Half of web traffic no longer comes from people. That is not a prediction from an industry report. It is the reality we work with daily in our clients' campaigns. Crawlers, scrapers, AI assistants, agents comparing prices or citing content. The Imperva Bad Bot Report from 2025 showed that automated traffic surpassed human traffic globally. In the campaigns we manage, we see this daily in the data: sessions with no scroll, instant bounces, clicks that nobody made.
The question is no longer whether you have non-human traffic. The question is whether you can tell the difference between a bot distorting your data and a real visitor who actually wants to buy. Until now, the answers have been annoying CAPTCHAs, third-party cookies that browsers are systematically killing, and IP lists that cannot keep up with reality. None of these solutions address the root problem.
This is where PACT comes in. A protocol developed by Cloudflare together with Mozilla, Chrome, Edge, and Shopify that tackles one of the oldest problems on the web: verifying that a visitor is human without asking for personal data. The protocol is not active yet. There is no trial, no public implementation. But the direction it sets changes the rules for any business with an online presence.
What PACT is and why it matters for your traffic
PACT (Private Access Control Tokens) generates anonymous tokens. A site that supports the protocol can verify that a visitor is a real person without learning who they are, where they came from, or what else they visited. The tokens are, as Cloudflare describes them, anonymous and unlinkable by design. The receiving site cannot correlate two visits from the same user.
A recent article on Search Engine Journal examines the timeline and limitations in detail. Their conclusion aligns with ours: full implementation is years away, but the direction is clear. What makes PACT different from previous solutions is that it works at the browser level, not the site level. The browser confirms that a human is behind the screen, and the site receives only the confirmation, with no identifying data.
This means CAPTCHAs disappear. Verification forms disappear. The friction that pulls visitors out of your funnel disappears. Instead of losing 3-5% of conversions on pages where you placed a CAPTCHA (according to Google reCAPTCHA Enterprise data), you get an invisible token doing all the work in the background.
Two traffic lanes, two strategic decisions
The most important part is not the protocol itself but what it reveals: the web is heading toward two completely different types of access management.
The first lane is for humans. PACT verifies human presence, not identity. It works like a badge you show at the entrance, but without a name on it. It solves fraud, fake traffic, and bot-generated clicks that distort your Google Analytics 4 data. For an online store, this means that the conversion rate you report reflects only real visitors, not a mix of people and crawlers. The budget you allocate based on that data becomes more precise.
The second lane is for autonomous agents. AI that enters your site to compare prices, cite content, or execute a task on behalf of a user. This requires completely different infrastructure. Google is already working on agent identity verification. Estonia is testing a state-backed identity system for digital agents, the first of its kind in Europe. OpenAI and Anthropic have started signing their agent requests with identification headers.
These two lanes are not mutually exclusive. But they demand different decisions. Struggling with fake traffic and fraud? Prepare for PACT. Want to control which AI agents access your content and your visibility in AI responses? That requires authorization, not personhood verification. The two problems look similar on the surface, but the technical and strategic answers are completely different.
What you can do now, even though the protocol is not live
At difrnt., we advise clients not to wait for live infrastructure before they start preparing. Three concrete steps you can take this week:
Audit your non-human traffic. In GA4, the Engaged sessions segment is a decent proxy for real traffic, but it is not enough. Traffic reports from Cloudflare or Sucuri show what percentage of requests come from identified bots. We have had clients with 35-40% bot traffic who had no idea. That means distorted conversion data and budget decisions based on false numbers. If you spend 10,000 EUR per month on Google Ads and 35% of your traffic is bot-generated, you are not losing money on fake clicks (Google filters most of those), but you are losing visibility in the reports that guide your strategy.
Decide what to do with AI agents. Do you want to block them? Charge them? Give them open access? This decision affects how you structure your robots.txt, HTTP headers, and soon, how you will configure protocols like PACT. If search traffic is already redistributing toward AI, your stance on AI agents becomes a business decision, not a technical one. Every AI agent that cites your content in a response is a form of distribution you do not control, but one you can benefit from if you structure your content correctly.
Monitor adoption. PACT has the backing of four major browsers and Shopify. When it enters trial, the first sites to adopt it will have a concrete advantage: cleaner traffic, more accurate data, easier conversion attribution. E-commerce sites in particular will benefit from removing bot traffic from their conversion funnel. For a store with 50,000 monthly sessions and 35% bot traffic, PACT adoption means reports based on 50,000 real sessions, not 77,000 apparent ones.
Why this is a strategy problem, not an IT task
The temptation is to treat PACT as a technical matter. To send the link to the development team and wait for it to get resolved. But the decisions that come with it are strategic. How much non-human traffic do you accept? What data do you share with AI agents? How do you report performance when a third of your visits are not people? How do you recalculate your cost per acquisition if you subtract bot traffic?
The answers do not come from your IT team. They come from the marketing team that understands how visibility works in the AI era. PACT is not live yet. But the conversation about what you do with non-human traffic needs to be. And the companies having this conversation now will be the first to benefit when the protocol becomes reality.
