Cloudflare and browsers launch PACT to reduce CAPTCHAs

Websites and services have long relied on CAPTCHAs, logins, or other gatekeeping methods to filter out automated traffic, but these measures often create friction for legitimate users. Cloudflare, in partnership with the teams behind Google Chrome, Microsoft Edge, and Mozilla Firefox, is testing an alternative approach called Private Access Control Tokens (PACT) to streamline this process without sacrificing security or privacy.

The system works by allowing sites that already trust a visitor—whether human or an authorized bot—to issue a token confirming that trust. The visitor can then present this token to other sites, reducing the need for repeated identity verification. Unlike traditional CAPTCHAs, which explicitly ask users to prove their humanity, PACT focuses on whether traffic should be allowed through based on prior validation. This shift could ease the burden on users while still giving site owners a tool to manage unwanted automation.

How PACT works

PACT tokens are designed to be lightweight and privacy-preserving. According to Cloudflare, the tokens do not carry personal data, and the system is intended to complement—not replace—existing anti-bot measures. However, the approach raises questions about what constitutes sufficient proof of legitimacy. For example, the sources do not clarify how the system will handle software acting on behalf of users, such as AI agents or automated scripts authorized by humans. Engineers from Google and Mozilla have emphasized that the system should not automatically exclude certain devices or browsers, but whether this principle will hold in practice remains uncertain.

Industry motivations

The push for PACT comes as automated traffic—particularly AI-driven requests—becomes more prevalent. Cloudflare’s CTO, Dane Knecht, described the current tools for managing this traffic as "too generic and coarse," noting that the collaboration aims to reduce friction for both human and AI visitors. Mozilla’s Bobby Holley echoed this sentiment, warning that the surge in automated traffic has led some sites to adopt blunt solutions like paywalls or invasive tracking to distinguish legitimate users from bots. PACT is positioned as a way to mitigate this trend while preserving user privacy.

However, the system is not without potential drawbacks. While PACT tokens themselves do not include personal information, they do not address other forms of tracking, such as fingerprinting, which are already embedded in many websites. There are also concerns that the system could inadvertently create new barriers, particularly for smaller sites or less common browsers that may struggle to establish trust within the PACT framework. Cloudflare’s announcement acknowledges this risk, noting that site owners may need to advocate for their visitors’ legitimacy if the system’s criteria are too restrictive.

What to watch

The success of PACT will depend on several factors, including how widely it is adopted by browsers and websites. Early testing will likely focus on high-traffic platforms where bot mitigation is a priority, but broader implementation could take years. Another key question is whether the system can adapt to evolving threats, such as AI agents that mimic human behavior more convincingly. If PACT proves effective, it could reduce reliance on CAPTCHAs and other user-facing verification methods, but its long-term impact on privacy and accessibility remains to be seen.

For now, the initiative represents a collaborative effort to address a growing challenge in web infrastructure, with implications for developers, site owners, and end users alike.