Many years ago, I was a software architect at an online travel company. Marketing kept asking me to approve third-party hosted tracking scripts walking the DOM

Many years ago, I was a software architect at an online travel company. Marketing kept asking me to approve third-party hosted tracking scripts walking the DOM looking for tracking tags at every step on our purchase path. I objected on the billing page, simply because I couldn't guarantee the safety of credit card numbers and customer data, but said it would be okay if we reviewed and hosted their js statically, but the third parties always refused. Perhaps I overreacted, because at the time, the e-commerce industry didn't seem to care about the risk. Do they now? I hope OWASP/PCI/GDPR have since developed opinions about third party hosted js on sensitive pages.