Under PCI DSS 4.0 (requirements 6.4.3 and 11.6.1), merchants have to inventory and justify every script on their payment pages, and scanners like SecurityMetrics Shopping Cart Monitor check those pages weekly.

HighLevel order form pages load the platform's attribution/session script on the checkout step. That script captures UTM parameters and ad click IDs (gclid, msclkid, dclid), reads Meta _fbp/_fbc cookies, creates a browser fingerprint, and sends session data to LeadConnector. It loads even when the account has no pixel or tracking code set up. Scans flag it as "Ad Network on Payment Page," and merchants can't remove it, so they can't close the finding themselves.

Request: Add a setting on order form steps (or at the funnel level) that turns off attribution/session tracking on the checkout page, while keeping everything the payment needs (Stripe, order creation, validation, Turnstile).

Why it matters: Any merchant taking card payments on a HighLevel checkout who goes through a PCI review runs into this. A checkout with no tracking would let them pass the scan without moving checkout to another platform.