Overview
- Cloudflare announced a joint initiative with Google Chrome, Mozilla Firefox and Microsoft Edge on June 22 to develop Private Access Control Tokens, or PACT, as an open protocol for verifying legitimate web access.
- PACT would let sites with “strong knowledge of personhood” issue anonymized tokens that a user’s browser can present to prove a human is in the loop or that an authorized AI agent is acting for them.
- Shopify has joined the effort and browser makers plan to help standardize the proposal, with Cloudflare saying PACT could run on its network to reduce false-positives and checkout friction for merchants.
- The project is not rolling out yet and it provides no deployment timeline; major technical and governance questions remain, notably who will issue tokens and how control will be distributed across sites, browsers and infrastructure providers.
- If adopted, PACT could cut CAPTCHAs and lower user friction but could also concentrate gatekeeping power unless clear issuer rules and privacy safeguards are established, so observers say watch standards and governance next.