Quick answer

To file a cyber libel case in the Philippines, submit a sworn complaint-affidavit and supporting evidence to the proper Office of the City or Provincial Prosecutor within one year from the date the allegedly defamatory material was discovered by the offended party, the authorities, or their agents. Filing the complaint or information interrupts that period. If technical investigation or account identification is needed, promptly seek help from the National Bureau of Investigation Cybercrime Division or the Philippine National Police Anti-Cybercrime Group—but do not assume that a platform report, police inquiry, demand letter, or blotter entry stops prescription.

To defend a case, do not ignore the prosecutor’s subpoena. Record when it was received, obtain the complete complaint and attachments, and submit a detailed sworn counter-affidavit by the stated deadline. Under current preliminary-investigation rules, the submission date must generally be at least 10 calendar days from receipt of the subpoena and complaint. Address authorship, publication, identification, defamatory meaning, malice, prescription, venue, privilege, truth, and the reliability of the electronic evidence.

Cyber libel is not established merely because an online statement is false, insulting, embarrassing, or harmful. The prosecution must establish every legal element and identify the accused as the responsible author. The outcome will depend heavily on the exact words, context, audience, account records, dates, documents, and status of the person allegedly defamed.

What qualifies as cyber libel?

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 applies the Revised Penal Code’s law on libel when the publication is made through a computer system or similar technology.

The prosecution ordinarily must establish:

A defamatory imputation. The material attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a natural or juridical person to contempt.
Publication. Someone other than the person allegedly defamed received, viewed, read, or heard the statement. A private message seen only by its subject ordinarily lacks this element; a group chat, copied message, public post, or message sent to another person may satisfy it.
Identification. The offended person is named or is otherwise reasonably identifiable from the words and surrounding circumstances. Naming a large, undefined group may not identify an individual member.
Malice. For a private person, a defamatory imputation is generally presumed malicious unless a privilege or other legal justification applies. Different constitutional standards may apply when the statement concerns a public official, public figure, official conduct, or a legitimate matter of public concern.
Use of a computer system or ICT. This includes material published through social media, websites, online forums, email, messaging applications, and other computer- or mobile-phone-based systems.

The entire communication matters. Courts examine its ordinary meaning, context, accompanying images, captions, replies, intended audience, and surrounding events. Calling a statement “opinion,” using a question mark, adding “allegedly,” or posting a meme does not automatically prevent liability if the communication conveys a defamatory factual assertion.

Who may be liable?

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel as applied to the original author but invalidated the use of the Cybercrime Prevention Act’s broad aiding-and-abetting provision against people who merely receive and react to an allegedly libelous post.

Accordingly:

Merely clicking “like,” reacting, or sharing without adding a new defamatory assertion is not treated as authorship of the original post under the cyber-libel provision.
A person who writes a new defamatory caption, comment, quotation, or accusation may be the original author of that new material.
An account name or screenshot does not necessarily prove who actually created the content. Hacking, impersonation, shared access, automated posting, and fabricated screenshots are factual matters that require evidence.
Editors, corporate officers, page administrators, account owners, and employees are not automatically liable solely because of their position. Their actual participation, authorship, authority, knowledge, and the applicable statutory provisions must be established.

The same online act may not be used to prosecute a person both for ordinary libel under the Revised Penal Code and cyber libel under Section 4(c)(4). Disini invalidated Section 7 of the Cybercrime Prevention Act to the extent that it permitted that double prosecution for the same libelous act.

The one-year deadline

The controlling rule is now clear. In its April 8, 2026 final resolution in Causing v. People, the Supreme Court affirmed that cyber libel prescribes in one year from discovery of the allegedly defamatory material by the offended party, the authorities, or their agents.

Important qualifications include:

Publication and discovery may occur on different dates.
A person is not automatically presumed to have discovered a post on the day it became publicly accessible.
Comments, reactions, messages, demands for deletion, threats to sue, or other conduct may prove an earlier discovery date.
The filing of the criminal complaint or information interrupts prescription.
The period can run again if proceedings end without conviction or acquittal, or are unjustifiably stopped for a reason not attributable to the accused.
Under Article 91 of the Revised Penal Code, prescription does not run while the offender is absent from the Philippines.
Whether a later edit, re-upload, or substantively altered repost constitutes a new publication is fact-sensitive. Preserve the post’s edit history and do not assume that every correction—or every continued online availability—creates a new offense.

