We use the Power-Responsibility Equilibrium (PRE) framework and advance that consumers balance perceived deficits in privacy protection by power holders (businesses and regulators) with defensive actions. In our model, consumer privacy concern is the endogenous mediating entity linking business policy and regulatory perceptions to negative online user responses. The model was empirically tested and confirmed in an experimental setting. In a second study, we added the nature of consumer information involved into a sub-model. Here, we investigated the moderating role of information sensitivity and congruency on the business policy-concern relationship across three industry contexts. Both hypothesized two-way interactions were confirmed, suggesting that a strong business policy is effective in reducing concern when low sensitivity data are gathered, but insufficient in reducing concern for highly sensitive data. Furthermore, concern increased dramatically when sensitive data were collected that were incongruent with the business context.PUBLICATION ABSTRACT