As a cyber security consultant, I can confirm. Not a single company out of hundreds I’ve performed PCI remediation for managed to completely comply with requirements, with some leaving major issues like storing cc info in a searchable plain text db for better “customer service”. There’s barely any enforcement for this.

Ranma 1/2 natch

13 years here. Search results only but even that is increasingly useless with so many folks deleting ALL their historical activity. Loving the fediverse!