Internet firms will have to store data on what people access online for a year, under new surveillance law plans.