Quick answer
To file a cyber libel case, preserve the online material and proof of authorship, prepare a sworn complaint-affidavit establishing every element of libel, and file it with the proper prosecution office—normally within one year from discovery of the alleged offense. Venue must be tied to where an element occurred, where part of the computer system used was situated, or where the legally relevant damage took place. A report to a platform, barangay, or law-enforcement help desk should not be assumed to stop the one-year period.
To defend a case, do not ignore a prosecutor’s subpoena. Obtain the complete complaint and attachments, note the date of receipt, preserve the account and device records, and submit a sworn, evidence-backed counter-affidavit by the stated deadline. Common defenses include lack of a defamatory imputation, no publication to a third person, failure to identify the complainant, lack of authorship, improper venue, prescription, truth accompanied by good motives and justifiable ends, privilege, and failure to prove actual malice where the law requires it.
Cyber libel is criminal libel committed through a computer system or information and communications technology. It is prosecuted under Section 4(c)(4) of the Cybercrime Prevention Act of 2012, together with the Revised Penal Code provisions on libel.
What the prosecution must prove
A disputed post is not cyber libel merely because it is offensive, embarrassing, critical, or false. The prosecution must establish all the required elements beyond reasonable doubt at trial:
A defamatory imputation. The statement must impute a crime, vice, defect, act, omission, condition, status, or circumstance tending to dishonor, discredit, or expose a natural or juridical person to contempt. Courts read the words in their full context, including the language used, audience, accompanying images, and overall message. Insulting words are not automatically libel.
Publication. The statement must have been communicated to at least one person other than the person allegedly defamed. A message seen only by its sender and the complainant ordinarily lacks this element; a group chat, email copied to others, social-media post, video, livestream, or message sent to a third party may satisfy it.
Identifiability. The complainant need not always be named, but at least one third person must be able to identify the complainant as the subject. Initials, photographs, job descriptions, family relationships, or surrounding events can sometimes make a person identifiable.
Malice. Article 354 generally presumes malice from a defamatory imputation unless good intention and justifiable motive or a recognized privilege applies. Different rules apply to privileged speech and speech about public officials or public figures.
Use of a computer system or similar ICT. The publication must have been made through a computer system or a similar technological means. This can include websites, social-media platforms, online forums, email, messaging applications, and comparable services.
The respondent’s responsibility for the publication. The evidence must connect the accused to the particular account, device, statement, or act of publishing. A profile name or screenshot alone does not necessarily prove who controlled the account.
These elements are summarized in the Supreme Court’s decision in Disini v. Secretary of Justice. Publication and identifiability are further explained in Tulfo v. People.
Important exceptions and defenses
Truth is not automatically a complete defense
Under Article 361 of the Revised Penal Code, an accused relying on truth generally must also show that the material was published with good motives and for justifiable ends. The rules are particularly technical when the imputation concerns an act that is not itself a crime or concerns a government employee’s official duties.
Documents supporting truth should be assessed carefully. A rumor, anonymous tip, unverified screenshot, or another person’s accusation does not become reliable merely because it was repeated online.
Privileged communications
Article 354 recognizes qualified privileges, including:
- A private communication made in the performance of a legal, moral, or social duty; and
- A fair and true report, made in good faith and without added comments, of a non-confidential judicial, legislative, or other official proceeding, official statement, or official act.
The Supreme Court has also recognized fair comment on matters of public interest as protected in appropriate circumstances. Qualified privilege is not a license to knowingly publish falsehoods, act out of spite, add unrelated personal attacks, or broadcast a supposedly private complaint to an unnecessarily large audience.
Relevant statements made in judicial proceedings may enjoy stronger protection, but relevance and the setting of the statement matter. Privilege should be analyzed from the exact words, recipients, purpose, and occasion—not from a label such as “official complaint” or “public interest.”
Public officers and public figures
Where the complainant is a public officer or public figure and the statement concerns official conduct or a legitimate public matter, the prosecution must prove actual malice: knowledge that the statement was false or reckless disregard of whether it was false. Reckless disregard requires more than ordinary error or negligence; it involves a high degree of awareness of probable falsity or serious doubts about the statement’s truth.
