Abstract: A customer profile access protocol with flexible access control capabilities is provided. The protocol facilitates secure and privacy enabled access to user profile data. The user profile data may be accessed by clients, such as other users, service providers and system administrators. The user profile data may be used by service providers and system administrators. The user profile data may be used by service providers to customize services provided to users. Permissions that control profile access may be established under user control. The user may specify different permissions for different grains of information within the user profile. For example, a first set of permissions may be associated with the entire user profile whereas a second set of permissions may be associated with a particular field in the user profile. Clients may be grouped such that permissions may be associated with a single group or combinations of groups specified by algebraic set operators.