Does the ATF Know What Guns You Own? 1.3 Billion Records

For ordinary firearms, no. There is no federal database that ATF can search by your name to produce a list of the rifles, shotguns, and handguns you own. Four separate federal laws forbid building one, and the Government Accountability Office has audited ATF for compliance with them. If you bought a Glock at a gun store in 2019 and the store is still open, the record of that sale is sitting in a filing cabinet at that store, not in Washington.

For NFA items, yes, completely. A suppressor, short-barreled rifle, short-barreled shotgun, or machine gun is entered into the National Firearms Registration and Transfer Record under the name of the person or trust that registered it. That is an actual centralized federal registry, it is lawful, and it has existed since 1934.

The interesting part is the space between those two answers, and that is where most of the argument lives. ATF holds an enormous volume of firearms transaction records and keeps them indefinitely. Whether that collection amounts to a registry in practice, whatever it is called on paper, is contested by members of Congress, was examined by GAO, and is the stated reason ATF is now proposing to destroy a large share of it.

ATF's National Tracing Center held approximately 1.3 billion images of records as of June 11, 2025, and was receiving roughly 6.8 million out-of-business records per month during fiscal year 2025. Those numbers are not an advocacy group's estimate. ATF published them itself in the preamble to a proposed rule in the Federal Register on May 6, 2026. The same filing states that approximately 500 million of those images are more than 20 years old, and that ATF currently maintains all out-of-business records indefinitely.

The records arrive by law. Under 18 U.S.C. 923(g)(4), a federal firearms licensee that permanently goes out of business must deliver its required records to the government within 30 days. With 128,960 active licensees as of fiscal year 2024 and a steady churn of shops closing every year, the pile compounds. An earlier ATF fact sheet counted 54.7 million transaction records collected from closed dealers in 2021 alone, and in response to a congressional inquiry ATF reported holding nearly 921 million out-of-business records as of November 2021, 94 percent of them computerized.

What is on those pages is the part gun owners tend to underestimate. A Form 4473 captures the buyer's full name, current residence address, place of birth, height, weight, sex, ethnicity, race, and citizenship, along with the manufacturer, model, serial number, type, and caliber of every firearm in the transaction. Social security number is optional. It is a complete identity record bolted to a specific serial number.

Four statutory provisions prohibit a national registry of most firearms. Two constrain ATF and two constrain the FBI, and they were enacted at different times for different reasons.

The Firearms Owners' Protection Act of 1986 amended 18 U.S.C. 926 to bar any rule requiring that licensee records be transferred to a federal facility, or that “any system of registration of firearms, firearms owners, or firearms transactions or dispositions be established.” Separately, an appropriations proviso attached to ATF's funding every year from fiscal 1979 through fiscal 2012 forbids spending any money in connection with consolidating or centralizing licensee acquisition and disposition records within the Justice Department. Congress inserted the word “hereafter” in the fiscal 2012 version, which makes it permanent.

On the FBI side, section 103(i) of the Brady Act prohibits using any record generated by the background check system to establish a registration system, except as to people who are prohibited from possessing firearms. And a second permanent appropriations provision requires the FBI to destroy the identifying information of any approved buyer within 24 hours of clearing the transfer. That is why a passed background check leaves no lasting federal record of you, while a denial does.

The argument turns on a single technical distinction: whether a digitized image is a database. ATF's position, stated in its own 2026 rulemaking, is that images stored in its repository “are not searchable by an individual's name or other personal identifiers or through character recognition.” They are retrievable by dealer number, serial number, and similar descriptors, and only in the course of a trace. GAO examined the Out-of-Business Records Imaging System in 2016, specifically because of perceptions that it violated the registry prohibitions, and concluded it complied (GAO-16-552).

Critics answer that the distinction is thinner than it sounds and gets thinner every year. Rep. Michael Cloud, whose inquiry produced the 921 million figure, has publicly characterized the system as an illegal national gun registry, and has introduced legislation with Sen. Jim Risch to block one. ATF's own filing acknowledges the pressure by name, citing the Shall Not Be Infringed Act of 2023 and a bill that would require destruction of all out-of-business records as evidence of “ongoing concerns with ATF retaining OOB records and trace information.”

No court has resolved it. What is documented is that a collection of roughly 1.3 billion identity-linked records exists, that it is currently kept forever, and that the only barrier between it and a searchable registry is a policy choice about indexing rather than a gap in the underlying data.

