group may be insufficient unless the complainant can show that readers understood the statement to refer to them.
Malice. Article 354 generally presumes a defamatory imputation malicious unless it is privileged or good intention and justifiable motive are shown. Different constitutional standards apply to statements concerning public officers, public figures, official conduct, and matters of public interest.
Use of a computer system or ICT. The publication must have been made online or through a computer system, such as through social media, a website, email, a messaging application, or another digital platform.
Authorship or legal responsibility. The evidence must connect the respondent—not merely an account name—to the publication.

The Supreme Court held in Disini v. Secretary of Justice that the cyber-libel provision is constitutional as to the original author, but not as to people who merely receive a post and react to it. The Court also invalidated aiding-or-abetting liability as applied to cyber libel. This does not necessarily protect someone who writes a new defamatory caption, comment, or accusation of their own; that person may be treated as the author of the new statement.

The same online statement should not be charged both as traditional libel and cyber libel. In Disini, the Court held that doing so for an identical publication would violate the rule against double jeopardy.

Not every offensive online statement is cyber libel

Rudeness, satire, exaggeration, criticism, parody, and harsh opinion are not automatically criminal. Courts examine the actual language, its ordinary meaning, the complete conversation, the audience, the speaker’s purpose, and whether the statement asserts or implies a provably defamatory fact.

Calling a statement an “opinion” does not conclusively protect it. An opinion that implies undisclosed defamatory facts, or rests on a false factual premise, may still create liability. Conversely, fair comment based on established facts concerning a matter of public interest may be privileged.

Public officers, public figures, and public affairs

When the statement concerns a public officer’s official conduct, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. The Supreme Court has emphasized that criminal libel laws must not be applied so broadly that they suppress legitimate criticism of public affairs. The same heightened protection may apply to public figures and matters in which the public has a legitimate interest, depending on the statement and context. See Tulfo v. People.

Actual malice is not established by falsity, inaccuracy, or an honest mistake alone. But fabricating material, deliberately distorting a source, ignoring obvious reasons to doubt an accusation, or publishing without any factual basis may support a finding of reckless disregard.

Privileged communications

Potentially privileged communications include:

A private communication made in the performance of a legal, moral, or social duty, such as a relevant, good-faith complaint to a proper authority.
A fair and true report, made in good faith and without added defamatory comments, of a non-confidential judicial, legislative, or official proceeding.
Fair comment on matters of legitimate public interest.
Relevant statements made in judicial proceedings, which may be absolutely privileged in appropriate circumstances.

Qualified privilege can be lost through actual malice, excessive publication, irrelevant accusations, or use of the occasion merely to injure someone. A complaint sent only to the proper office may be privileged; posting that complaint publicly with unnecessary accusations presents a different issue.

Truth is important but not always enough

Under Article 361 of the Revised Penal Code, truth may be offered as a defense, but acquittal generally also requires good motives and justifiable ends. Proof of a true act or omission that is not a crime is ordinarily restricted unless the imputation concerns a government employee and facts related to official duties.

A person should therefore preserve not only evidence that the statement was true, but also proof of responsible verification, legitimate purpose, appropriate audience, and fair presentation.

The one-year filing period

Cyber libel prescribes in one year from actual discovery by the offended party, the authorities, or their agents. A public social-media setting does not create an automatic presumption that the offended party immediately discovered the post. Discovery is a factual issue that may be established through messages, comments, reactions, demands, reports, witness testimony, or other conduct showing knowledge.

The complainant should record:

The exact date, time, and manner of discovery.
Who first showed or sent the material to the complainant.
Messages or emails transmitting the post.
Any reaction, comment, demand, or report made after discovery.
The date the criminal complaint was filed and proof of receipt by the prosecution office.

A respondent asserting prescription should collect contrary evidence, such as an earlier comment by the complainant, an earlier demand letter, a prior report, or proof that the complainant’s authorized agent had already received the publication.

Do not wait until the last day. Venue disputes, an incomplete affidavit, filing in the wrong office, or uncertainty over whether an investigative referral interrupts prescription can place the case at risk.

How to file a cyber-libel complaint

1. Preserve the complete online evidence

Before requesting deletion or blocking, preserve the material in a form that can be authenticated:

Take full-screen screenshots showing the statement, account name, profile identifier, date, time, platform, and surrounding conversation.
Save the direct URL or permalink and record when it was accessed.
Capture the entire thread, not only the most damaging sentence.
Make a screen recording showing navigation from the account profile to the post.
Download the original image, audio, video, email, or message where the platform permits.
Preserve original files, metadata, message headers, notification emails, and platform data exports.
Record the audience or privacy setting and available engagement information.
Identify third parties who personally read, viewed, or received the material.
Preserve evidence linking the account to its operator, such as admissions, linked contact details, consistent account history, prior messages, videos, business pages, or witnesses.
Keep the original device and avoid modifying, renaming, compressing, or repeatedly forwarding important files.

