Control and enforcement of access of user data are described, including receiving a request from an application to access data associated with a user; determining that a service profile and another service profile are associated with the user, the service profile includes at least one data service specified by the user and the another service profile includes at least another data service specified by the user; identifying the service profile being associated, by the user, with at least the application; determining whether the data requested by the application are provided by the at least one data service included in the service profile; and performing an action with respect to access by the application to the data requested, based on a result of the determining.