On May 6, 2026 ATF published a notice of proposed rulemaking (RIN 1140-AA95, Docket No. ATF-2026-0003) that would cap record retention at either 20 or 30 years instead of indefinitely. It would apply to dealer Forms 4473, to licensee acquisition and disposition records, and, most significantly, to the out-of-business records held at the National Tracing Center. The comment period closed August 4, 2026, and the rule is not final.

ATF states the rationale plainly: reducing the retention period “would significantly reduce the volume of records retained by ATF and alleviate concerns that ATF might have established or will establish a registry of firearms, firearms owners, or firearms transactions.” The agency backs the operational case with trace data showing that 89 percent of successful fiscal 2024 traces used records less than 20 years old, and that the median time-to-crime for traced firearms is 1,293 days, slightly more than three years.

If it goes final, it partially reverses Final Rule 2021R-05F, which took effect August 24, 2022 and replaced the previous 20-year dealer retention requirement with retention for the entire life of the license. Retention has now swung three times: permanent before 1985, 20 years from 1985 to 2022, indefinite since. ATF's estimate is that 500 million currently held images would fall outside a 20-year window.

If you own a suppressor, a short-barreled rifle, a short-barreled shotgun, an AOW, or a transferable machine gun, ATF knows, by name, in a searchable central record. The National Firearms Registration and Transfer Record is exactly what the registry prohibitions carve out: a centralized registry of NFA-regulated firearms, covering registrations held by private citizens, trusts and other entities, and government registrants.

That registration is the entire point of the Form 4 and Form 1 process, and it is why those applications collect fingerprints and a photograph on top of the identity data a 4473 already captures. Our Form 4 walkthrough covers what goes into a submission, and the suppressor buying guide tracks current processing times and which purchase route applies.

Two things are shifting underneath this. ATF proposed a rule in July 2026 that would cut the fingerprint and photograph burden on NFA applicants, reducing how much identity material ATF holds in the first place. And a party-specific injunction that took effect August 13, 2026 lets covered buyers take a suppressor home on a 4473 and a NICS check with no Form 4 at all, which means those transfers create no NFA registration record. That relief reaches only the parties and customers the court named. State law is a separate layer, and several states independently condition possession on federal registration; our state legality tool tracks where each class stands.

A firearm trace follows one serial number down the distribution chain. It is not a query against a name-searchable national registry, and understanding that distinction explains why the records pile exists at all. Police recover a gun and send ATF the serial number. ATF contacts the manufacturer or importer, which reports which wholesaler it shipped to. The wholesaler reports which retail dealer it shipped to. The dealer pulls the Form 4473 and reports the first retail purchaser. Each hop is a separate request against a separate private record system, some answered by phone and some through electronic tools that search a participating dealer's own disposition records by serial number.

ATF completed 614,995 traces in fiscal year 2024. The chain targets the first retail buyer, which is the structural limit of the whole apparatus: an ordinary private sale or an inheritance creates no new federal Form 4473 record of the new owner. That limit is not absolute, because a firearm that later passes back through a dealer generates a fresh 4473, and multiple-sale reports can supply a lead to a subsequent purchaser. The out-of-business records exist to fill the gap created when the dealer that holds the relevant 4473 no longer exists to answer the phone.

Practically, the exposure depends on what you own and where you bought it. A Title I firearm bought from a dealer that is still in business sits in that dealer's records only, and reaching it requires a trace tied to a specific serial number. A firearm bought from a shop that has since closed is in ATF's imaging repository as a scanned page. An NFA item is in a central registry under your name, and no amount of records policy changes that.

The security of that repository stopped being theoretical in August 2026, when ATF confirmed a cybersecurity incident that senior Justice Department officials designated a major incident. ATF says the compromised machine was a standalone system holding information about targets of its investigations, and that it was not connected to eForms or to its case management systems. The incident is a reminder that the retention debate is also a data security debate: records that are never destroyed are records that remain available to be stolen for as long as they exist, which is the argument ATF is now making in its own rulemaking.

The concrete things worth doing are small. Know that a passed background check is destroyed within 24 hours while a denial is not. Know that your dealer holds your 4473 for as long as the shop exists, and that it goes to ATF if the shop closes. And if you file NFA paperwork, understand that registration, not recordkeeping, is the point of the exercise.