A screenshot is useful but may be challenged if it is cropped, incomplete, altered, or unsupported. Under the Rules on Electronic Evidence, the party offering a private electronic document must establish its authenticity and integrity. An affidavit from the person who captured or personally saw the content, together with metadata, admissions, provider records, or reliable circumstantial evidence, can strengthen authentication.

Do not hack an account, guess passwords, impersonate another user, or secretly intercept private communications to obtain evidence. Evidence-gathering methods can themselves be unlawful.

2. Evaluate the actual words and context

Identify the precise words, image, audio, or video claimed to be defamatory. Explain:

What factual accusation it conveys.
Why an ordinary reader would understand it as defamatory.
How the complainant is identified.
Who besides the complainant received it.
Why it is false or malicious.
Why any claimed privilege does not apply.
Why the respondent is the author or responsible publisher.

Avoid treating every insult in a long thread as a separate count without analyzing whether it is a distinct publication and offense.

3. Identify the proper filing place

Cyber-libel cases fall within the jurisdiction of a designated Regional Trial Court acting as a special cybercrime court. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the province or city:

Where the offense or any element was committed;
Where any part of the computer system used is situated; or
Where damage to the natural or juridical person took place.

The court where the criminal action is first properly filed acquires jurisdiction to the exclusion of the others. Venue is not a mere convenience in a criminal case. The complaint and supporting evidence should state concrete venue facts, not simply that the content could be accessed anywhere.

The criminal complaint is normally filed for preliminary investigation with the City or Provincial Prosecutor’s Office competent for the selected venue. The complainant may also seek investigative assistance from the NBI Cybercrime Division or an appropriate PNP cybercrime unit, particularly when the author is unknown or provider and forensic records are needed. An NBI investigation is helpful but is not a substitute for monitoring the one-year prescriptive period. The NBI publishes its computer-crime complaint process and maintains an online complaint page.

4. Prepare the complaint-affidavit

The sworn complaint should be chronological and specific. It should ordinarily contain:

The complainant’s and respondent’s identifying details and addresses, if known.
The exact publication and a clear translation when material is in a local language.
The date and manner of publication and discovery.
The factual basis for venue.
A separate explanation of every element.
The evidence connecting the respondent to the account or publication.
Names and affidavits of witnesses.
Properly marked electronic and documentary annexes.
Evidence of falsity, malice, harm, and damages, where relevant.
A certification that the statements are true based on personal knowledge or authentic records.

The DOJ’s current filing checklist calls for an Investigation Data Form, sworn complaint and witness statements, supporting documents, and the required number of copies. Confirm the latest local requirements, fees, office hours, and accepted filing method with the receiving prosecution office. The DOJ’s official guidance is available on its filing page for preliminary-investigation complaints.

5. Participate in the preliminary investigation

Cyber libel is subject to regular preliminary investigation under the 2024 DOJ–NPS Rules. The prosecutor applies the standard of prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, preservable, and capable of establishing the elements and the responsible person’s identity. The Supreme Court upheld this standard in Meking v. Remulla.

The respondent must receive the complaint and supporting evidence with the subpoena. The subpoena must afford the respondent at least 10 days from receipt to submit a counter-affidavit on the date set by the prosecutor. If reply and rejoinder affidavits are authorized, each must be filed within the period directed, which may not exceed 10 calendar days from receipt of the pleading being answered.

If either party receives an adverse resolution, a motion for reconsideration may be filed within 15 days from receipt. Any petition for review is governed by separate DOJ appeal rules and does not automatically suspend court proceedings after an Information has been filed. Obtain advice immediately rather than assuming that an appeal stops arraignment or a warrant.

How to defend a cyber-libel complaint

Act immediately after receiving a subpoena

Record the date, time, and manner of service.
Keep the envelope, receiving copy, email headers, and every attachment.
Check whether the complete complaint and annexes were provided.
Calendar the prosecutor’s deadline; do not assume it is extendible.
Engage counsel early enough to investigate and prepare sworn evidence.
Preserve the account, device, drafts, source materials, and security logs.
Do not contact, intimidate, coach, or pressure the complainant or witnesses.
Do not publish retaliatory accusations about the pending case.