A complainant should not wait until the last weeks of the one-year period. An accused asserting prescription should gather evidence of the earliest provable discovery date rather than relying only on the original posting date.

Where the case should be filed

Cyber libel is tried by a designated Regional Trial Court acting as a cybercrime court. Under the Rule on Cybercrime Warrants, the criminal action may be filed in the province or city:

where the offense or any of its elements was committed;
where any part of the computer system used was situated; or
where damage to the natural or juridical person took place.

The court where the action is first properly filed acquires jurisdiction to the exclusion of the others. The Supreme Court’s venue discussion in Henares v. Tieng also cautions against treating mere internet access in a convenient or distant location as an unlimited choice of venue.

The complaint should therefore state concrete venue facts: where the author used the relevant device, where the publication or an essential element occurred, where the affected person was located when the legally relevant damage occurred, and why the selected prosecution office and court have territorial authority. Improper or inadequately alleged venue can be a serious defense.

How to file a cyber libel complaint

1. Preserve the online material immediately

Before asking that a post be removed, preserve:

full-page screenshots showing the URL, account name, date, time, and surrounding content;
a screen recording opening the profile, post, comments, links, and account information;
the exact text, images, audio, video, captions, hashtags, and attached files;
the direct post URL, profile URL, username, numeric account or page ID if visible, and platform;
the privacy or audience setting;
visible reactions, comments, shares, and edit indicators;
the device’s date, time, and time-zone settings;
downloaded originals, message exports, notification emails, and platform data;
the date and circumstances of discovery; and
evidence showing who else saw or received the material.

Keep the original files unchanged. Make working copies and record who collected each item, when it was collected, and from what device or account.

2. Preserve proof of authorship and publication

Collect lawful evidence connecting the respondent to the account or content, such as:

admissions or messages acknowledging authorship;
prior use of the same account;
distinctive information known to the author;
witnesses who communicated with the account holder;
linked contact details or public account information; and
evidence that a third person actually received or viewed the material.

Do not guess at identity, hack an account, secretly obtain passwords, or fabricate account records. Subscriber, traffic, or content data held by a service provider may require law-enforcement action and a court-issued cybercrime warrant.

3. Document discovery, falsity, context, and harm

Keep:

the message or conversation through which you first learned of the post;
records disproving factual accusations;
official clearances, contracts, receipts, correspondence, or agency records;
requests for verification, correction, or a response;
statements from readers who understood the post to refer to you;
employer, client, customer, or business communications showing reputational consequences; and
properly supported financial or medical records if damages will be claimed.

A criminal conviction does not depend solely on proof of financial loss, but reliable evidence of actual consequences can be relevant to the civil claim and the seriousness of the incident.

4. Seek technical investigation when necessary

The NBI and PNP are the designated law-enforcement authorities for cybercrime. Early investigation is particularly important when:

the account is anonymous, fake, or newly deleted;
platform records may soon be lost;
the account holder denies authorship;
a device may need forensic examination;
the publication originated abroad; or
impersonation, hacking, threats, extortion, stalking, or unlawful disclosure may involve additional offenses.

A law-enforcement preservation order can require a service provider to preserve specified data. Private screenshots remain useful, but they are not a substitute for provider records when authorship or authenticity is disputed.

5. Prepare the complaint-affidavit

Under DOJ Department Circular No. 015, series of 2024, a regular preliminary investigation begins with:

the original complaint-affidavit;
two duplicate copies for the official file;
one copy for each respondent;
a completed NPS Investigation Data Form;
affidavits of witnesses; and
documentary, electronic, and other evidence sufficient to establish a prima facie case with reasonable certainty of conviction.

