how pci dss is a standard and not a law
Payment Card Industry Data Security Standard Compliance with PCI DSS is not required by federal law in the United States. However, the laws of some U.S. states either refer to PCI DSS directly, or make equivalent provisions.