Can Businesses Sue Over Online Review Bombing?

Introduction

Coordinated online harassment and review bombing can damage a business’s reputation, reduce customer confidence, disrupt operations, and cause measurable financial loss. A campaign may involve multiple accounts posting substantially similar reviews, false accusations, manipulated ratings, disclosure of private information, or coordinated calls to boycott a business.

Philippine businesses may pursue civil, criminal, administrative, and platform-based remedies. The appropriate response depends on whether the campaign contains false factual imputations, unauthorized disclosure of personal information, threats, deceptive commercial conduct, or merely harsh but protected opinion.

When Review Bombing May Become Legally Actionable

Negative reviews are not automatically unlawful. Consumers may generally express dissatisfaction, criticize a business, or report their personal experiences, provided that their statements are substantially truthful and are not made through unlawful means.

The risk of liability increases when a coordinated campaign involves false factual statements, fabricated customer experiences, malicious impersonation, threats, harassment, doxxing, or deliberate manipulation designed to cause economic injury.

Under Article 353 of the Revised Penal Code, libel involves a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance tending to cause dishonor, discredit, or contempt of a natural or juridical person. A business may therefore be the subject of defamatory statements, since the law protects juridical persons against reputational injury.

For online publications, the Cybercrime Prevention Act applies the relevant Revised Penal Code provisions to libel committed through a computer system. Section 6 of R.A. No. 10175 provides that crimes under the Revised Penal Code and special laws committed through information and communications technologies are subject to a penalty one degree higher. (Section 6, R.A. No. 10175, as discussed in “People of the Philippines v. Soliman,” G.R. No. 256700, Date of the Decision not stated in the supplied record.)

However, liability still requires proof of the elements of libel. A business must distinguish between an actionable false statement of fact and protected opinion, fair comment, or a consumer’s genuine account of an experience.

Civil Damages for Defamation and Related Wrongs

A business may institute an independent civil action for damages in cases of defamation. Article 33 of the Civil Code expressly allows a civil action for damages, entirely separate and distinct from the criminal action, in cases of defamation, fraud, and physical injuries. The civil action requires only a preponderance of evidence. (Civil Code of the Philippines, Article 33.)

The civil action may seek compensation for actual or proven financial losses, moral damages where legally available, exemplary damages when the defendant acted wantonly or fraudulently, and attorney’s fees when the statutory requirements are met. The business must connect the campaign to specific injury rather than rely solely on a general allegation that its reputation was harmed.

Based on internal knowledge of Philippine law. Articles 19, 20, and 21 of the Civil Code may also support a claim where persons exercise their rights in a manner contrary to justice, give contrary to law, or wilfully cause loss or injury in a manner contrary to morals, good customs, or public policy. These provisions are fact-sensitive and should not be pleaded as substitutes for proof of the specific unlawful acts and resulting damage.

What the Business Must Prove

A strong civil complaint should identify the precise conduct, the persons responsible, the unlawful character of the campaign, and the resulting harm. The following matters are commonly material:

• Identifiable defendants: The business should establish the identity of the account owners, organizers, employees, contractors, or other participants.
• Publication or communication: The business should preserve the posts, reviews, messages, videos, comments, advertisements, and links showing that the statements were made available to third parties.
• Falsity or unlawful character: The complaint should identify which statements are false factual assertions, threats, unauthorized disclosures, or other unlawful acts.
• Malice or bad faith: Evidence may include coordinated timing, identical wording, false accounts, instructions to post without personal knowledge, or communications showing an intent to injure.
• Actual injury: The business should document cancelled orders, lost contracts, reduced bookings, refunds, employee disruption, increased advertising expenses, and other financial consequences.

In Bonifacio, et al. v. Regional Trial Court of Makati, et al. (G.R. No. 184800, 5 May 2010), the Supreme Court held that venue in criminal libel involving private individuals is limited to the place where the complainant actually resided at the time of the offense or where the defamatory article was printed and first published. The Court ruled that merely accessing an internet post in a location does not establish printing and first publication there.

The venue rule is especially important when a business considers filing a criminal complaint arising from online publications. The place where customers viewed a review is not automatically the proper venue for a criminal libel case.

Coordinated Conduct and Joint Liability

Coordination can materially strengthen a business’s case because it may show that the publications were not independent consumer reactions but part of a common plan. Useful evidence may include group-chat instructions, spreadsheets assigning accounts, payment records, common templates, shared links, synchronized posting times, and messages directing participants to lower a business’s rating.

Coordination alone does not establish civil or criminal liability. Each defendant’s participation, unlawful act, and connection to the injury must still be proved. A person who merely reposted a truthful customer complaint may have a different legal position from an organizer who supplied fabricated allegations and directed others to publish them.

Businesses should therefore avoid making unsupported public accusations against suspected participants. A premature accusation can create additional defamation, privacy, or commercial-dispute risks.

Privacy and Unauthorized Disclosure

Review-bombing campaigns sometimes publish the names, telephone numbers, home addresses, identification documents, health information, or private correspondence of business owners and employees. These acts may raise issues under the Data Privacy Act of 2012.

The National Privacy Commission has recognized that processing may be lawful even without consent when it rests on another statutory basis, including legitimate interest, provided that the processing is transparent, proportionate, and consistent with the rights of data subjects. (NPC 18-109, 2021.)

The same principles operate in the opposite direction: publishing personal information merely to mobilize harassment may be unlawful where there is no legitimate purpose, the disclosure is excessive, or the disclosure creates an unjustified risk to the individual.

