Private Access Control Tokens, known as PACT, are a proposed web technology for proving that an online visitor is legitimate without making them solve a CAPTCHA, create an account, or reveal their browsing history. The idea drew attention in June 2026, when Cloudflare announced that it was working with Mozilla, Google, Microsoft and Shopify to develop the approach and submit it for standardization.
What Are Private Access Control Tokens?
PACT is a privacy-preserving access-control system. A service that already has good reason to trust a person or an authorized software agent can issue an anonymous digital token. The visitor’s browser or agent can then present that token to another website as proof that it meets a particular rule, such as having a real person involved or being an approved automated agent.
The website receives an assurance rather than a personal profile. PACT is designed to keep sites from using the token to identify someone or track them across the web.
How PACT Works
PACT separates the verification process from access to a website. A trusted party first verifies the visitor according to its own policy and issues a limited, anonymous endorsement. The browser converts that endorsement into a credential based on the website’s chosen policy. Once the visitor reaches the site, the browser presents the credential so the site can check that it’s valid.
This multi-party design keeps the verifying organization from needing to know every site the visitor accesses. At the same time, the destination site doesn’t need to see the visitor’s underlying identity. The technical proposal also aims to prevent separate token presentations from being linked.
Why PACT Matters
Websites need ways to defend themselves against fraud, scraping, account abuse and harmful automation. Current tools often depend on CAPTCHAs, device fingerprinting, forced logins or broad bot blocking. These methods can disrupt legitimate visitors while collecting more information than a site actually needs.
PACT could provide websites with a more precise signal and create less friction for people. It may also help them tell authorized AI agents apart from abusive automated traffic, making it possible to apply different policies or limits instead of treating every bot the same way.
Why It’s Getting Attention Now
AI agents are starting to handle tasks such as searching, shopping and submitting requests on behalf of users. As a result, websites are finding it harder to separate useful automation from abuse. PACT remains a proposal, not a finished universal standard, but the involvement of browser makers and web-platform companies makes it a technology to watch.
?){kind=link}