Personalized web search (pws) has demonstrated its effectiveness in improving the quality of various search services on the internet. however, evidences show that users’ reluctance to disclose their private information during search has become a major barrier for the wide proliferation of pws. we study privacy protection in pws applications that model user preferences as hierarchical user profiles. we propose a pws framework called ups that can adaptively generalize profiles by queries while respecting user specified privacy requirements. our runtime generalization aims at striking a balance between two predictive metrics that evaluate the utility of personalization and the privacy risk of exposing the generalized profile. we present two greedy algorithms, namely greedydp and greedyil, for runtime generalization. we also provide an online prediction mechanism for deciding whether personalizing a query is beneficial. extensive experiments demonstrate the effectiveness of our framework. to protect user privacy in profile-based pws, researchershave to consider two contradicting effects during the searchprocess. on the one hand, they attempt to improve thesearch quality with the personalization utility of the userprofile. on the other hand, they need to hide the privacycontents existing in the user profile to place the privacy riskunder control. a few previous studies suggest thatpeople are willing to compromise privacy if the personalizationby supplying user profile to the search engineyields better search quality. in an ideal case, significantgain can be obtained by personalization at the expenseof only a small (and less-sensitive) portion of the userprofile, namely a generalized profile. thus, user privacy canbe protected without compromising the personalizedsearch quality. in general, there is a tradeoff between thesearch quality and the level of privacy protection achievedfrom generalization.