Web infrastructure company Cloudflare announced it is working with three major web browsers to develop “a privacy-preserving protocol to help humans and bots prove that their traffic is not malicious”. In other words, to distinguish between genuine internet traffic by real people and authorised bots from the fake and malicious ones. The result is what it calls Private Access Control Tokens (PACTs), and it’s being worked on alongside Mozilla Firefox, Google Chrome and Microsoft Edge.
Per the announcement, Cloudflare says that PACT “are designed to allow sites with strong knowledge of ‘personhood’ to issue anonymous tokens. A user’s browser can then provide these tokens to other sites to prove that a human is in the loop”. This should reduce the number of Captchas that you need to solve, but the company says that “PACT is designed so that sites cannot leverage it to track or identify users or their browsing history”.
On the surface, this sounds like turning a passed Captcha test into a token that your browser then uses to prove your authenticity to other websites. That sounds like a good idea, especially if you’ve been especially inundated with a lot more Captchas recently than usual. But on the flip side, it’s also unclear if these tokens will be treated the same way as cookies, which don’t get imported when you open a private browser window, nor are they saved in such situations.
The mention of authorised bots “with legitimate intent” would have also been a head-scratcher. But we live in an age when nearly every tech company wants in on the AI industry, and nearly every such company is talking about agentic AI. So there’s that distinction, as opposed to bots that are employed to DDoS a site, for instance. That being said, it’s unclear what the criteria is for distinguishing a legitimate bot from an illegitimate one, and that’s probably harder than trying to differentiate human internet traffic from bots these days.
Oddly enough, the announcement also comes with a statement by a Shopify engineer who says “merchants need effective protections against automated abuse, but buyers shouldn’t have to pay for them with unnecessary friction or invasive tracking. Shopify is proud to help develop PACT as an open, privacy-preserving standard that can help the millions of businesses on our platform distinguish legitimate shoppers and authorised agents from abusive traffic while preserving buyer privacy”. So ultimately, one can argue that this Cloudflare announcement is primarily for the benefit of businesses, with the user benefits being secondary.
(Source: Cloudflare)