Public status does not automatically make every aspect of a person’s private life fair game. The subject matter and its connection to public duties remain important. See Daquer v. People.
Opinions, criticism, satire, and rhetorical language
A protected opinion normally expresses a view rather than asserting a provably false fact. Simply adding “in my opinion,” “allegedly,” a question mark, or a disclaimer will not protect a statement that reasonably communicates a factual accusation.
Courts consider whether the statement can be proven true or false, whether it implies undisclosed defamatory facts, and how an ordinary reader would understand it in context. Criticism of policy or performance receives substantial constitutional protection, while invented factual accusations do not become protected merely because they appear in a commentary or meme.
Likes, shares, and comments
In Disini, the Supreme Court upheld cyber libel as applied to the original author, but declared it unconstitutional as applied to people who merely receive and react to a post. The Court also invalidated the Cybercrime Act’s aiding-or-abetting provision insofar as it applied to cyber libel.
A simple like, share, or brief reaction should therefore not be treated automatically as cyber libel. But a person who adds a new, independently defamatory factual assertion may become the original author of that new statement. Copying material into a fresh post, materially modifying it, or presenting it as one’s own accusation requires fact-specific analysis.
Posts made before the law took effect
Online defamation published before the Cybercrime Prevention Act took effect cannot be punished retroactively as cyber libel. A later republication, material update, or new defamatory post may present a different issue. Merely assuming that an old page remains continuously punishable is unsafe; the exact publication history and later acts must be proved. See Peñalosa v. Ocampo.
The one-year deadline
The Supreme Court has now ruled that cyber libel prescribes in one year under Article 90 of the Revised Penal Code. The period begins when the alleged crime is discovered by the offended party, the authorities, or their agents—not automatically on the date the material was uploaded.
There is no legal presumption that a person discovered a social-media post as soon as it appeared online. The actual discovery date may require testimony, messages, forwarding records, or other evidence. The accused may contest that date and present evidence showing earlier discovery.
Filing the complaint or Information interrupts prescription. The period may run again if proceedings end without conviction or acquittal or are unjustifiably stopped for a reason not attributable to the accused. Article 91 also provides that prescription does not run while the offender is absent from the Philippines. The current controlling ruling is Causing v. People, G.R. No. 258524, April 8, 2026.
Because calculating prescription is evidence-dependent:
- Record the first date the complainant, an authorized representative, law enforcement, or another relevant agent actually learned of the material.
- Preserve the message or communication through which discovery occurred.
- Do not assume that a demand letter, platform report, barangay proceeding, or informal police inquiry interrupts prescription.
- File sufficiently early to allow venue and documentary requirements to be corrected.
A separate civil action for defamation is also generally subject to a one-year prescriptive period under Article 1147 of the Civil Code. Its accrual and relationship to any criminal case should be reviewed separately.
Where a case may be filed
Cyber libel cases are tried in designated cybercrime Regional Trial Courts. Under Section 2.1 of the Rule on Cybercrime Warrants, the criminal action may be filed in the city or province:
- Where the offense or any element was committed;
- Where any part of the computer system used was situated; or
- Where damage to a natural or juridical person took place.
The court where the action is first properly filed acquires jurisdiction to the exclusion of other courts. Mere ability to view a webpage from a location should not be treated as an unlimited choice of venue. The complaint and eventual Information must allege facts supporting the chosen place. The Supreme Court discusses this rule in Henares v. Tieng.
Before filing, determine:
- Where the respondent allegedly created or uploaded the material;
- Where the relevant device or computer system was situated;
- Where the complainant actually suffered the damage relied upon;
- Where the complainant resided or held office when relevant; and
- Whether another case involving the same publication has already been filed.
Venue errors can cause dismissal or substantial delay and may become critical as the one-year period approaches.
