NewsPublished 25 Jun 2026

Cloudflare Introduces PACT to Distinguish Human and Bot Activity

Source Reddit Cybersecurity

Discussion

Cloudflare is collaborating with major browser providers to develop PACT, a privacy-first protocol designed to distinguish human users from bots. PACT enables sites with strong confidence in a visitor's personhood to issue anonymous tokens that other sites can trust to verify human activity without additional user interaction. This approach aims to reduce reliance on invasive tracking methods and CAPTCHAs, improving user experience while maintaining privacy. The protocol's governance and token issuance process remain to be clarified. No direct security vulnerability or exploit is described in the available information.

r/cybersecurity (opens in a new tab)u/Sad_Dentist_72880 points0 comments

Cloudflare, Inc. - Cloudflare Collaborates With Leading Browsers to Develop a Privacy-First Protocol For the Global Internet

Cloudflare is collaborating with browser providers to create better ways to identify human vs bot behavior and eliminate invasive tracking and CAPTCHAs.

PACT works by allowing sites with "strong knowledge of 'personhood' to issue anonymous tokens." Other sites can then reference that token and assume the site visitor is a human without requiring further interaction.

This setup seems reminiscent of PKI with public CAs, and I wonder who or what will be controlling the PACT issuing process. I do appreciate the move towards a less invasive and less annoying human-checking experience.

Impact

No direct security impact or vulnerability is reported. The initiative could reduce the use of invasive tracking and CAPTCHA challenges, potentially improving privacy and user experience. There is no indication of exploitation or security risk from the information provided.

Defensive guidance

No mitigation or patch is applicable as this is an announcement of a new protocol rather than a vulnerability or exploit. Organizations should monitor the development and deployment of PACT for any future security advisories or implementation guidance.

Summary

Cloudflare's PACT protocol is a new initiative developed in collaboration with leading browsers to provide a privacy-preserving method for websites to verify human visitors. It works by allowing trusted sites to issue anonymous tokens confirming 'personhood,' which other sites can then use to authenticate users as human without requiring further challenges such as CAPTCHAs. This mechanism resembles a public key infrastructure model but applied to human verification. The announcement does not describe any security vulnerability, exploit, or threat but rather a new technology aimed at improving bot detection and user privacy.

References

Community reviews

Loading reviews…

Discussion

AI analysisMachine-generated, updated 26 Jun 2026, 11:31 UTC

Technical details

References

Community reviews