If you sell a complete firearm online in the United States, you have never actually run the age check yourself. The gun ships to a licensed dealer near the buyer, and that dealer runs Form 4473, checks the ID, runs the background check, and hands the firearm over in person. The FFL is the backstop. It is why online firearm retailers have spent years treating age verification as somebody else’s job.
That model covers a shrinking slice of what these merchants actually sell. Ammunition, magazines, optics, triggers, barrels, and the long tail of parts and accessories do not route through an FFL. They ship straight to the buyer’s door. There is no dealer standing between the checkout button and the doormat, which means there is no one to run the age check except the seller. For most of the last decade that gap sat unregulated, and most sellers filled it with a checkbox. In 2026 that stopped being viable, and California is the reason.
What the FFL model covers, and what it quietly does not
Under the Gun Control Act, the federal minimum age at the point of an FFL transfer is 18 for long guns and long-gun ammunition, and 21 for handguns and handgun ammunition (ATF). When a firearm is sold online, the transfer legally happens at the receiving dealer, not at your storefront. The dealer verifies age against a government photo ID on the 4473 and runs the NICS check. Your site collected a card number. The dealer did the compliance.
The problem is scope. That in-person 4473 covers the firearm. It does not cover the box of ammunition a customer adds to the same cart, the replacement barrel, or the accessory that ships direct. Federal law sets an age floor for ammunition too, but for a direct-to-consumer ammunition seller there is no receiving FFL to enforce it. The obligation lands on the merchant at checkout, and a lot of merchants have been meeting it with an “I am 18 or older” tickbox that verifies nothing.
Self-attestation has been the soft underbelly of this vertical for years. It survived because enforcement was thin and the FFL model created the impression that age was handled upstream. Both of those cushions are gone.
California moved the obligation to the seller
Two California measures did the moving, and together they turn “the dealer handles it” into a statement that is only half true.
AB 1263 took effect January 1, 2026. It requires that every sale or transfer of a firearm, a firearm accessory, or a gun barrel include identity and age verification using a government-issued photo ID, plus a written acknowledgment of prohibited uses, an address match between the buyer and the shipping destination, and adult-signature confirmation on delivery (Orchid Advisors, CRPA). The part that matters for your architecture: it reaches out-of-state businesses selling into California or interacting with California residents. A parts seller in Texas shipping a barrel to a customer in Fresno is now inside the statute. AB 1263 was signed October 11, 2025, so this is not a proposal on a roadmap. It is live law with a compliance date already behind us.
The second measure is ammunition. As of August 6, 2026, California’s ammunition eligibility check is in full force, and the state’s model for online ammunition is not “verify at checkout.” It is “you cannot ship direct at all.” Online ammunition orders must be routed to a licensed dealer for an in-person, face-to-face handoff with an eligibility check, the same structural pattern the firearm itself follows (LegalClarity). California also draws the age line at 21 for handgun ammunition and 18 for rifle and shotgun ammunition, and it explicitly rejects self-attestation: the seller must verify age and identity against a government-issued ID, not a checkbox.
California is not the whole country. It is the leading edge of a patchwork that is forming the same way the broader age-verification map formed, one state at a time, with inconsistent thresholds and inconsistent mechanics. We have written about that dynamic in the general case in our piece on the US compliance patchwork, and the firearms-adjacent vertical is now firmly inside it. If you sell parts or ammunition nationally, you are already building for the strictest state, because the strictest state defines your shipping logic.
Why the checkbox and the credit card both fail here
Two controls that look like age verification in a compliance deck fail the moment a regulator or a plaintiff’s lawyer inspects them.
The checkbox fails because it verifies intent, not age. California says so directly, and it is the correct read everywhere: a self-attested age gate is not a check, it is a disclaimer. When the standard is “verified proof of age and identity against a government ID,” a boolean the user clicked themselves does not clear it.
The credit card fails for a subtler reason that this vertical is especially prone to lean on. A successful card charge proves a payment instrument was issued to someone. It does not prove the cardholder’s age, and it does not prove the person at the keyboard is the cardholder. Teenagers hold authorized-user and prepaid cards routinely. We laid out that failure mode in full in why a credit card is not proof of age, and it applies with extra force where the legal threshold is 21, because the card network never encoded age in the first place.