How to file a complaint
1. Preserve the evidence before seeking removal
Capture the material while it remains available. Keep:
- Full-page screenshots showing the exact words, photographs, account name, date, time, reactions, comments, and surrounding context;
- The complete URL or platform-specific link;
- The account’s profile page, username, unique identifier if visible, and relevant “About” information;
- A screen recording showing how the material was accessed;
- Original downloaded files, emails, chat exports, notifications, and message headers;
- The device on which the material was received or viewed;
- Names and contact details of people who personally saw the material;
- Records showing the date and manner of discovery;
- Earlier and later versions of an edited post;
- Evidence connecting the account to the suspected author; and
- Documents showing actual reputational, employment, business, professional, or emotional consequences.
Keep an untouched original copy and work from duplicates. Record who collected each item, when it was collected, and how it was stored. Do not crop away context, alter metadata, impersonate another person, guess passwords, or access a private account without authority.
Electronic evidence must be authenticated. The party offering it bears the burden of showing its integrity and reliability under the Rules on Electronic Evidence. Screenshots are useful, but corroborating testimony, original files, device records, account admissions, platform data, and lawful forensic examination can be decisive.
2. Identify the precise statement and responsible person
A complaint should quote or accurately reproduce each statement relied upon. If it is in Filipino, Cebuano, Ilocano, or another language, provide the original and a careful translation. Explain:
- What factual imputation the statement conveyed;
- Why it was defamatory in its full context;
- How third persons identified the complainant;
- Who actually saw or received it;
- Why the respondent is believed to be its author or publisher;
- How a computer system was used; and
- What facts establish venue and timely filing.
Do not name every person who reacted to a post without a legal and evidentiary basis. For anonymous or fictitious accounts, seek investigative assistance promptly instead of making unsupported accusations against a suspected owner.
3. Prepare a sworn complaint-affidavit
The complaint-affidavit should be based on personal knowledge and authentic records. Attach witness affidavits and properly marked supporting evidence. It should include a clear chronology covering publication, discovery, preservation, identification of the respondent, harm, and venue.
The DOJ’s published preliminary-investigation filing checklist calls for an Investigation Data Form, the complaint-affidavit, witness affidavits, and supporting documents, with the required number of copies. Confirm the current local requirements, authorized fees, oath procedure, and electronic-filing availability directly with the receiving office.
4. File with the proper prosecution office
File with the Office of the City or Provincial Prosecutor corresponding to the legally supportable venue, or with the DOJ when the matter is properly accepted or assigned there. The NBI Cybercrime Division and the PNP cybercrime unit may assist with investigation, account attribution, preservation requests, and lawful applications for cybercrime warrants.
A law-enforcement report can be valuable, especially for an anonymous account, but confirm whether and when a formal complaint for preliminary investigation has actually been docketed. Do not rely on an automated acknowledgment or ordinary email alone to protect the prescriptive period.
What happens during preliminary investigation
Cyber libel carries a prescribed imprisonment range reaching beyond six years, so it proceeds through regular preliminary investigation under the 2024 DOJ-NPS Rules. The Supreme Court upheld those rules in Meking v. Remulla.
The usual sequence is:
- The prosecution office evaluates the complaint and supporting evidence.
- If the complaint warrants an answer, the prosecutor issues a subpoena with copies of the complaint and attachments.
- The respondent submits a sworn counter-affidavit, witness affidavits, and supporting evidence. The subpoena should provide at least ten days from receipt before the scheduled submission or hearing; follow the exact date stated.
- The prosecutor may require clarificatory matters or allow further submissions when authorized.
- The prosecutor determines whether the evidence establishes a prima facie case with reasonable certainty of conviction, including admissible, credible, and preservable evidence covering all elements and the identity of the responsible person.
- The complaint is dismissed or an Information is filed in the designated cybercrime court.
A preliminary investigation is not the trial. If an Information is filed, the prosecution must still prove guilt beyond reasonable doubt in court.
How to defend a complaint
Act immediately after receiving a subpoena
Note the date, time, and manner of service. Obtain every page of the complaint, affidavits, and annexes. Do not assume an extension will be granted, and do not substitute an informal letter or social-media explanation for a sworn counter-affidavit.
If you cannot afford private counsel, promptly ask the Public Attorney’s Office whether you meet its financial and merit requirements, or approach an IBP legal-aid office.