Failure to appear or submit a counter-affidavit may allow the prosecutor to resolve the complaint based on the complainant’s evidence.

Build the defense around the actual missing or disputed elements

Possible defenses, depending on the documents and facts, include:

No authorship or control. The account was spoofed, hacked, shared, or operated by someone else, and reliable evidence does not connect the respondent to the publication.
No defamatory imputation. The words, read in their full context, do not convey the accusation alleged.
No publication. The communication was sent only to the complainant and not to a third person.
No identification. Reasonable readers could not identify the complainant.
Privilege. The communication was made in good faith to a proper recipient in the performance of a duty, was a fair report of an official proceeding, or was fair comment on a public matter.
No actual malice. Where the heightened standard applies, the evidence shows responsible verification, credible sources, honest error, or lack of reckless disregard.
Truth, good motives, and justifiable ends. Preserve primary records and witnesses supporting both accuracy and legitimate purpose.
Mere receipt or reaction. The respondent only received or reacted to another person’s post and did not author a new defamatory statement.
Prescription. More than one year elapsed from provable discovery before the criminal complaint was properly filed.
Improper venue. The complaint lacks a legally sufficient connection to the selected city or province.
Retroactive prosecution. A publication made before the Cybercrime Prevention Act took effect cannot be prosecuted under its cyber-libel provision.
Double charging. The same online publication is being prosecuted simultaneously as traditional libel and cyber libel.

A denial should be supported by objective evidence whenever possible. For disputed accounts, preserve platform security emails, login histories, device records, two-factor authentication notices, recovery requests, travel records, administrator roles, and reports of unauthorized access. For responsible-publication defenses, preserve research notes, drafts, source documents, interview records, requests for comment, corrections, and communications showing the purpose and intended audience.

Do not delete or edit first

Deleting a post does not erase a completed publication or automatically end the case. Editing or deleting relevant data after learning of a complaint can also make the evidence harder to explain.

Preserve the complete material and obtain legal advice first. After preservation, limiting further dissemination, correcting an error, or requesting platform removal may reduce continuing harm. A correction, retraction, or apology can be relevant to good faith and damages, but it is not an automatic defense or dismissal.

What happens if an Information is filed in court

A prosecutor’s finding is not a conviction. Once an Information is filed, the RTC judge independently evaluates probable cause and may dismiss the case, require additional evidence, or issue a warrant of arrest.

Cyber libel is bailable before conviction. A respondent who learns that an Information or warrant has been issued should have counsel verify the case directly with the court and arrange lawful voluntary surrender and bail if necessary. Do not rely solely on social-media posts, unofficial messages, or fixers.

Possible court defenses may be raised through appropriate pleadings, including a motion to quash when the defect is legally apparent. Prescription often requires evidence and a hearing when the discovery date is disputed. Arraignment and trial deadlines continue unless the court issues an order suspending proceedings.

Penalties and civil exposure

Cyber libel carries a penalty one degree higher than traditional libel. The possible imprisonment is prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

A court may impose a fine instead of imprisonment. After the adjustments under Republic Act No. 10951 and the one-degree increase required by the Cybercrime Prevention Act, the Supreme Court fixed the possible cyber-libel fine at ₱40,000 to ₱1,500,000. Depending on the judgment, the court may impose imprisonment, a fine, or both. Fine-only treatment is legally available but is not guaranteed. See People v. Soliman.

Civil damages may also be claimed. Civil liability arising from the offense is generally deemed included in the criminal case unless waived, reserved, or previously instituted. Article 33 of the Civil Code also recognizes an independent civil action for defamation under a preponderance-of-evidence standard. Because special venue, first-filed-case, reservation, consolidation, and double-recovery rules can interact, obtain advice before filing parallel criminal and civil proceedings.

Retraction, settlement, and an affidavit of desistance

A carefully negotiated correction, retraction, apology, takedown, or damages agreement may resolve the private dispute or reduce harm. However:

A criminal offense is prosecuted in the name of the People of the Philippines.
An affidavit of desistance does not automatically require the prosecutor or court to dismiss the case.
Once an Information is filed, withdrawal ordinarily requires court action.
A settlement must not involve threats, witness pressure, false affidavits, or payment demands amounting to another offense.
Any agreement should address preservation, removal, correction language, confidentiality, releases, civil claims, and pending proceedings.

Communicate through counsel when relations are hostile, a protection order exists, or statements could be used as admissions.

