I'd argue that the law doesn't affect Lemmy instances unless they attempt to link a Lemmy identity to someone's real-world identity.

Here's the text of the bill.

Note that it only applies to "digital services" that collect "personal identifying information". But "personal identifying information" is defined very narrowly:

(1) "Digital service" means a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity.
[...]
(6) "Personal identifying information" means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual. The term does not include deidentified information or publicly available information.

So it seems to me that any service that ① uses pseudonymous identities and ② does not attempt to link them to real identities using other information, doesn't count as a "digital service" under this law's definitions.

If a specific Lemmy instance requires real-world identifying information from its users, then that instance would come under this law. But purely pseudonymous services that do not do that, aren't covered.