diff --git modules/callbacks.inc modules/callbacks.inc
index 12a4042..2fd8ccf 100644
--- modules/callbacks.inc
+++ modules/callbacks.inc
@@ -515,6 +515,33 @@ function entity_metadata_user_access($op, $entity = NULL, $account = NULL, $enti
 }
 
 /**
+ * Access callback for restricted user properties.
+ */
+function entity_metadata_user_properties_access($op, $property, $entity = NULL, $account = NULL) {
+  if (user_access('administer users', $account)) {
+    return TRUE;
+  }
+  // Allow view access to anyone with access to the entity for some properties.
+  if ($op == 'view' && $property == 'name') {
+    return TRUE;
+  }
+  // Only grant access to some properties for the user itself.
+  $account = isset($account) ? $account : $GLOBALS['user'];
+  if (!isset($entity) || $account->uid != $entity->uid) {
+    return FALSE;
+  }
+  switch ($property) {
+    case 'name':
+      return user_access('change own username', $account);
+    case 'mail':
+      return TRUE;
+    case 'roles':
+      return ($op == 'view');
+  }
+  return FALSE;
+}
+
+/**
  * Access callback for the comment entity.
  */
 function entity_metadata_comment_access($op, $entity = NULL, $account = NULL) {
diff --git modules/user.info.inc modules/user.info.inc
index b25f412..144ca1e 100644
--- modules/user.info.inc
+++ modules/user.info.inc
@@ -27,6 +27,7 @@ function entity_metadata_user_entity_property_info() {
     'setter callback' => 'entity_property_verbatim_set',
     'sanitize' => 'filter_xss',
     'required' => TRUE,
+    'access callback' => 'entity_metadata_user_properties_access',
   );
   $properties['mail'] = array(
     'label' => t("Email"),
@@ -34,6 +35,7 @@ function entity_metadata_user_entity_property_info() {
     'setter callback' => 'entity_property_verbatim_set',
     'validation callback' => 'valid_email_address',
     'required' => TRUE,
+    'access callback' => 'entity_metadata_user_properties_access',
   );
   $properties['url'] = array(
     'label' => t("URL"),
@@ -66,6 +68,7 @@ function entity_metadata_user_entity_property_info() {
     'setter callback' => 'entity_metadata_user_set_properties',
     'setter permission' => 'administer users',
     'options list' => 'entity_metadata_user_roles',
+    'access callback' => 'entity_metadata_user_properties_access',
   );
   return $info;
 }