My TLDR of that law firms info which could be a wrongful interpretation, in priority or execution order.
Any Non Specified Entity uploading any data which could be accessed by another Non Specified Entity with or without public access is bound by this bill.
Can be used or accessed from the UK. This might be the UK expanding beyond its borders here, because its a given if it not geo restricted it it could be used in the UK. VPN's/Tor may not be able to offer privacy from the state which is my opinion anyway.
Applies to all services with a "significant" number of UK users. No definition of significant so dont know if this is the same use of the word significant found in medical studies or not.
Definition of search engine is a service which can search more than one website or database.
Largest players now have a legal duty to prevent paid-for fraudulent adverts on their service and other regulated content.
Clarification on identifying the users of the service, ie profile pics and other identifying data.
Exempt specified entities:
--------------------------
Software like antivirus, antispam cloud/online submissions where said data is never likely to be used for communication purposes but might be analysed to improve the performance of said software function, ie reverse engineering stuxnet, latest spam techniques.
Published Content with commenting for the content, ie online newspaper comments.
Posting a link, with or with comments, including like, dislike buttons and emojis of Published Content to another Non Specified Entity.
SMS & MMS messaging.
Services solely used for specific tasks like education, childcare and possibly health care.
One to One Aural (realtime speech and sound only guessing telephone) communication with identifying data allowed with no additional data communication functionality like visuals, text messaging. No mention of recording said Aural data.
Any public body carrying out their public duty.
Any internal business resource or tool, like company message boards, company chat facility's in all forms. No mention of recording data, would assume business includes official organisations like charities, but not clear.
No mention of private paid for programming language groups which can be accessed using a password of sorts and costs
Case by case reviews and changes made by the secretary of state so the exemption list will probably grow.
So my opinion on the above is if you are a big (US) tech service, you can self regulate, but little users will be watched by the UK state as no one can be trusted. Other laws apply where applicable.