Evidence worth preserving

For the complainant

Complete post, thread, video, audio, or message.
URL, account identifier, timestamps, privacy setting, and metadata.
Original files and the device used to capture them.
Affidavits of third parties who received the publication.
Evidence linking the account to the respondent.
Proof of the actual discovery date.
Requests for correction and the responses received.
Employment, business, medical, or other records supporting claimed harm.
Provider or platform correspondence.

For the respondent

The subpoena, proof of service, complaint, and all annexes.
Full conversation and surrounding context omitted from screenshots.
Original drafts, sources, research, and requests for comment.
Account-security, device, and login records.
Evidence of account administrators or shared access.
Proof supporting truth, privilege, good faith, or public interest.
Evidence that the complainant or an agent discovered the material earlier.
Copies of corrections, retractions, or takedown efforts.
Records showing that the respondent merely received or reacted to another post.

Common mistakes

Waiting for a platform to answer before protecting the one-year filing period.
Filing based only on a cropped screenshot.
Failing to prove who operated the account.
Treating an insult as automatically defamatory.
Omitting the third-party recipient needed for publication.
Assuming that truth alone always defeats liability.
Ignoring privilege and the actual-malice standard in public-affairs cases.
Filing in a convenient location without establishing cybercrime venue.
Ignoring a prosecutor’s subpoena or relying on an unsupported denial.
Deleting devices, posts, drafts, or account logs after a dispute begins.
Publicly arguing the case and creating new potentially defamatory statements.
Assuming that a demand letter, NBI inquiry, apology, or affidavit of desistance automatically starts, stops, or dismisses the criminal case.
Assuming that a prosecutor’s resolution, DOJ appeal, or platform takedown automatically suspends court proceedings.

When legal help is urgent

Contact a Philippine criminal-law or cybercrime lawyer immediately when:

The one-year period may expire soon.
A prosecutor’s subpoena or adverse resolution has been received.
An Information or warrant of arrest may already exist.
The author uses an anonymous, hacked, or overseas account.
Provider records or a cybercrime warrant may be needed before data disappears.
The publication concerns journalism, whistleblowing, public officers, or confidential official records.
Several people or repeated publications are involved.
The dispute includes threats, stalking, doxxing, intimate material, gender-based harassment, identity theft, or a minor; other laws and urgent protective remedies may apply.
A civil case, restraining order, employment case, administrative complaint, or professional-disciplinary proceeding is also pending.

Those who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility, merit, and conflict-of-interest rules.

Frequently asked questions

Can I file if the post has already been deleted?

Yes, if the offense has not prescribed and admissible evidence of the publication remains. Deletion can make authentication and proof of authorship more difficult, so preserve evidence and seek provider-assisted investigation promptly.

Does a screenshot prove cyber libel?

Not by itself in every case. It must be shown to be authentic, complete, and reliable, and the prosecution must still prove authorship, publication, identification, malice, venue, and the other elements.

Can someone be liable for liking or sharing a defamatory post?

A person who merely receives and reacts to a post is not liable for cyber libel under Disini. A simple share presents similar constitutional concerns. But someone who adds a new defamatory accusation or caption may become the original author of that new content.

Can a private group chat contain cyber libel?

Yes, if a defamatory statement about a person is communicated to at least one other group member. A limited audience may affect context, privilege, malice, and damages, but it does not automatically eliminate publication.

Is a true accusation automatically safe?

No. Article 361 generally also requires good

Quick answer

Cyber libel is committed when the elements of libel under the Revised Penal Code are present and the defamatory material is published through a computer system or information and communications technology. It can cover social-media posts, online articles, videos, captions, comments, emails, and group messages, depending on the facts.

A complainant must establish the defamatory imputation, publication to at least one third person, identification of the person defamed, malice, use of a computer system, and the respondent’s authorship or responsibility. A respondent may defeat the charge by disproving any element or showing, among other defenses, prescription, privilege, lack of actual malice where the constitutional standard applies, truth coupled with the legally required good motive and justifiable purpose, lack of publication, mistaken identity, or lack of authorship.

Act quickly. The Supreme Court has definitively ruled that cyber libel prescribes in one year from discovery of the defamatory material by the offended party, the authorities, or their agents—not automatically from the date of posting. A properly filed criminal complaint or information interrupts prescription. A demand letter, platform report, or informal police inquiry should not be assumed to do so. The date of discovery is often disputed and must be proved.

Cyber libel is serious but bailable. The possible penalty is imprisonment from four years, two months and one day to eight years, or a fine from ₱40,000 to ₱1,500,000, or both, plus possible civil liability. A fine-only sentence is legally possible but never guaranteed.