The affidavit should state, in chronological and specific terms:

the parties’ names and addresses;
the exact material complained of;
when and where it was posted and discovered;
who saw or received it;
why it identifies the complainant;
why it is defamatory;
the facts supporting authorship and malice;
the relevant venue facts; and
how each attachment was obtained and authenticated.

Check the receiving office’s current administrative requirements before filing. Do not change material facts merely to create venue or avoid prescription.

6. File with the proper prosecution office

File with the Office of the City or Provincial Prosecutor that has territorial authority over the expected cybercrime court. A complainant may first obtain investigative assistance from the NBI Cybercrime Division or the PNP Anti-Cybercrime Group.

Do not assume that reporting the post to the platform, sending a demand for retraction, making a barangay or police blotter entry, or requesting an NBI investigation by itself interrupts the one-year period. Ensure that a legally sufficient criminal complaint is timely filed with the proper prosecutorial authority.

What happens during preliminary investigation?

Cyber libel carries a possible maximum imprisonment exceeding six years, so it undergoes regular preliminary investigation.

Under the 2024 DOJ-NPS Rules:

Within five calendar days after receiving the complete record, the investigating prosecutor may recommend dismissal or issue subpoenas.
The scheduled preliminary-investigation hearing should be no later than 30 calendar days from the prosecutor’s receipt of the record.
The respondent’s submission date must be at least 10 calendar days after receipt of the subpoena and complaint.
If a respondent who received the subpoena fails to appear or submit a counter-affidavit without sufficient justification, the case may be resolved without it.
After receiving the counter-affidavit, the prosecutor may submit the case for resolution or set a physical or virtual clarificatory hearing within 10 calendar days.
A reply-affidavit or rejoinder is not automatic; the prosecutor may require one when clarification is needed.
Preliminary-investigation complaints should ordinarily be resolved within 60 calendar days from assignment, subject to a maximum 30-day extension in specified complex or exceptional cases.

The prosecutor applies the standard of prima facie evidence with reasonable certainty of conviction. The evidence must be admissible, credible, capable of preservation, and sufficient—if left uncontradicted—to establish every element and the respondent’s identity.

These periods guide the prosecution process. Delay by the office does not automatically dismiss a complaint or excuse a party from complying with a subpoena.

How to defend against a complaint

Act immediately upon receiving a subpoena

Record the date, time, and manner of service. Confirm the submission date and obtain a complete copy of every affidavit and attachment. Engage a criminal-defense lawyer before making admissions, contacting the complainant, or submitting a statement.

A subpoena for preliminary investigation is not itself a warrant of arrest. However, ignoring it can result in the case being resolved solely on the complainant’s evidence.

Build an element-by-element counter-affidavit

A bare denial is rarely enough. The counter-affidavit should identify specific factual and legal defects, supported by admissible evidence. Possible defenses include:

No authorship or unreliable attribution

Show that the accused did not create or publish the material. Relevant evidence may include account-compromise reports, device records, travel or work records, messages showing impersonation, access logs lawfully obtained, or inconsistencies in the screenshots and account identifiers.

No publication to a third person

A communication seen only by the person allegedly defamed ordinarily does not injure reputation in the eyes of others. Identify exactly who received the communication and whether the prosecution has a competent witness.

The complainant was not identifiable

Explain why an ordinary reader could not reasonably connect the statement to the complainant without speculation. This defense is weaker where context, photographs, job titles, locations, or other details make the person apparent despite the omission of a name.

The statement was not defamatory in context

The communication may be criticism, rhetorical exaggeration, satire, or an expression of personal experience rather than an accusation of discreditable fact. Courts assess substance, not labels, so explain the complete context and how an ordinary reader would understand it.

Privileged communication

Article 354 recognizes qualified privileges for:

a private communication made in the performance of a legal, moral, or social duty; and
a fair and true report, made in good faith and without comments, of a non-confidential judicial, legislative, or official proceeding, statement, report, speech, or official act.

Jurisprudence also protects fair comment on matters of legitimate public interest under appropriate circumstances. A qualified privilege may be defeated by actual malice, excessive publication, irrelevance, bad faith, or use of the occasion for an improper purpose.

