PACT Protocol: Cloudflare's Partnership With Leading Browsers

Cybersecurity and content distribution giant Cloudflare is teaming up with major browser vendors—Mozilla Firefox, Google Chrome, and Microsoft Edge—to develop a privacy-first protocol known as PACT (Private Access Control Tokens). The goal? To help both human users and automated bots seamlessly prove their web traffic is safe and non-malicious.

As the internet undergoes a paradigm shift from human-initiated clicks to autonomous AI agents, Cloudflare recognizes an urgent need for web platforms to manage aggressive automated traffic without relying on invasive tracking. PACT is envisioned as the foundation for a secure, private web experience that benefits both end-users and platform owners.

Dane Knecht, CTO of Cloudflare, summarized the motivation behind the initiative:

“The way we interact with the Internet is facing a fundamental shift. Normal everyday tasks like ordering food previously required a user to personally navigate menus and payment gateways. Now, autonomous agents are starting to orchestrate these workflows on behalf of people.

As AI-powered traffic becomes widespread, existing tools to support its use are too generic and coarse. Now this collaboration lets us eliminate the friction caused by security protocols for every visitor—whether they are human or agent—without sacrificing privacy."

PACT: The Design Principles

The core concept of PACT revolves around trust. When a website or application confidently verifies the legitimacy of a visitor, it issues an anonymous token. Browsers can then carry this token to other websites to confirm the visitor’s identity, drastically reducing the need for repetitive challenges like CAPTCHAs.

This interoperable “carry-forward” approach is an exciting solution to some of the web’s most pressing usability issues—especially as the proliferation of AI tools threatens to further complicate traffic verification.

How about Privacy?

Crucially, PACT is built with privacy at its core. The protocol ensures that websites receiving these tokens cannot use them to track individuals or piece together their browsing history. This makes the initiative particularly exciting, as it actively works to preserve user anonymity.

Bobby Holley, CTO for Firefox, highlighted this commitment:

“Mozilla is committed to defending openness and user privacy on the web. An avalanche of automated traffic is pushing sites to adopt blunt defenses—paywalls, identity checks, CAPTCHAs, and invasive tracking—simply to tell whether a request comes from a human. We can build a better solution that maintains strong privacy and provides a much less annoying experience for real humans using the web. This project requires collaboration across the ecosystem, and we’re thrilled to work with Cloudflare and other like-minded partners to bring it to life.”

The Evolving Landscape

Because PACT is still in its ideation phase, the exact mechanics of how “personhood” or legitimacy will be verified remain under development.

However, looking at it through a Cloudflare lens, the potential is clear: imagine a user passes a single Turnstile challenge on one site, and that success token seamlessly validates them on other participating sites. This dynamic not only bolsters Cloudflare’s bot management portfolio but also addresses a fundamental internet-wide problem by standardizing this capability across browsers.

Today’s identity validation ecosystem is highly fragmented. Cloudflare and major browser vendors are working to standardize this process, enabling websites to issue reusable tokens. This will allow browsers to seamlessly verify users and autonomous agents across multiple sites during a single session.

While many promising tech initiatives launch with fanfare only to stall due to slow standardization or hesitant adoption by web owners, PACT holds significant promise. Only time will tell how quickly this ecosystem evolves, but it is undoubtedly an exciting idea worth watching.