Facebook, Google and others face yearly checks and limits on what they can do with users' data.