My webshop is currently in the process of becoming PCI compliant.

For business intelligence reasons we would like to include Google analytics code (or a code from a similar package) on the checkout page of our payment funnel.

As this involves including 3rd party JavaScript code on a page which handles customers credit card details I am wondering if this type of integration runs the risk of not passing a PCI audit.

  • If we can't give you an answer here then you might want to try on security.stackexchange.com. I think it could belong on either, which is why I'm not flagging it for migration. Posting on two sites is frowned on though, so I'd wait a few days to see if we can answer it before you try it there. Mar 16 '12 at 14:56
  • Thanks paulmorriss, I didn't know that one existed. I'll try there if nothing turns up here in a few days.
    – xenox
    Mar 16 '12 at 15:04
  • 1
    It will also depend on your PCI auditor
    – Anagio
    Mar 16 '12 at 18:33

To be PCI compliant you have to use a validated payment application. Once a payment app is validated, it has to stay frozen (meaning no coding changes to the application at all).

Is adding javascript to the front end of your website considered a coding change to the application? I would say no, if you host the javascript yourself and you understand what it's doing. You could be PCI compliant with a tracking script in place. However, if the script is hosted by a third party, then the javascript could change without your consent which still doesn't necessarily invalidate your PCI compliance.

My speculation: You can add javascript to the front end without affecting the payment application, if they are two separate entities. Your payment application will not be invalidated, but you have to make sure you can still answer all questions in the PCI questionnaire truthfully. If you can still answer all question truthfully, then you are still PCI compliant.

  • I would very much like to see Google publicly acquire and assert PCI Compliance certification for their Google Analytics system, including the processes and systems that inject javascript, receive and respond to calls made by that JavaScript, collect and store information acquired through that means, and reporting that information. Then we wouldn't have this issue. Short of that, I don't see how we can truthfully assert PCI compliance if we have GA on our checkout page.
    – Shavais
    May 2 '17 at 19:57
  • They might say their Google Analytics system doesn't collect credit card data, so PCI compliance is not necessary - but then the question becomes would PCI compliance regulators trust Google's word on that, because they certainly could be collecting credit card information, and we wouldn't have any way of knowing or controlling that.
    – Shavais
    May 2 '17 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.