Cloudflare, Mozilla Firefox, Google Chrome, Microsoft Edge, and Shopify have jointly announced PACT, which stands for Private Access Control Tokens. It is a privacy-friendly protocol that helps websites distinguish between humans, legitimate bots, and malicious automated traffic, without invasive tracking or annoying CAPTCHAs.
For years, website owners have struggled with a patchwork of defense mechanisms (CAPTCHAs, forced logins, invasive tracking) to combat bot abuse. These methods are becoming increasingly restrictive. The problem has only grown worse. With the rise of generative AI, malicious automation has become more widespread, more sophisticated, and economically more damaging to site owners. And then there’s agentic AI. Autonomous agents perform tasks on the web on behalf of users, from ordering food to processing payments. As a result, the line between human behavior and bot activity is rapidly blurring.
“The way we interact with the Internet is facing a fundamental shift,” says Dane Knecht, CTO of Cloudflare. “Now this collaboration lets us eliminate the friction caused by security protocols for every visitor—whether they are human or agent—without sacrificing privacy.”
PACT works as follows: sites with a strong understanding of who their users are issue anonymous tokens. A browser can then present those tokens to other sites to prove that a human is behind the request. This eliminates the need for CAPTCHAs or invasive tracking.
Browsers and Retailers as Partners
Microsoft Edge, Mozilla Firefox, and Google Chrome are committed to supporting and collaborating on the standardization of PACT. Shopify is also joining the initiative. The platform aims to protect its millions of merchants without burdening their customers with unnecessary friction.
PACT is designed so that websites cannot use it to track users or retrieve their browsing history. This positions the initiative as an alternative to the invasive tracking techniques currently used for bot detection.
The consortium is currently working on further developing the protocol and plans to submit PACT to a standards body.