I don't think this is correct. This test is satisfied for anyone who has permission to view a user's email, including superusers, the user himself, and possibly everyone if the user later decides that their email should be public. You can use {% if user == request.user %} to check if a user is on their own profile.