Behind PACT: How Mozilla, Google, and Cloudflare Plan to Kill CAPTCHAs Without Breaking the Open Web

The Architectural Reality

The modern web faces an unprecedented crisis of identity. As generative AI and autonomous agents proliferate, traditional methods of distinguishing humans from bots—such as IP tracking and CAPTCHAs—have collapsed. Threat actors now solve visual challenges faster than genuine users. In response, websites have resorted to aggressive tracking or forced registration walls. Enter Private Access Control Tokens (PACT), a privacy-preserving protocol introduced on June 23, 2026, by Dennis Jackson on the Mozilla Hacks blog.

PACT fundamentally re-engineers how trust is established online. Instead of relying on invasive hardware attestation or cross-site tracking, it leverages cryptographically blinded tokens. The architectural premise is elegant: an “Anchor” entity—where a user already has an established, trusted relationship, such as an active login session or a paid subscription—issues an anonymous token. This token can be presented to other websites as cryptographic proof of legitimate intent without disclosing any identifying information. The protocol ensures that tokens cannot be used to track users or reconstruct their browsing history, resolving the tension between anti-abuse measures and user privacy.

This initiative builds upon the robust foundation of Privacy Pass, an IETF-standardized protocol originally designed for creating and redeeming anonymous, transferable tokens. While Privacy Pass primarily focused on bypassing CAPTCHAs for Tor users, PACT extends the concept specifically to handle the surge in agentic AI and volumetric abuse. Discussions regarding PACT and related designs, like Anonymous Rate-Limited Credentials (ARC), are actively tracked in open GitHub repositories, ensuring transparent development.

Market Impact & Deployment

The deployment of PACT carries massive implications for the enterprise security landscape and the future of the open web. Crucially, PACT is not a solitary endeavor; it is being developed through an unprecedented collaboration between Mozilla, Cloudflare, Google, Microsoft, and Shopify. This coalition intends to submit the protocol for formal standardization across the open web, preventing the fracturing of internet access into hardware-locked walled gardens.

From an operational standpoint, PACT introduces the concept of a stateful “Credential” managed by a “Moderator.” With PACT, sites can verify if a credential is in good standing and adjust access levels dynamically based on user behavior. Using PACT, a website’s access privileges can be reduced if malicious activity is observed, providing a powerful, privacy-first tool against DDoS attacks and credential stuffing without the friction of blocking legitimate traffic.

The market impact extends to web standards and competitor reactions. While some ecosystem players have pushed for hardware-based device attestation—which effectively transfers control of the web to device manufacturers—PACT champions an open, software-agnostic approach. Any entity with a scarce resource (like a VPN provider with paid subscriptions) can act as an Anchor, democratizing the issuance of trust and preserving the decentralized nature of the internet.

The Consumer Translation

For the everyday consumer, PACT represents a profound shift toward a frictionless internet. The protocol aims to provide a seamless alternative to traditional identity verification methods. Instead of encountering endless CAPTCHA grids, VPN blockades, or mandatory sign-ups on their first visit to a news site or retailer, users will experience uninterrupted access. The browser, acting on behalf of the user, will silently negotiate trust using privacy-preserving tokens.

PACT serves as a technical companion to a broader Mozilla update on keeping the web open and private in the bot era. It ensures that users are not penalized for protecting their privacy. Consumers can maintain strict anti-fingerprinting defenses and use VPNs without being treated as second-class citizens by automated anti-abuse systems. Because a trusted relationship is only needed to issue the initial PACT token, users are insulated from the cross-site tracking that plagues the modern web ecosystem.

Frequently Asked Questions

Q1: What are Private Access Control Tokens (PACT)?
A1: PACT is a privacy-preserving protocol that allows users to verify their legitimacy to websites without disclosing identifying information. It acts as an anonymous credential to replace intrusive CAPTCHAs and tracking mechanisms.

Q2: How does PACT protect user privacy?
A2: PACT issues cryptographically blinded tokens. This ensures that the tokens cannot be used by websites to track users across the internet or reconstruct their browsing history.

Q3: Which companies are developing the PACT protocol?
A3: PACT is a collaborative effort led by major technology companies, including Mozilla, Cloudflare, Google, Microsoft, and Shopify. They intend to submit it to the IETF for formal standardization.

Q4: What happens if a user behaves maliciously using PACT?
A4: Websites can verify a PACT credential’s standing. If malicious activity is observed, the site can dynamically reduce the user’s access privileges without needing to identify them.

Q5: Does PACT require logging into every site?
A5: No. A trusted relationship (like an active login session with an Anchor) is only needed to issue the initial token, which can then be anonymously presented to other websites.

TechNode HQ Verdict: Pros, Cons & Usability

• Pro (Engineering): Enables rate limiting and abuse prevention based on scarcity without relying on hardware attestation or centralized gatekeepers.
• Pro (Consumer): Drastically reduces browsing friction by eliminating CAPTCHAs and preventing indiscriminate blocking of VPN users.
• Con: Requires broad adoption by both token issuers (Anchors) and websites to reach critical mass and effectively bypass existing friction.
• Con: Establishing the aggregate trustworthiness of anonymous issuers without leaking privacy remains a mathematically complex deployment challenge.

Enterprise Usability: CTOs should closely monitor the IETF standardization of PACT. Integrating PACT compatibility into edge security layers and WAFs will be crucial for maintaining low-friction access for legitimate human traffic and benign AI agents, while effectively mitigating volumetric abuse.

Everyday Usability: For the public, this is a highly anticipated backend evolution. While not something to “buy,” users should prioritize browsers and services that support PACT to ensure a smooth, privacy-first web experience free from aggressive anti-bot countermeasures.