A lot -- maybe most -- QSAs would absolutely flag an analytics script on a checkout page as a security issue, though they probably wouldn't consider it a pass/f

A lot -- maybe most -- QSAs would absolutely flag an analytics script on a checkout page as a security issue, though they probably wouldn't consider it a pass/fail issue. PCI-DSS is a viral system, infecting every system that comes into contact with a covered environment. I've seen email servers and phone dialers get scoped in because they were used by employees handling payment card data.