The US has issued new guidance on how websites should collect, save and share information about users.