also, does this law just affects sites hosted physically in the uk? if a site is on a server in the us, does that avoid it?

This hasn't been clarified yet. Some people think it may effect all EU traffic.

Seems like we might having a tracking paradox.

Right? especially where you can no longer really trust ip based geolocation now that we've run out of ipv4 address, and they're allowing single address trading. What you could once reasonable guess was a us address based on the ip block, may now actually be owned by a uk organization.

As far as I understand, from an off-hand chat with a lawyer last year, UK law applies to businesses that have a record or filing in Companies House. http://www.companieshouse.gov.uk/