USA businesses, PCI DSS compliance applies to companies that accept credit card information.
https://docs-prv.pcisecuritystandards.org/SAQ%20(Assessment)/SAQ/PCI-DSS-v4-0-SAQ-A-r2.pdf

PCI DSS is not a federal law, some states have incorporated aspects of it into their laws, such as Nevada, Washington, and Minnesota. Failure to comply with PCI DSS can result in fines or the inability to process credit card transactions, making compliance essential for businesses.

Minnesota: The Plastic Card Security Act includes requirements for businesses to protect cardholder data and maintain secure payment systems.

Nevada: The Security of Personal Information Law (NRS 603A) requires businesses to take reasonable measures to protect personal information, including payment card data.
1. NRS: CHAPTER 603A - SECURITY AND PRIVACY OF PERSONAL INFORMATION www.leg.state.nv.us
Washington: The Data Breach Notification Law requires businesses to notify consumers of security breaches that could result in the compromise of personal information, including payment card data.
Minnesota: The Plastic Card Security Act includes requirements for businesses to protect cardholder data and maintain secure payment systems. www.leg.state.nv.us/nrs/nrs-603a.html
NRS 603A.215 Security measures for data collector that accepts payment card; use of encryption; liability for damages; applicability.
1. If a data collector doing business in this State accepts a payment card in connection with a sale of goods or services, the data collector shall comply with the current version of the Payment Card Industry (PCI) Data Security Standard, as adopted by the PCI Security Standards Council or its successor organization, with respect to those transactions, not later than the date for compliance set forth in the Payment Card Industry (PCI) Data Security Standard or by the PCI Security Standards Council or its successor organization.

Stripe Checkout - No billing address/zip?