The password requirements of PCI DSS, among everything else, state that you must enforce a very specific password policy:
You need to force the users to change their passwords every 90 days, their passwords cannot be shorter than 7 characters, etc.
As far as I know, large companies such as Google, Facebook, PayPal and many more don't enforce that policy. For example, none of them freeze your account after a period of non-activity as PCI DSS requires and services such as Facebook allows your password to be 6 chars long (which is less than the 7 chars min stated in the PCI DSS requirements).
Those companies are PCI DSS Level 1 Service Providers and are listed in the PCI DSS Service Providers index.
How can those companies be PCI DSS compliant even though they don't enforce the PCI DSS password policy?
On whom does the policy apply? Does it apply on the simple user / customer or is it talking about the staff / moderators?