Cloudflare PACT Protocol: What Small Businesses Need to Know

The way traffic moves across the internet is undergoing a significant shift. As AI agents, automated crawlers, and human users browse side by side, traditional security methods like friction-heavy CAPTCHAs and forced logins are becoming obsolete. To address this, Cloudflare, in partnership with Google Chrome, Mozilla Firefox, Microsoft Edge, and Shopify, announced a new standard called PACT (Private Access Control Tokens).

What Happened

On June 22, 2026, Cloudflare unveiled PACT alongside the industry's top browser developers and commerce giants. The goal of the protocol is simple yet ambitious: prove that a human (or an authorized agent acting on a human's behalf) is behind a web request without compromising user privacy or relying on intrusive CAPTCHAs.

Historically, website security operated on a binary block-or-allow system. However, with the rise of autonomous AI agents executing tasks online, this binary approach fails. PACT introduces a cryptographic, privacy-first token system where a trusted entity vouches for personhood, allowing users to seamlessly navigate participating sites.

Key Details of Cloudflare's PACT

To understand why PACT matters, it helps to break down its core technical and structural mechanics:

• Anonymous Personhood Verification: A website with strong knowledge of a user's authenticity issues a cryptographically signed token. The user's browser carries this token to other websites to prove human presence without sharing identity.
• Built-in Privacy: PACT tokens are non-linkable. The issuer cannot see where the token is spent, the receiving site cannot trace where it came from, and separate sessions cannot be tied together.
• Unprecedented Ecosystem Alignment: Securing backing from Chrome, Firefox, Edge, and Shopify simultaneously indicates that PACT is poised to become an internet-wide access standard.
• Focus on Human-in-the-Loop Traffic: PACT explicitly verifies human-driven or human-authorized requests. Autonomous, unassisted AI agents operating without direct human triggers fall into a separate traffic track that sites must manage independently.

What It Means For Your Business

For local service providers, e-commerce stores, and brick-and-mortar brands, the introduction of PACT alters how your website handles incoming visitors and web crawlers.

1. The Separation of Web Traffic Tracks

Moving forward, your website's traffic will broadly fall into three distinct tracks:

1. Verified Humans (via PACT): Customers actively browsing, purchasing, or requesting quotes.

2. Authorized AI Agents & Bots: Crawlers from Search Engines and AI tools like OpenAI, Google Gemini, and Perplexity index your site to supply answers to potential clients.

3. Unauthorized Scrapers & Malicious Bots: Unwanted automated scripts attempting to steal data or drain server resources.

2. Protecting AI Search Discoverability

Many small business owners reactively set strict bot-blocking rules on Cloudflare or security plugins to reduce spam. However, over-blocking can inadvertently cut off AI search bots. If Perplexity, ChatGPT, or Google AI Overviews cannot crawl your pages, your business will disappear from AI-generated recommendations.

3. Preparing for Agentic Commerce

With Shopify heavily involved in PACT, autonomous commerce—where an AI agent books an appointment or buys a product for a customer—is approaching quickly. Ensuring your site correctly allows authorized agentic traffic will determine whether future customers' AI assistants can complete transactions with your business.

How to Prepare Your Website Today

While PACT is still in development, local businesses should take proactive steps to optimize their technical web setup:

• Audit Your Bot Management Rules: Check your Cloudflare or firewall settings. Ensure you are not blocking legitimate AI crawlers like OAI-SearchBot, PerplexityBot, or Google-Extended.
• Improve Technical Accessibility: Keep your structured schema data (LocalBusiness, Product, Service) updated so that both humans and authorized AI agents can easily extract core details about your business.
• Monitor Traffic Analytics: Pay attention to shifts in referral traffic. Look for increases in direct agent queries and AI referral channels alongside traditional organic traffic.