Police and security services will be able to see names of sites visited in the past year without a warrant, under the draft Investigatory Powers Bill.
The science and technology Committee says its requirements are confusing, and firms fear a rise in hacking.
The Home Office said it would study the report's findings [parliament.uk].
When she announced the draft bill last year, Theresa May stressed that the authorities would not be able to see individual web pages visited, just basic data, such as domain names like bbc.co.uk or facebook.com.
The information won't be used for political blackmail at all.