[antonyh]

Possibly until they grow to a point where they have divisions in UK or EU, which I think is how Facebook/Google/Microsoft are set up but I could be wrong.

There's some choices in the market, and beyond the behemoths it is still possible to avoid the US. The challenge is finding one that isn't owned by a US company and will end up with the same restrictions (like Gigya is now owned by SAP) - but any company serious about security will do the due diligence and know who own who.