The rise of microtargeted online disinformation (MOD) has raised concerns over its harms to democracy and human rights. Debates over the regulation of MOD crystallise around Article 10 of the European Convention on Human Rights, the right to freedom of expression, and its limited capacity to regulate disinformation. As the chapter demonstrates, the effects of disinformation are compounded by microtargeting techniques. These facilitate the surgical spread of information to homogeneous groups, based on the analysis of people’s personal data. The chapter contends that human rights protection has shifted from human rights law to other legal regimes. They centre on the protection of personal data, the regulation of online platforms and search engines and the technological systems that propel them, and the use of targeted political advertising. The chapter demonstrates this claim with reference to selected European Union legal instruments, discussing their capacity to address the harmful effects of MOD. It will be argued that the broadening of human rights protection beyond human rights law should be welcomed, but it also has significant limitations, including enforcement gaps and wide-ranging scope for exemptions.