An external authorization server or an authorization server internal to the social networking system 228 enforces one or more privacy settings of the users of the social networking system 228. A privacy setting of a user determines how particular information associated with a user can be shared, and may be stored in the user profile of a user in the user profile store 284 or stored in the authorization server and associated with a user profile. In one embodiment, a privacy setting specifies particular information associated with a user and identifies the entity or entities with whom the specified information may be shared. Examples of entities with which information can be shared may include other users, applications, third party systems or any entity that can potentially access the information. Examples of information that can be shared by a user include user profile information like profile photo, phone numbers associated with the user, user's connections, actions taken by the user such as adding a connection, changing user profile information and the like.