What the prosecution must prove

Under Articles 353 to 355 of the Revised Penal Code and Section 4(c)(4) of the Cybercrime Prevention Act, the prosecution must establish every essential element:

Defamatory imputation. The statement attributes a crime, vice, defect, act, omission, condition, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. The material was communicated to at least one person other than the person defamed. A public post is not required. A group chat, restricted account, email chain, or message sent to another person may satisfy publication. A private message sent only to its subject ordinarily lacks this element.
Identification. The offended person is named or can reasonably be identified from the words, images, context, relationships, or surrounding circumstances. Naming no one is not automatically a defense.
Malice. Article 354 generally presumes a defamatory imputation malicious unless it is privileged, subject to constitutional and jurisprudential protections for speech on public affairs.
Use of a computer system or ICT. The publication was made online or through a computer, phone, platform, or comparable technology.
Authorship or legal responsibility. The respondent authored, posted, or caused the publication. Showing that a post appeared under an account name is not necessarily enough if ownership or control is genuinely disputed.

The prosecutor now applies the standard of prima facie evidence with reasonable certainty of conviction. The available evidence must be admissible, credible, capable of preservation and presentation, and sufficient—if left uncontradicted—to establish the elements and the responsible person. The Supreme Court upheld this standard and the current DOJ rules in Meking v. Remulla.

Important limits and exceptions

Likes, reactions, and simple receipt

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but invalidated its application to people who merely receive and react to a post. It also invalidated aiding or abetting liability in relation to cyber libel.

That protection is not a license to write a new defamatory statement. A person who adds an independently defamatory caption, comment, accusation, edited image, or narration may become the original author of that new material. The precise wording and platform function matter.

Truth is not always enough

For an ordinary private-person case, truth alone is not automatically a complete defense. Article 361 generally requires both:

proof that the imputation is true; and
proof that it was published with good motives and for justifiable ends.

For an imputation of an act or omission that is not a crime, proof of truth is generally inadmissible unless it concerns a government employee and relates to the discharge of official duties. These rules must also be applied consistently with constitutional protection for speech on public issues.

Public officers, public figures, and matters of public concern

When a statement concerns a public officer’s official conduct, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Philippine jurisprudence has also applied this protection to public figures in appropriate cases.

Fair comment on established facts concerning a public person or public issue may be protected. An opinion does not become actionable merely because it is harsh or mistaken if it is a reasonable inference from established facts. Conversely, labeling a factual accusation “opinion” does not protect it when the context presents it as a provable assertion of fact. These principles are discussed in Tulfo v. People.

Privileged communications

Potentially privileged communications include:

a private communication made in the performance of a legal, moral, or social duty;
a fair and true, good-faith report—without added comments—of a non-confidential judicial, legislative, or official proceeding;
relevant statements in judicial proceedings that are absolutely privileged; and
fair commentary on matters of legitimate public interest.

Most privileges outside judicial or legislative proceedings are qualified, not absolute. Excessive publication, irrelevant accusations, spite, knowing falsity, or lack of a genuine duty may defeat the privilege. Filing a complaint with the proper authority may be privileged; broadcasting the same accusation to unrelated people or posting it publicly is a different act requiring separate analysis.

Old online material

A defamatory online post made before the Cybercrime Prevention Act took effect cannot be retroactively punished as cyber libel. Whether a later edit, update, repost, or separate publication created a new offense is highly fact-specific and should not be assumed without reviewing the exact digital history.

The one-year deadline

The Supreme Court’s latest controlling ruling is that cyber libel prescribes in one year from actual discovery by the offended party, the authorities, or their agents. A public Facebook post does not create automatic or constructive notice merely because it was accessible online. Discovery may be proved through messages, comments, reactions, demands, reports, witness testimony, or other conduct showing knowledge.

Prescription is commonly disputed. The respondent may present evidence that the complainant or an authorized agent knew of the post earlier than claimed. The complainant should record exactly:

who discovered the material;
the date and time of discovery;
how it was found;
who first sent or showed it to the complainant; and
what actions followed.

The Supreme Court denied reconsideration with finality and reaffirmed the one-year rule in its April 8, 2026 resolution in Causing v. People.

Do not wait until the last weeks of the period. Questions about the proper prosecution office, venue, rejected filings, incomplete affidavits, holidays, or the true discovery date can endanger a case.