Public official or public figure; no actual malice

When the applicable constitutional standard governs, the prosecution must prove beyond reasonable doubt that the accused published the statement knowing it was false or with reckless disregard of its truth or falsity. Reckless disregard requires more than ordinary or even gross negligence; evidence must support a high degree of awareness of probable falsity or serious doubts about the statement’s truth.

Whether someone is a public figure, and whether the statement concerns official conduct or a public matter, depends on the evidence. Public status is not blanket permission to publish knowingly false accusations about any aspect of a person’s life.

Truth, good motives, and justifiable ends

Truth is important but is not always a complete defense by itself. Article 361 provides for acquittal when the matter is true and was published with good motives and for justifiable ends.

Proof of the truth of an imputation involving an act or omission that is not a crime is generally inadmissible unless the imputation concerns a government employee and facts related to the discharge of official duties. The precise accusation, supporting records, motive, audience, and public purpose must therefore be addressed.

Prescription

Present evidence establishing when the offended party, authorities, or their agents actually discovered the content. Relevant proof can include an earlier reply, reaction, screenshot, demand, conversation, report, or threat to sue. The posting date alone does not necessarily prove discovery.

Improper venue or lack of jurisdiction

Compare the venue allegations with the location of the alleged acts, devices, computer systems, and legally relevant damage. A vague allegation that a post could be accessed anywhere may not establish the selected court’s authority.

No retroactive application

Online material published before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. A claimed later republication must be proved; continued availability of old content should not automatically be treated as a new authored act.

Mere reaction rather than original authorship

If the respondent only liked, reacted to, or mechanically shared someone else’s post, cite Disini. If the respondent added words, however, those words must be analyzed independently because they may constitute a new defamatory publication.

If an information is filed in court

After the prosecutor approves the filing of an information, the designated RTC independently evaluates probable cause for a warrant of arrest. Because cyber libel is not punishable by reclusion perpetua, bail is generally a matter of right before conviction, although the amount and conditions are fixed by the court.

Counsel should immediately review:

whether the information alleges every element;
whether the accused and offended party are properly identified;
whether the date and place are sufficiently stated;
whether the case has prescribed;
whether the RTC has territorial jurisdiction;
whether the evidence supports judicial probable cause; and
whether a motion to quash or another pre-arraignment remedy is appropriate.

A motion to quash ordinarily must be considered before entering a plea, although certain fundamental objections may be treated differently under the Rules of Criminal Procedure. Do not enter a plea or waive arraignment-related rights without legal advice.

The criminal action generally includes the civil claim arising from the offense unless the offended party waives it, reserves the right to bring it separately, or previously filed the proper civil action. Civil damages are not automatic in amount and must be supported by law and evidence.

Penalties and financial exposure

For cyber libel, the statutory imprisonment range is one degree higher than traditional libel: prisión correccional in its maximum period to prisión mayor in its minimum period, or approximately four years, two months and one day to eight years.

For conduct governed by the fine amounts introduced by Republic Act No. 10951, the Supreme Court held in People v. Soliman that the alternative fine for online libel ranges from ₱40,000 to ₱1,500,000. The court may impose imprisonment, a fine, or both, depending on the law and circumstances.

Administrative Circular No. 08-2008 permits judges to consider imposing a fine alone where that would best serve justice, but it does not remove imprisonment as an available penalty. An apology, prompt deletion, retraction, lack of prior offenses, provocation, and other circumstances may affect the court’s discretion, but they do not automatically extinguish liability.

Moral, exemplary, or other properly proved civil damages may be awarded separately from the criminal fine.

Retraction, apology, and settlement

A prior demand, request for correction, or opportunity to reply is not a legal prerequisite to filing a criminal complaint. Nevertheless, a carefully drafted request can help stop continuing harm, preserve proof of notice, and clarify whether the author stands by the accusation.

For a respondent, deleting the post or apologizing does not erase an already completed publication. It may, however, reduce further harm and become relevant to motive, damages, or sentencing.

Cyber libel is prosecuted in the name of the People of the Philippines. An affidavit of desistance or private settlement does not automatically require the prosecutor or court to dismiss the criminal case. The civil aspect may be compromised under applicable law, but any agreement should be prepared with counsel and should not involve intimidation, false testimony, or suppression of evidence.