Preserve—not delete—your own records
Keep the relevant device, account archive, drafts, source documents, research notes, messages with editors or sources, login alerts, and evidence of compromise or unauthorized access. Deleting or editing the material after learning of a case can destroy helpful context and may create credibility or evidence-preservation problems.
Do not contact or threaten the complainant or witnesses. Do not post a running public defense that repeats the accusation or creates new statements. Communications about settlement or correction are safer through counsel.
Address every element separately
A counter-affidavit should test, among other matters:
- Defamatory meaning: Does the full statement actually impute a discreditable fact, or is it protected criticism, opinion, satire, or rhetorical language?
- Publication: Is there competent evidence that a third person received or read it?
- Identification: Could a third person identify the complainant from the statement and context?
- Authorship: What proves that the respondent created or controlled the relevant account or device?
- Authenticity: Are the screenshots complete, unaltered, and properly authenticated?
- Computer-system use: Does the evidence establish the technological means alleged?
- Malice: Was there good-faith reliance on records, verification, an official proceeding, a legal or social duty, or another recognized privilege?
- Actual malice: If the case concerns a public officer, public figure, or qualifiedly privileged matter, can the prosecution prove knowledge of falsity or reckless disregard?
- Truth and purpose: Are there admissible documents and witnesses establishing truth, good motives, and justifiable ends?
- Venue: Do the allegations and evidence connect the case to the chosen city or province?
- Prescription: When was the material actually discovered, and when was the formal complaint filed?
- Prior proceedings: Is the same publication being charged twice under ordinary libel and cyber libel?
In Disini, the Supreme Court held that identical material cannot be prosecuted as both traditional libel and cyber libel for the same offense because that would violate the rule against double jeopardy.
Challenge the discovery date with evidence
A prescription defense should not rest only on the upload date. Preserve messages, emails, earlier complaints, public responses, demand letters, meeting minutes, or witness testimony showing when the complainant, authorities, or their agents first knew of the post. In Causing, the Court allowed the issue to be litigated but refused to quash solely on unsupported assertions.
Review the prosecutor’s resolution promptly
Under the 2024 DOJ-NPS Rules, an aggrieved party may file a motion for reconsideration within 15 days from receipt of the resolution. A petition for review or appeal may also be available under the applicable DOJ rules, but the proper reviewing office and requirements depend on where the complaint was decided and which court has jurisdiction.
A petition for review does not safely justify ignoring court proceedings. If an Information has already been filed, counsel should consider a motion to suspend proceedings and comply with all court dates unless the court orders otherwise.
If an Information or arrest warrant has been issued
Once an Information is filed, the judge independently evaluates judicial probable cause. The judge may dismiss the case for lack of probable cause, require additional evidence, or issue a warrant of arrest when legally warranted.
For cyber libel, bail is generally a matter of right before conviction by the Regional Trial Court, but the court fixes the amount and conditions. A person who learns of a case or warrant should not evade service. Counsel can verify the docket, obtain the order, coordinate a lawful voluntary surrender when appropriate, and arrange the correct form of bail.
Before entering a plea, review possible objections to jurisdiction, venue, sufficiency of the Information, prescription, and double jeopardy. Some objections can be waived if not timely raised. An accused should also understand the consequences before agreeing to stipulations, admissions, plea negotiations, or testimony.
A judgment of conviction by the RTC is generally appealed by filing a notice of appeal within 15 days from promulgation or notice, subject to the rules on motions for reconsideration or new trial. Never calculate an appellate deadline from memory; confirm the operative date from the record.
Possible penalties and civil liability
Cyber libel may be punished by:
- Imprisonment from four years, two months and one day to eight years;
- A fine from ₱40,000 to ₱1,500,000; or
- Both imprisonment and fine.
Civil damages may also be awarded. The Supreme Court has confirmed that a fine may be imposed as an alternative to imprisonment and calculated the current cyber-libel fine range in Dela Cruz v. People, G.R. No. 256700.
Administrative Circular No. 08-2008 recognizes a preference for a fine rather than imprisonment in appropriate libel cases, but it does not abolish imprisonment or guarantee a fine-only sentence. The court retains discretion based on the facts.