How to file a cyber-libel complaint

1. Preserve the complete electronic evidence

Before requesting takedown or blocking the account, preserve:

full-screen screenshots showing the entire post, account name, profile image, date, time, reactions, comments, and surrounding context;
the exact URL, permalink, username, account ID, channel name, and profile link;
a screen recording that navigates from the profile or page to the post;
the original image, audio, or video file where available;
captions, thumbnails, hashtags, transcripts, comments, and linked material;
the post’s audience or privacy setting, if visible;
the device and account on which the material was received or viewed;
platform download or export files and available metadata;
messages identifying the author or acknowledging the post;
security, subscriber, or account information lawfully available to you;
the names and sworn accounts of third persons who saw the publication; and
records showing the date of discovery and resulting harm.

Keep an untouched copy and a separate working copy. Do not crop, annotate, enhance, or combine the only copy. Record who captured each item, when it was captured, and how it was stored.

Electronic evidence must be authenticated. The Rules on Electronic Evidence place the burden on the offering party to show authenticity, integrity, and reliability. A screenshot can be useful, but a screenshot without context, a competent witness, or corroborating records may be challenged.

Never hack an account, guess a password, install spyware, impersonate another person, or secretly intercept communications to obtain evidence. Unlawful collection can create separate criminal, privacy, or admissibility problems.

2. Identify the exact defamatory material

Quote or transcribe the precise words alleged to be defamatory. For a video or livestream, identify the relevant timestamps. For a meme or image, explain how the words and visual elements work together.

The complaint should not merely say that a post was “offensive,” “fake,” or “damaging.” It should explain:

what factual accusation or discreditable imputation was made;
why readers would understand it as referring to the complainant;
who received or viewed it;
why it is false or malicious, where falsity is material;
why the respondent is the author or person who caused publication; and
how the computer system or online platform was used.

3. Establish the author’s identity

For a known respondent, gather the correct full name and available address for service. For a pseudonymous account, preserve lawful evidence connecting the account to a person, such as:

admissions;
consistent use of identifying photographs or contact information;
links to other verified accounts;
prior messages;
account-history evidence;
witnesses familiar with the account;
distinctive facts known to the suspected author; or
subscriber or platform records obtained through lawful investigation.

The NBI or PNP cybercrime units may assist with anonymous accounts, digital forensics, and requests for judicially authorized disclosure. Platform cooperation and data retention vary, so report promptly. Law-enforcement authorities—not private complainants—apply for cybercrime warrants to obtain protected subscriber, traffic, or content data.

4. Select the proper place of filing

Cyber-libel cases fall within the jurisdiction of a designated Regional Trial Court acting as a cybercrime court. Under Section 2.1 of the Rule on Cybercrime Warrants, a criminal action may be filed in the designated cybercrime court of the province or city:

where the offense or any element occurred;
where any part of the computer system used is situated; or
where damage to the natural or juridical person took place.

The first court in which the criminal action is properly filed acquires jurisdiction to the exclusion of the others. Venue is jurisdictional in criminal cases, so the complaint and eventual Information must allege and support the venue facts.

Ordinarily, the sworn complaint is first filed with the City or Provincial Prosecutor’s Office competent for the selected venue, not directly with the trial court. The NBI Cybercrime Division or an appropriate PNP cybercrime unit may first investigate and then refer or file the complaint with the prosecution office.

5. Prepare and file the sworn complaint

The filing package commonly includes:

the required investigation data form;
a complaint-affidavit sworn before an authorized officer;
affidavits of witnesses with personal knowledge;
electronic and documentary evidence;
an evidence index identifying each annex;
available identifying and address information for each respondent; and
the copies and filing requirements specified by the receiving office.

Check the receiving prosecution office’s current checklist before filing. The DOJ publishes general requirements on its filing-of-complaint page.

The affidavit should be chronological and based on personal knowledge. Clearly separate what the complainant personally saw from what another person reported. The person who first viewed or captured the post may need a separate affidavit.

6. Participate in preliminary investigation

Because cyber libel carries a possible penalty exceeding six years, it undergoes regular preliminary investigation under DOJ Department Circular No. 15, series of 2024.

If the complaint is sufficient to proceed, the prosecutor issues a subpoena with the complaint and attachments. The respondent must be given at least 10 days from receipt to submit a counter-affidavit on the date fixed in the subpoena. The prosecutor may require clarificatory proceedings and, when warranted, a reply-affidavit and rejoinder-affidavit. A reply or rejoinder allowed under the regular rules must be filed within the period directed, which cannot exceed 10 calendar days from receipt of the pleading answered.

The prosecutor may dismiss the complaint or find sufficient basis to file an Information in the proper cybercrime court. Either party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review may also be available under the separate DOJ appeal rules, but it does not automatically stop court proceedings. Obtain advice immediately because the governing periods and proper reviewing office depend on the resolution and case posture.

