So this bit here:

Populate a public list of other users with whom such user shares a social connection within such service or application

seems like the easiest way to circumvent this law, with the least effort. Just hide connections for users in VA, and now you’re not a social media site.