I don't think it's a question of collecting user metadata or not. Here it really depends on "are the credit card details touching any non-PCI-compliant code?"

I don't think it's a question of collecting user metadata or not. Here it really depends on "are the credit card details touching any non-PCI-compliant code?" Section 6.3.2 requires you to verify any "custom" code released to a customer that handles credit card information.[1] The way I see it, since your code touches that information, you must be PCI DSS compliant or you're breaking the chain of trust. 1: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.pdf?agreement=true&time=1477005719371#page=55 https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.... (This is my opinion, which should be taken with a grain of salt.)