Cloudflare announced Monday that it’s working with Google Chrome, Microsoft Edge, and Mozilla Firefox to build something called Private Access Control Tokens, or PACTs. The idea is simple enough: give websites a way to tell legitimate traffic apart from the junk, without forcing every visitor to prove they’re human through another CAPTCHA or login wall.
Here’s how it works. A site that already trusts a visitor, whether that visitor is a person or an authorized bot, can hand out a token confirming that trust. The visitor then carries that token to other sites, which cuts down on repeated identity checks. Think of it less as a “are you human” test and more as a “should we let this traffic through” test.
The tricky part is what counts as enough proof to earn one of these tokens. Cloudflare’s announcement doesn’t spell out exactly what “personhood” means once you include software acting on someone’s behalf, and engineers from Google and Mozilla have said they don’t want the system to automatically lock out certain devices or browsers. Whether that holds up in practice remains an open question.
Dane Knecht, Cloudflare’s CTO, framed the push around how browsing itself is changing. “As AI-powered traffic becomes widespread, existing tools to support its use are too generic and coarse,” he said, adding that the collaboration aims to cut friction for human and AI visitors alike.
Mozilla’s Bobby Holley pointed to the same pressure from a different angle, noting that a flood of automated traffic pushes sites toward blunt fixes like paywalls and invasive tracking just to figure out who’s actually behind a request.
Cloudflare calls this a privacy win, and the tokens reportedly won’t carry personal details. But they don’t touch fingerprinting or other tracking methods already baked into the web, and depending on how the rollout goes, they could create a new kind of gatekeeping rather than remove one. A lot of site owners are fed up with bot traffic and will appreciate the break. Others might find themselves at the table with platforms, making the case that their own visitors are legitimate.
