Speaking as someone who deals with this on a daily basis, I say not true. PCI is common sense written down into an "industry standard". You don't have to do it, it's not a law. But if you want to continue to accept CCs, then you should comply. Compliance is as easy as redirecting all of your CC work to a processor that is PCI compliant. So long as <i>you</i> <i>yourself</i> do not store, transmit or process the card data, you can worry about your business and forget about PCI and it won't cost any more money.