How to defend a cyber-libel complaint

1. Do not ignore the subpoena

A prosecutor’s subpoena is not yet a conviction or warrant of arrest, but ignoring it can allow the prosecutor to resolve the complaint from the complainant’s evidence alone.

Record the date and manner of receipt. Check whether the complaint-affidavit and all cited attachments were actually included. The subpoena should provide at least 10 days from receipt to submit the counter-affidavit. Extensions are exceptional and should not be assumed.

Engage counsel early enough to investigate facts, obtain affidavits, and preserve electronic records—not merely to rewrite a denial on the filing date.

2. Preserve rather than alter

Keep:

the complete subpoena, envelope, delivery record, and attachments;
the original post and full conversation;
drafts and source materials;
account downloads, login histories, device records, and security alerts;
records of hacking, impersonation, lost devices, or unauthorized access;
research notes and source verification made before publication;
communications showing purpose, duty, good faith, correction, or request for comment;
proof of account roles, page administrators, employees, or contractors;
evidence of when the complainant first knew of the post; and
the complete context before and after the quoted words.

Do not delete the only evidence, edit timestamps, manufacture screenshots, coach witnesses, or contact the complainant in a threatening manner. Counsel can advise whether to preserve first and then remove or restrict access to stop further harm.

3. Test every element and procedural requirement

A counter-affidavit should address the evidence, not rely on a bare denial. Depending on the facts, examine:

Prescription: Was the complaint filed more than one year after the complainant, authorities, or their agent discovered the material?
Venue: Does the complaint establish a valid connection to the chosen province or city?
Authorship: Is there competent evidence that the respondent owned or controlled the account and made the post?
Publication: Was the material communicated to anyone other than its subject?
Identification: Could a reasonable reader actually identify the complainant?
Defamatory meaning: Is the statement an accusation of fact, protected rhetoric, satire, or an opinion based on disclosed facts?
Privilege: Was the communication made to the proper recipient in the performance of a legal, moral, or social duty, or was it a fair report or fair comment?
Actual malice: If the speech concerned a public officer’s official conduct or an appropriate public-figure issue, can the prosecution show knowledge of falsity or reckless disregard?
Truth and motive: Are the imputed facts provably true, and was publication supported by good motives and justifiable ends?
Computer-system use: Does the evidence establish the ICT component charged?
Double charging: The same online statement cannot constitutionally be punished both as ordinary libel and cyber libel as separate offenses.

Include the supporting records and witness affidavits now. Preliminary investigation is decided on the evidence submitted, and the current standard expressly includes an evaluation of the respondent’s counter-evidence.

4. If an Information or warrant has already been issued

Once an Information is filed, the judge independently examines probable cause and may dismiss the case, require additional evidence, or issue a warrant of arrest. A prosecutor’s favorable resolution does not itself authorize arrest.

Cyber libel is bailable before conviction. If a warrant exists, coordinate voluntary surrender and bail through counsel rather than waiting for an unexpected arrest. Counsel should also assess:

a motion to quash based on grounds apparent from the Information;
a separate evidentiary hearing on prescription where facts are disputed;
improper venue or lack of sufficient venue allegations;
defects in the charge;
judicial probable cause;
arraignment deadlines;
available review remedies; and
preservation of defenses for trial.

A pending DOJ petition for review does not, by itself, guarantee suspension of arraignment or court proceedings. A specific court order is ordinarily needed.

Penalties and civil exposure

Section 6 of the Cybercrime Prevention Act raises the penalty for libel committed through ICT by one degree. The possible imprisonment is prisión correccional in its maximum period to prisión mayor in its minimum period, or four years, two months and one day to eight years.

Following Article 355 as amended by Republic Act No. 10951 and the Supreme Court’s computation in People v. Soliman, the possible fine is ₱40,000 to ₱1,500,000. The court may impose imprisonment, a fine, or both. The Supreme Court confirmed that fine-only punishment is legally available, but the sentence depends on the facts, applicable mitigating or aggravating circumstances, and judicial discretion.

Civil liability may include proven damages. The civil liability arising from the offense is generally deemed included in the criminal action unless waived, reserved, or previously instituted. Article 33 of the Civil Code also permits an independent civil action for defamation based on preponderance of evidence. Separate civil and criminal filings must be coordinated carefully because special venue, first-filed-case, reservation, consolidation, and double-recovery rules may apply.

