PCI DSS applies, but for single-use cards, there may be an exception.
PCI SSC says:
Articles 1285 and 1286:
“PCI DSS applies to all primary account numbers (PANs) that represent a PCI founding payment card brand (American Express, Discover, JCB, MasterCard, or Visa). This includes PANs that are only provided electronically (virtual PANs) as well as PANs that correspond to a physical payment card. Whether a one-time PAN is in scope for PCI DSS will depend on the particular restrictions around their usage as defined by the payment brands. Entities should contact the applicable payment brand to determine how PCI DSS applies.”
That means "Pobably yes". There are some interpretations.
For example, VISA says:
The following points define Visa’s updated position on the applicability of PCI DSS to virtual Visa accounts (https://usa.visa.com/dam/VCOM/global/support-legal/documents/expanded-pci-dss.pdf)
- Tokens generated in accordance with the EMVCo Payment Tokenisation Specification are not considered to be Visa account data and are not in scope for PCI DSS protection requirements.
- Visa considers single-use virtual Visa account numbers and multi-use virtual Visa account numbers with
Dynamic Card Verification Value 2 (dCVV2) out of scope for PCI DSS protection requirements based on the
low risk of fraud associated with the account type.
- All other Visa primary account numbers (PANs) must be protected in accordance with PCI DSS.
- In environments where a Visa PAN (i.e., stored credential) is maintained and not segmented from other virtual Visa account types, PCI DSS requirements are applicable across the full environment.
Mastercard does not consider Single Use Virtual Card Numbers (SU-VCNs) to be in scope of PCI DSS requirements. The SU-VCN becomes inactive/disabled after only one authorisation; therefore, the virtual PAN data cannot be reused for fraudulent activities within the payment ecosystem. However, it is important to note that even though a SU-VCN may be considered “out of scope” for PCI DSS, it does not mean that the systems and/or entities that are storing, transmitting or processing the SU-VCN are also out of scope. PCI DSS will apply anywhere a multi-use PAN is stored, transmitted or processed. If the systems storing, transmitting or processing the SU-VCN also store, transmit or process multi-use PANs, those systems will remain in scope of PCI DSS requirements.
(statement attributed to Mastercard on various websites, but not found on Mastercards own website)