An apology, correction, deletion, settlement, or affidavit of desistance does not automatically extinguish criminal liability. Once a criminal case is underway, the public prosecutor represents the People of the Philippines. These steps may nevertheless affect the evidence, damages, penalty, or practical resolution and should be discussed with counsel before publication.
Common mistakes to avoid
- Waiting for the platform to answer a takedown request while the one-year period runs;
- Filing in a convenient city without evidence supporting venue;
- Submitting cropped screenshots that omit the URL, account identity, date, or surrounding conversation;
- Treating an anonymous account name as proof of the real author;
- Assuming falsity alone establishes cyber libel;
- Assuming truth alone guarantees acquittal;
- Naming people who merely liked or shared material without examining Disini;
- Repeating the entire accusation in a demand letter or public response;
- Editing or deleting records after receiving a complaint or subpoena;
- Ignoring the prosecutor’s deadline because settlement discussions are ongoing;
- Assuming a motion for reconsideration or DOJ appeal automatically stops the court case;
- Paying an unauthorized “facilitator” instead of filing through the official office; and
- Treating a platform report, barangay complaint, or informal police blotter as equivalent to a docketed prosecutorial complaint.
When legal help is urgent
Seek a Philippine criminal-law lawyer immediately if:
- The one-year period is close to expiring;
- A prosecutor’s subpoena, resolution, Information, summons, or warrant has been received;
- The account is anonymous or platform data may soon disappear;
- The publication was edited, reposted, translated, or circulated across several platforms;
- Several complainants or jurisdictions are involved;
- The statement concerns a public officer, journalist, election, government contract, or major public controversy;
- A device, account, or newsroom record is being sought by investigators;
- The material also contains threats, doxxing, intimate images, sexual content, or information about a child;
- The respondent was outside the Philippines for part of the relevant period; or
- A civil damages case, administrative complaint, employment case, or professional-disciplinary proceeding is also threatened.
Frequently asked questions
Is a demand letter required before filing?
No. A prior demand, apology request, or takedown request is not an element of cyber libel. A carefully drafted demand may help resolve a dispute, but it should not be allowed to consume the prescriptive period.
Can a private message be cyber libel?
Possibly, if it was communicated through a computer system to someone other than the person defamed. A one-to-one message sent only to the complainant ordinarily lacks publication, while a message sent to a third party or group may satisfy that element.
Can someone be charged for sharing a defamatory post?
A simple share or reaction is not automatically punishable as cyber libel under Disini. Liability may arise if the person creates a new defamatory assertion or becomes the original author of a distinct publication.
What if the post has already been deleted?
Deletion does not erase a completed publication. A case may still proceed if admissible evidence proves the content, publication, identity, authorship, online means, malice, venue, and timely filing. Preservation and authentication become especially important.
What if the account was hacked or impersonated?
That may defeat authorship, but it should be supported by evidence such as security alerts, login records, recovery messages, reports to the platform, device history, or forensic findings. Report the compromise promptly and preserve the account rather than deleting it.
Does filing a complaint mean the respondent will be arrested immediately?
No. A complaint first undergoes prosecutorial evaluation and preliminary investigation. If an Information is later filed, the judge independently determines judicial probable cause and whether a warrant is necessary. An existing warrant must, however, be handled immediately through counsel.
Can the complainant withdraw the case after an apology or settlement?
The complainant may submit an affidavit of desistance or confirm a settlement, but withdrawal does not automatically end the criminal case. The prosecutor and court must determine the legal effect. Any settlement should separately address civil claims, correction or removal terms, confidentiality, and preservation of lawful evidence.
Official references
- Republic Act No. 10175 — Cybercrime Prevention Act of 2012
- Republic Act No. 10951 — updated fines under the Revised Penal Code
- Disini v. Secretary of Justice
- Causing v. People — one-year prescription from discovery
- 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings
- DOJ cybercrime-reporting guidance
- NBI online complaint page
- Rules on Electronic Evidence
This article provides general Philippine legal information, not legal advice or an attorney-client opinion. Outcomes depend on the exact words, audience, publication history, evidence, discovery date, venue, and procedural record. Laws and official procedures were checked through controlling and official sources as of August 27, 2026.