The NPC has also held that private individuals may incur liability for unauthorized processing and disclosure of personal information in online posts. (NPC 20-287, 2024.) A business or affected employee may consider filing a complaint with the National Privacy Commission when the campaign involves personal data rather than merely business criticism.

Not every disclosure is prohibited. The NPC has recognized that processing necessary for the establishment, exercise, or defense of legal claims may be allowed when legitimate and proportionate. (NPC 22-112, 2024.) A business should therefore avoid publishing more personal information than is necessary to document or pursue its legal claim.

Evidence Preservation Before Filing a Case

Online content can be edited, deleted, or hidden. Evidence should be preserved before sending a demand letter or notifying suspected participants, because notice may prompt the destruction of relevant communications.

The business should preserve:

• Complete screenshots showing the account name, date, time, URL, rating, text, comments, and engagement;
• Archived copies or forensic captures of the pages and their metadata;
• Records showing the business’s rating and review volume before, during, and after the campaign;
• Customer-service records, cancelled transactions, refund requests, and lost-contract evidence;
• Messages, emails, group-chat content, payment records, and instructions linking participants to an organizer; and
• Affidavits from employees, customers, investigators, and other persons who observed the campaign or its effects.

Where authenticity may be disputed, the business should consider obtaining a properly prepared affidavit and preserving the electronic evidence in a manner that can satisfy the Rules on Electronic Evidence. Screenshots alone may be challenged if they do not establish who created the post, when it was made, or whether it was altered.

Demand Letters and Platform Complaints

A demand letter may request the removal or correction of false statements, preservation of relevant evidence, identification of campaign organizers, cessation of further publication, and compensation for documented losses. It should identify the specific statements complained of and explain why they are false or unlawful.

The business may also report the content to the relevant platform. The complaint should be factual and supported by links, screenshots, proof of impersonation, evidence of coordinated manipulation, and documentation of personal-data disclosures.

A platform complaint is not a substitute for legal proceedings. It may nevertheless reduce continuing harm, preserve the business’s position, and prevent further circulation while the business evaluates litigation.

Potential Criminal Remedies

Online libel may be prosecuted under Section 4(c)(4) of R.A. No. 10175 in relation to Articles 353 and 355 of the Revised Penal Code. The Supreme Court has recognized that the court may impose either imprisonment or a fine within the legally prescribed range, depending on the circumstances and the applicable penalty provisions. (People of the Philippines v. Soliman, G.R. No. 256700, Date of the Decision not stated in the supplied record.)

Other criminal offenses may be relevant depending on the facts, including threats, unjust vexation, identity theft, computer-related fraud, or unauthorized disclosure of personal information. The business should not combine unrelated offenses without identifying the facts that satisfy each statutory element.

For online libel, the business must also examine prescription, venue, authorship, publication, and the identity of the responsible persons. If the campaign occurred before the Cybercrime Prevention Act became applicable, the legal treatment may differ. The Supreme Court ruled in Peñalosa v. Ocampo, Jr. (G.R. No. 230299, 20 September 2023) that online defamation occurring before the Cybercrime Prevention Act was not punishable under Article 355 of the Revised Penal Code merely by treating the internet as a “similar means.”

Limits: Opinion, Fair Comment, and Truthful Reviews

A business should not treat every negative review as defamation. Statements such as “the service was slow,” “I would not return,” or “the product did not meet my expectations” may be opinion or a truthful account of a customer experience.

Greater legal risk arises from statements that assert verifiable but false facts, such as allegations that a business stole money, used unsafe materials, committed a crime, falsified records, or defrauded customers when the speaker had no factual basis.

Public-interest criticism and comments concerning official conduct receive particular protection. In Tan v. People of the Philippines (G.R. No. 265929, 2026), the Supreme Court stated that, in criminal libel involving public officials, the prosecution must prove actual malice beyond reasonable doubt—knowledge of falsity or reckless disregard for truth or falsity. Mere offensiveness or negligence is insufficient in that setting.

The precise constitutional and statutory defenses depend on the speaker, subject matter, wording, publication, and evidence of truth or good motives. A corporation should have counsel classify each challenged statement before commencing suit.

Recommended Response Plan

1. Activate an internal response team. Assign legal, communications, information-security, and customer-relations personnel to a single documented process.
2. Preserve evidence immediately. Capture the content, accounts, dates, links, related communications, and measurable business effects.
3. Separate legitimate criticism from unlawful conduct. Do not demand removal of truthful reviews merely because they are unfavorable.
4. Identify the participants and organizer. Use lawful investigation methods and avoid unauthorized access to accounts or devices.
5. Send a focused demand. Request correction, removal, evidence preservation, and compensation only for statements and acts that can be specifically identified.
6. File the appropriate complaint. Consider civil damages, criminal proceedings, a National Privacy Commission complaint, or platform enforcement according to the evidence.
7. Prepare a factual public response. Correct material inaccuracies without repeating defamatory allegations or disclosing unnecessary personal information.

Conclusion

A coordinated review-bombing campaign may support a civil action when the business can prove unlawful publication, bad faith or malicious conduct, participation by the defendants, and actual injury. The strongest cases are built on specific false statements, reliable evidence of coordination, identifiable defendants, and documented financial loss.

Businesses should act quickly but carefully. Preserving electronic evidence, distinguishing false allegations from protected criticism, complying with privacy requirements, and selecting the correct venue and remedy are essential to a defensible response.

About Nicolas and De Vega Law Offices

 Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.