"As AI-powered traffic becomes widespread, existing tools to support its use are too generic and coarse," said Dane Knecht in a statement.
Who signed up: Cloudflare with Chrome, Edge and Firefox
Cloudflare on Monday announced a collaboration with the three leading commercial browser makers — Google Chrome, Microsoft Edge, and Mozilla Firefox — to develop a privacy-preserving protocol called Private Access Control Tokens, or PACTs. The companies have committed to work together to let websites generate and accept these tokens as a way to separate "desirable" web traffic from requests they deem abusive or improper.
What PACTs are and how they're intended to work
PACTs are described as anonymous digital tokens that a website with "strong knowledge of 'personhood'" can issue. Browser users and "designated bots" would be able to present those tokens at other sites so that fewer identity checks are required. The announcement frames PACTs as a shareable, privacy-preserving CAPTCHA result: the test assesses the desirability of traffic — whether a session represents a visitor or a bot with legitimate intent — rather than simply whether the visitor is human or software.
Technical specifics are still being "hammered out and harmonized between related proposals," according to the report. The collaboration aims to let sites that can confidently determine personhood issue tokens so subsequent sites do not need to repeat identity checks, reducing friction while preserving anonymity in the token itself.
Privacy caveats and fingerprinting risks
Cloudflare and its browser partners present PACTs as privacy-preserving, but the announcement and accompanying analysis temper that claim. PACT tokens themselves "will not contain personal details," yet they will not address "all the other ways browsers can facilitate digital fingerprinting and tracking." The report cautions that if PACTs are implemented poorly they "may introduce novel risks," and that the technology divides traffic into welcome and unwelcome classes — a function already performed by firewalls and other measures but not easily reconciled with a notionally open web.
Questions remain about what qualifies as "strong knowledge of 'personhood'." The source material notes that "personhood" appears to extend to software authorized to act on behalf of a legitimate person for an authorized purpose. It is not clear from the current discussion what signals, behaviors, browsers, or hardware might be favored or disadvantaged by PACT criteria — though past technical discussion by developers at Google and Mozilla suggests deliberately excluding certain hardware, platforms, or user‑agents is not the goal.
An anti-fraud tool that could also be an access barrier
Cloudflare frames PACTs as an anti-fraud measure. The company says the technology is designed to "empower businesses to identify genuine visitors, ensuring they can focus their resources on the traffic that matters to them." Many site operators, the announcement notes, have complained about the burden of handling unwanted traffic from disrespectful crawlers and abusive automation; PACTs may directly address that operational pain point.
At the same time, the report warns PACTs "may also become an access barrier" — effectively requiring negotiation with site publishers to have a visit or a software agent deemed worthy of "personhood." Bobby Holley, CTO for Firefox at Mozilla, is quoted saying, "Mozilla is committed to defending openness and user privacy on the web," and framing PACTs as a response to an "avalanche of automated traffic" that has driven adoption of blunt measures such as paywalls, CAPTCHAs and invasive tracking.
What PACTs mean for technologists, enterprises, and end users
- Technologists and security teams: Expect a new protocol to integrate into site authentication and bot-mitigation stacks; engineers will need to follow the harmonization of technical details and evaluate whether PACT issuance and verification introduce fingerprinting or operational risk.
- Affected enterprises and procurement leaders: PACTs are being pitched as an anti-fraud capability that could reduce the operational cost of handling unwanted automated traffic; organizations should weigh benefits against potential vendor lock-in and access-control consequences implied by token-based personhood.
- End users and the general public: Tokens "will not contain personal details," yet users should be aware PACTs do not solve browser fingerprinting or tracking and may alter how sites decide who gains seamless access.
Cloudflare and the browser makers have signaled an intent to reduce friction for both humans and authorized agents: "Now this collaboration lets us eliminate the friction caused by security protocols for every visitor – whether they are human or agent – without sacrificing privacy," Dane Knecht said. The claim rests on implementation choices that are still being written; the coming months of technical work will determine whether PACTs curtail abusive automation without introducing new forms of exclusion or surveillance.
