The 509 section on Applicability seems to restrict this to services specifically targeting or deliberately creating environments suitable for, or providing attractions that can only be reasonably targeted to minors.

So if you don’t create kidzone.world or a blues clues community you’re probably alright, if you can show you don’t target or encourage minor participation.

I’d argue that the law doesn’t affect Lemmy instances unless they attempt to link a Lemmy identity to someone’s real-world identity.

Here’s the text of the bill.

Note that it only applies to “digital services” that collect “personal identifying information”. But “personal identifying information” is defined very narrowly:

(1) “Digital service” means a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity.
[…]
(6) “Personal identifying information” means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual. The term does not include deidentified information or publicly available information.

So it seems to me that any service that ① uses pseudonymous identities and ② does not attempt to link them to real identities using other information, doesn’t count as a “digital service” under this law’s definitions.

If a specific Lemmy instance requires real-world identifying information from its users, then that instance would come under this law. But purely pseudonymous services that do not do that, aren’t covered.

It should be easier to implement this on Lemmy, I think. There should be one instance with whitelisted instance federation, and during signup, if somebody says they’re less than 18 (or whatever the age limit is), they should be redirected to that instance. They won’t see anything from anything other than the whitelisted instances.