Essentially, it uses a combination of fakeroot and pacman flags to download the remote database to a temporary location and compare against the local package list. (I think the main “downside” is that it clears its package database every reboot, which is not ideal… reading, it looks like you can override CHECKUPDATES_DB so it doesn’t put it into /tmp, then there’s a little more persistence.)
Useful tip: checkupdates -d will download updated package files ready for installation without creating a partial upgrade situation, then you can pacman -Syu when you’re ready.
e.g.:
alias cu="CHECKUPDATES_DB=/var/tmp/checkupdates checkupdates -d"