Cloudflare and Browser Makers Move Toward Personhood Tokens

The agentic web has a traffic problem: the old human-versus-bot distinction is no longer enough.

On June 22, 2026, Cloudflare announced a collaboration with Mozilla Firefox, Google Chrome, Microsoft Edge, and Shopify to develop Private Access Control Tokens, or PACT.¹ The proposal is meant to let legitimate humans and authorized bots prove that their traffic is not malicious, without forcing every site to fall back to CAPTCHAs, login walls, or invasive tracking.¹

The timing matters. AI agents are starting to browse, compare, buy, book, and automate work on behalf of people. At the same time, site operators are dealing with increasingly aggressive automated traffic. A blanket "block bots" policy is too crude for that world. Some automation is abuse. Some is a user's assistant doing exactly what the user asked.

PACT tries to create a privacy-preserving middle layer. Cloudflare describes the basic flow like this: a site that already has strong knowledge of a visitor's "personhood" can issue an anonymous token. Later, the user's browser can present that token to another site as evidence that a human is in the loop.¹ The receiving site should be able to verify the token without learning who the user is or seeing their browsing history.¹

That makes PACT adjacent to CAPTCHA, but not identical to it. CAPTCHA asks a visitor to prove something in the moment. PACT aims to let a prior trust decision travel privately across contexts. In Cloudflare's framing, this could reduce friction while giving site owners a better legitimacy signal.¹

Why agents change the requirement

The interesting part is that Cloudflare is explicitly not treating all automation as hostile. Its announcement says the protocol is intended to help humans and bots prove their traffic is not malicious.¹ That is a quiet but important shift.

For agentic systems, identity is layered. A shopping assistant, coding assistant, or research agent may need to show different things: that it is real software, that it is authorized by a user, that the user has an account in good standing, or that the request fits an allowed quota. PACT focuses on the "human in the loop" signal rather than every bot-authentication problem at once.

Shopify's involvement also explains the commercial pressure. E-commerce sites need protection against abuse, credential stuffing, inventory scraping, and checkout attacks. But every extra challenge can also break legitimate purchases. A token that helps distinguish a real buyer or authorized assistant from abusive automation is valuable only if it avoids turning privacy into the price of entry.

The open questions

PACT is not deployed web infrastructure yet. Cloudflare says the collaborators are committing to developing and submitting the protocol for standardization.¹ The details still matter: who can issue tokens, how issuers are trusted, how rate limits work, how smaller browsers participate, and what happens to users without a token.

Independent coverage has already pointed at the central risk: a system designed to separate welcome from unwelcome traffic can become an access gate if implemented poorly.² The privacy promise is also scoped. PACT may avoid putting identity into the token itself, but it does not magically remove every other form of browser fingerprinting or traffic analysis.

Still, the direction is worth watching. In April, Cloudflare spent Agents Week laying out infrastructure for agentic software: MCP servers, agent authentication, sandboxing, and agent-oriented deployment flows. In June, Temporary Cloudflare Accounts gave coding agents a way to deploy Workers without a prior signup.³ PACT now points at the browser and standards layer: how the public web decides which automated requests deserve trust.

For developers, the practical lesson is simple. The next web stack will not only be HTML, CSS, JavaScript, APIs, and auth. It will also include machine-readable trust signals for humans, agents, browsers, and services. PACT is early, but it is one of the clearest signs that the web is being redesigned for a world where users increasingly act through software.

The hard part is making that world more private and less annoying without giving a few large platforms the power to decide who counts as legitimate.

Sources