Common mistakes to avoid

Waiting until the one-year period is nearly over.
Preserving cropped screenshots without the URL, date, context, or account identifiers.
Failing to identify a third person who saw the material.
Assuming an account name alone proves who authored the post.
Treating every insult, bad review, or harsh opinion as criminal libel.
Assuming truth alone is always a complete defense.
Assuming public officials can never be defamed.
Charging a person merely for liking or mechanically sharing another person’s post.
Filing in a convenient but unsupported venue.
Hacking, impersonating, or unlawfully accessing an account to obtain evidence.
Ignoring a subpoena or submitting only an unsworn denial.
Deleting devices, messages, drafts, or account records after receiving notice of a complaint.
Retaliating online or posting confidential case documents.
Assuming a retraction, apology, platform takedown, or affidavit of desistance automatically ends the case.

When legal help is urgent

Consult a Philippine criminal lawyer immediately if:

the one-year period may expire within the next month;
a subpoena, prosecutor’s resolution, information, warrant, or arraignment notice has been received;
the respondent is anonymous or platform records may disappear;
the account may have been hacked or impersonated;
law enforcement requests access to a device or account;
the case involves a journalist, public official, election, workplace investigation, or pending court proceeding;
the post includes threats, extortion, stalking, doxxing, intimate images, or a minor; or
either side is considering a settlement, retraction, or public statement while proceedings are pending.

People who cannot afford private counsel may apply for assistance from the Public Attorney’s Office, subject to its qualification and conflict rules, or contact the Integrated Bar of the Philippines National Center for Legal Aid.

Frequently asked questions

Is a private message cyber libel?

It may be, but publication to a third person must be proved. A message received only by the person allegedly defamed ordinarily does not satisfy publication. A message sent to a group chat or copied to another person may.

Can I file against an anonymous account?

An investigation may be initiated, but the State must ultimately establish the responsible person’s identity. Promptly seek law-enforcement help so that legally available preservation and disclosure procedures can be considered.

Is a demand letter required before filing?

No. A demand, correction request, or takedown request may be useful, but it is not an element of cyber libel and does not replace timely filing.

Does deleting the post prevent prosecution?

No. Deletion does not undo a completed publication, although it may limit further harm and be relevant to the court’s assessment. Preserve the evidence before requesting deletion.

Am I liable if I only shared the post?

A bare reaction or mechanical share is not treated as authorship of the original cyber libel under Disini. Adding a defamatory caption, endorsement, accusation, or comment may create a separate publication that must be assessed on its own facts.

Is truth a complete defense?

Not by itself in every case. Article 361 generally requires both truth and proof that the publication was made with good motives and for justifiable ends, subject to special limits on proving non-criminal imputations.

Can a person be arrested immediately after a complaint is filed?

A complaint-affidavit ordinarily begins preliminary investigation; it is not a warrant. If an information is later filed, the RTC independently determines whether a warrant should issue. The separate rules on valid warrantless arrests still apply in appropriate situations.

How long do I have to challenge a prosecutor’s resolution?

Under the 2024 DOJ-NPS Rules, an aggrieved party may file a motion for reconsideration within 15 days from receipt. A petition for review is likewise generally taken within 15 days from receipt of the resolution or denial of a timely motion for reconsideration, under the NPS appeal rules. For cyber libel cases cognizable by the RTC, review is generally routed to the Office of the Secretary of Justice. If a court case has already been filed, the petition for review must be accompanied by a motion to suspend proceedings filed with the court; the DOJ appeal does not by itself stop the criminal case.

Can the case proceed if the author or platform is abroad?

Potentially. Republic Act No. 10175 recognizes Philippine jurisdiction when an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, or damage was caused to a person who was in the Philippines. Cross-border attribution and evidence collection may require formal international cooperation.

Official legal sources

This article provides general legal information, not advice for a particular case. Cyber-libel findings depend on the exact publication, evidence, dates, parties, and procedural history. Current law and official procedures were checked through August 5, 2026.