Retraction, correction, takedown, and settlement

A prompt correction, retraction, apology, or takedown may reduce continuing harm and may be relevant to good faith, damages, or settlement. It does not automatically erase an offense that was already completed.

Likewise, an affidavit of desistance does not automatically terminate a criminal case. The offense is prosecuted in the name of the People of the Philippines, and the prosecutor or court must still determine the legal effect of any withdrawal or compromise.

Settlement discussions should be conducted through counsel when a case is pending. Do not demand money through threats of exposure, arrest, or unrelated harm, and do not pressure witnesses to change truthful testimony.

Common mistakes

Waiting for the platform to answer before filing and losing the one-year period.
Assuming a demand letter, barangay proceeding, or social-media report interrupts prescription.
Capturing only a cropped screenshot without the URL, account, date, context, or competent witness.
Filing in the nearest prosecution office without analyzing cybercrime venue.
Suing every person who liked, shared, or reacted despite the limits recognized in Disini.
Treating every insult, criticism, bad review, or negative opinion as criminal libel.
Assuming that “it is true” ends the inquiry without addressing motive, purpose, privilege, and the applicable public-speech standard.
Assuming that calling an accusation “opinion” protects a provably factual claim.
Publicly reposting an accusation while trying to document or deny it.
Deleting the only copy of a post, account history, or security record.
Ignoring a subpoena or filing a bare denial without evidence.
Contacting the opposing party or witnesses with threats, pressure, or retaliatory posts.
Assuming a complaint automatically produces an arrest warrant.
Assuming a DOJ appeal automatically suspends the court case.

When legal help is urgent

Consult a Philippine criminal-law or cybercrime lawyer immediately if:

the one-year period will expire soon;
a prosecutor’s subpoena has been received;
an Information or warrant of arrest may already exist;
the account is anonymous, hacked, spoofed, or based abroad;
platform or telecom data may soon be deleted;
the case involves a journalist, public officer, public figure, whistleblower, or confidential source;
the post concerns official proceedings or a complaint made to authorities;
several people administered or posted through the same page;
intimate images, threats, stalking, gender-based harassment, a child, or identity theft are also involved;
a civil damages case is being considered alongside the criminal complaint; or
the parties are discussing retraction, desistance, or settlement.

People who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its indigency, merit, conflict, and service rules.

Frequently asked questions

Does a cyber-libel complaint immediately lead to arrest?

No. The prosecutor first conducts preliminary investigation. If an Information is filed, the judge independently determines probable cause before issuing a warrant. Cyber libel is bailable before conviction.

Can I file even if the post was deleted?

Possibly. Deletion does not extinguish an already completed offense, but the complainant must still prove the publication, contents, authorship, identity, malice, and other elements with admissible evidence.

Is one screenshot enough?

Sometimes it may support a complaint, but relying on one screenshot is risky. Preserve the full post, URL, context, account identifiers, original files, metadata, and testimony from someone with personal knowledge.

Can someone be liable for sharing another person’s post?

A person who merely receives and reacts to a post is outside cyber-libel liability under Disini. A simple platform share presents similar constitutional concerns. But adding an independently defamatory caption, accusation, edit, or narration may create a new publication attributable to that person.

Can an anonymous account be charged?

Yes, if the responsible person can be lawfully identified and the evidence connects that person to the account and publication. An account name alone may be inadequate. Prompt NBI or PNP cybercrime assistance may be necessary to preserve and seek protected platform data.

Can a business or corporation be defamed?

Yes. Article 353 protects both natural and juridical persons, but the company must be identifiable and the other elements must still be proved.

Is a negative customer review cyber libel?

Not automatically. An honest account of personal experience or an opinion based on disclosed facts may be protected. Knowingly false factual accusations, fabricated events, or malicious claims unsupported by the reviewer’s experience present greater risk.

Can I file more than one year after the post if I discovered it only recently?

Possibly. The controlling period runs from discovery, not automatically from posting. The alleged discovery date must be credible and can be challenged using evidence of earlier knowledge.

Does taking down the post end the case?

No. Takedown can limit further harm but does not undo publication already made to a third person.

Can the complainant file both ordinary libel and cyber libel for the same post?

The same online publication cannot be punished as two separate offenses under ordinary libel and cyber libel. Other genuinely distinct statements or legally different acts may require separate analysis.

Official legal sources

This article provides general legal information, not legal advice or an attorney-client relationship. Outcomes depend on the exact words, audience, evidence, dates, account ownership, status of the parties, venue, and procedural history. Law and agency procedures were checked against primary and official sources current to August 3, 2026.