Little changed from the first announcement. The wording of the 2nd paragraph, that refers to all IOS devices, not just family account managed ones, says it's an in-phone scan, followed by an upload of suspicious images to iCloud. It does not say that opting the device out of iCloud will defeat this feature.
The flow diagram that Apple initially published did indicate it's regardless of whether iCloud is enabled.