"Privacy Pass tokens are unlinkable, one-time-use authenticators that can be used to anonymously authorize a client"
People from Apple, Google and Cloudflare are all editors of the spec and eg Fastly has also blogged about it: https://www.fastly.com/blog/private-access-tokens-stepping-i...
Excerpt from Fastly's article above:
> When you put this together, no one entity can link client identity to website activity. And yet, this authorizes access to a website – all while eliminating human interactions.