4 ms·
I'd be curious if you can point to a specific section of PCI that states that a 3rd party cannot collect user meta-data. If that is true Google Analytics and In
by nodesocket 10y ago
I'd be curious if you can point to a specific section of PCI that states that a 3rd party cannot collect user meta-data. If that is true Google Analytics and Intercom could not track on checkout pages.
- Artemis2 10y agoThere is no such thing, but the standard dictates that all payment pages have to be served from a PCI DSS compliant environment. Stripe is in a very grey area, because they don't even have their merchants use iframes. Tampering with the script that (according to Stripe) makes the merchant compliant, and not being certified doing so, is a big no-no.
- striking 10y agoI don't think it's a question of collecting user metadata or not. Here it really depends on "are the credit card details touching any non-PCI-compliant code?" Section 6.3.2 requires you to verify any "custom" code released to a customer that handles credit card information.[1] The way I see it, since your code touches that information, you must be PCI DSS compliant or you're breaking the chain of trust. 1: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.pdf?agreement=true&time=1477005719371#page=55 https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.... (This is my opinion, which should be taken with a grain of salt.)
- HillRat 10y agoA lot -- maybe most -- QSAs would absolutely flag an analytics script on a checkout page as a security issue, though they probably wouldn't consider it a pass/fail issue. PCI-DSS is a viral system, infecting every system that comes into contact with a covered environment. I've seen email servers and phone dialers get scoped in because they were used by employees handling payment card data.