The third trap is the one sellers fall into when they finally do ask for an ID. A naive photo-of-license upload flow invites the synthetic-ID problem: AI-generated documents now cost a few dollars and pass a large share of upload-and-selfie stacks on the first try. AB 1263 asks for an address match and adult-signature delivery precisely because the legislature does not trust a bare document image either. If your step-up is a JPEG a generator can fabricate, you have spent friction and bought fraud.
What a real check looks like for this vertical
The firearms-adjacent stack has an unusual shape because it carries two different questions at once, and most sellers collapse them into one expensive flow. Separate them.
The first question is the age line, and it is binary: is this buyer over 18, or over 21, depending on the item. For a large share of your customers that can be answered with a lightweight Check rather than a full document scan, which keeps friction and abandonment down for the majority who are comfortably clear of the threshold. Reserve the heavier flow for the cases the light one cannot resolve.
The second question is identity, and it is where AB 1263 actually bites: the seller has to know who the buyer is, tie that identity to a real government document, and match it to the shipping address. That is a document Verification, an OCR-and-face-match against a genuine ID, not an attestation. The address-match and adult-signature requirements sit on top of the identity result, so the verification has to return structured data the shipping system can compare against the destination, not just a pass or fail.
Two moves make this survivable rather than punishing. The first is document integrity that resists synthetics: an NFC chip read that is cryptographically signed by the issuer, or a mobile driver’s licence with selective disclosure, beats a photo of a card that a model can fabricate. The second is not making repeat buyers re-verify from scratch. A firearms and ammunition customer is often a returning customer, and asking them to redo a full identity check on every order is how you lose them. A reusable, cryptographically bound credential lets a verified buyer prove age and identity again with a lookup instead of a fresh document scan. The cheapest verification is the one you never have to repeat.
The data you keep is a liability, not an asset
This vertical has a specific temptation: because the FFL world runs on the 4473 and its retained records, sellers assume more retention is always safer. For the direct-to-consumer side, the opposite is true. You are not an FFL keeping a bound book. You are an e-commerce merchant who just collected a government ID, a face image, and a home address, which is exactly the bundle that turns an age check into a breach headline.
Minimize to the assertion. You need to be able to prove that a buyer cleared the age-and-identity check, when, and against what class of document, an auditable event a regulator can inspect. You almost never need to keep the raw ID image or the selfie after the decision resolves. If your architecture cannot answer “what would an attacker get if they breached this tomorrow” with “a log of pass or fail decisions plus the minimum fields the shipping rule required,” you are hoarding risk that the law does not ask you to carry.
The payments layer is moving too, in the other direction
One piece of adjacent context, because it changes the tools available at checkout. There is a parallel fight over the firearms merchant category code, MCC 5723, which distinguishes firearms retailers from general sporting-goods merchants. In July 2026 the House passed H.R. 1181, 221 to 201, to prohibit payment networks from requiring or assigning firearm-specific MCCs, while several states have moved the opposite way (Payments Dive, AmmoLand). That fight is about purchase tracking and privacy, not age, and it is a reminder not to lean on the payment rail to do compliance work it was never built for. The card network is contested political ground. Your age-and-identity control should not depend on it.
What to build now, in order
Lead with the age line as a lightweight check, and clear the majority of buyers who are well clear of 18 or 21 without a document scan. Escalate only the unresolved cases to a full document Verification with face match, and return structured identity data the shipping system can use for the AB 1263 address match and adult-signature requirements. Resist synthetics at the document layer with NFC or an mDL rather than a bare image upload. Give returning buyers a reusable credential so their second order is a lookup, not a re-verification. Retain the decision and its audit trail, not the underlying ID image. And build to the strictest state you ship to, because that state, right now California, is already defining your shipping logic whether or not your other markets have caught up.
The FFL still handles the firearm. Everything else in the cart is now yours to verify, and in 2026 the law finally says so out loud.
