Coin relies on the loophole that they're not a merchant or a middle-man handling payment data; they're just an electronic form of a physical wallet and the data is always with the customer (on the Coin itself). This is apparent in their FAQ:
Q. Does Coin have a PCI PA-DSS validation?
A. The PCI Security Standards Council PA-DSS program addresses payment
applications used to accept and process payment for goods and
services. A device such as a Coin is seen as similar to a payment card
in a consumer’s wallet and the standard does not apply.
Coin loses one aspect of handling a payment card - physical identification characteristics; the name isn't physically present on the card, so is the expiration date and the customer's signature. This will be met with disagreement from merchants as this will make fraud much more difficult to detect by the human cashier employee. (Note: This is one aspect of fraud detection. I'm aware that this can be easily circumvented. The fact is, merchants still train their employees on these practices).
Clearly, this device is targeting the US market where magnetic stripe cards are still the standard.Personally, I see this device massively failing (and I certainly hope so) because most US card issuers have announced that in 2017 they will be implementing a liability shift in cases of fraudulent transactions. This means that any merchant or ATM operator that doesn't use EMV (~Chip&Pin) will be liable for this transaction. Which means EMV-compliant cards will be used more and more.
Since EMV-compliant cards can't be cloned*, this Coin device will eventually die, just like its inventors hipster style.
* Well, they can be, with the help of electron microscopes and fancy laser technology, but let's not get into details on this one.