The problem of AI bots has become one of the biggest headaches for website owners in 2026: how do you tell a legitimate AI agent acting on behalf of a real user apart from an abusive bot that scrapes content, manipulates prices, or probes for vulnerabilities?
Cloudflare has proposed an answer. It's called PACT (Privacy-preserving Agentic Control Token), an open protocol already joined by Google Chrome, Microsoft Edge, Mozilla Firefox, and Shopify.
The Problem PACT Solves
With the explosion of AI agents — assistants that do research, make purchases, book appointments, or browse on behalf of users — websites face a dilemma:
- Blocking all bots also means blocking legitimate AI agents acting for users, losing real sales and interactions
- Allowing everything means opening the door to abusive bots that consume resources, scrape content without permission, or manipulate systems
Current solutions (CAPTCHA, rate limiting, user-agent filtering) weren't designed for this scenario. A legitimate AI agent shopping on behalf of a user looks like a bot from any current technical angle.
How PACT Works
The protocol introduces the concept of human presence attestation.
When an AI agent interacts with a site on behalf of a user, the browser (Chrome, Edge, Firefox) can generate a cryptographically verifiable token attesting: "This agent is acting on behalf of a real human who authorized this interaction."
The website can choose to:
- Accept interactions with a valid PACT token (treating them as legitimate traffic)
- Reject or limit interactions without a token (abusive bots, automated scrapers)
The "privacy-preserving" part of the name is crucial: the token attests to human presence without revealing the user's identity — separating "there's a human here" from identifying the specific individual.
Why Shopify Is Involved
Shopify joined the initiative for a very concrete reason. As the company stated:
"In commerce, every extra challenge, delay, or false positive can turn a purchase into an abandoned cart. Merchants need effective protection against automated abuse without unnecessary friction or invasive tracking."
For an e-commerce business, bots are a problem on two fronts: bad bots attack the system, but overly aggressive defenses also block legitimate customers. PACT promises to solve this trade-off by letting merchants tell the two cases apart.
Implications for Website Owners
For content sites: the protocol could change how you manage AI traffic. Instead of blocking all bots, you could choose to allow verified AI agents (bringing real users) and block automated traffic without attestation.
For e-commerce: less friction for users who use AI agents to shop, fewer abusive bots manipulating inventory or prices.
For everyone: it's the first serious attempt to create an open standard for AI-web interaction — similar to robots.txt for SEO crawlers, but for AI agents with verified human presence.
Timeline
PACT is still in a collaborative development phase. Cloudflare launched the initiative with the support of major browsers, but widespread adoption will take time — both from sites implementing it and from AI agents supporting the protocol.
It's one of the most interesting infrastructure developments of 2026 for website owners: the web is preparing for an ecosystem where not only humans browse, but also agents acting on their behalf. PACT is the first serious attempt to bring order to this transition.