Another school week had just begun at Central Visual and Performing Arts High School in St. Louis when Orlando Harris, armed with a recently purchased AR-15-style rifle and 600 rounds of ammunition, burst into the building with a declaration: “You are all going to die!”

Mr. Harris, a 19-year-old graduate of the school, opened fire that morning in October, killing Alexzandria Bell, 15, and Jean Kuczka, a 61-year-old physical education teacher. More than half a dozen others were injured before the police fatally shot the gunman in a third-floor room where he had barricaded himself.

Mr. Harris had struggled with mental health issues so severe that his family had him committed more than once, triggering an automatic rejection on the federal background check system when he tried to purchase a gun at a licensed dealer 16 days before the shooting. But Missouri is one of 29 states that have no background check requirement for private sales. So, Mr. Harris found a weapon by browsing the online site Armslist.

Federal law requires background checks only for purchases made through the approximately 80,000 businesses that sell, ship, import or manufacture weapons licensed through the federal Bureau of Alcohol, Tobacco, Firearms and Explosives. Unlicensed private sellers, by contrast, can legally sell their wares at gun shows, out of their houses and, increasingly, through online platforms such as Armslist that match buyers with sellers.

The growing digital loophole is causing alarm among gun-control advocates, and some of those whose relatives were targeted with powerful weapons purchased with relative ease online.

“It’s not like selling a car radio,” Alexzandria’s father, Andre Bell, said in an interview. “It’s a gun.”

But the regulatory landscape might be changing. Senate Democrats, long blocked in their attempts to require universal background checks, negotiated a provision into the Bipartisan Safer Communities Act, signed into law last year, that is expected to vastly increase the number of background checks in the unregulated gun market.

The regulations required to put the new law into effect — expected to be released soon — would require anyone who earns a profit from selling firearms to obtain a federal license and conduct background checks.

Previously, dealers were required to join the federal system only if they derived their chief livelihood from selling weapons. Failing to register carries a penalty of up to five years in prison and $250,000 in fines.

The new measure is an attempt for the first time to regulate dealers such as Armslist, Florida Gun Trader and GunBroker.com, an online marketplace responsible for selling tens of thousands of guns in the United States every year.

In March, President Biden included swift implementation of the provision in an executive order on gun policy. Senior officials from the Justice Department and the A.T.F. have been working closely with the White House to draft the regulations, targeting the second half of 2024.

The regulations will set a threshold number of transactions that would define a dealer; gun-control groups hope to see it at five sales a year or lower. The rules will be backed up by a renewed push to prosecute businesses that refuse to register, by accessing bank records, storage unit leases and other expenses associated with running an off-the-books gun business.

While the law does not include any explicit reference to online gun sales, legislators say it is their best chance to impose minimal safeguards on the rapidly growing percentage of sales that occur through internet retailers.

“Most people still think that the majority of unlicensed dealers are operating at gun shows, but that’s really a passé idea,” said Senator Richard Blumenthal, a Connecticut Democrat and longtime proponent of strict gun control. “The real area of growth in firearms sales are online sales through sites likes Armslist.”

Armslist, the best-known of the online gun-trading posts, was founded in 2007 by two college students from the Pittsburgh area looking to fill a market niche created when Craigslist banned firearms sales. From the start, the company’s business model did not involve actually selling guns, but instead creating a virtual marketplace.

Visitors are asked to attest that they are over 21, that they will indemnify the company for damages and that they will not use Armslist for “any illegal purpose.” There is no specific mention of disqualifying factors under federal law, such as a criminal record, involuntary commitment to a mental institution, a history of domestic abuse or drug use.

The site receives no cut from sales. Its founders initially intended to sell advertising, but the company has gradually switched from a free, ad-based platform to a pay-to-sell model based on premium memberships of $6.99 to $30 a month, referring on its website to “the never-ending legal assaults on Armslist” that it says has made the site harder to keep afloat.

One of those legal cases involved the family of a Chicago police commander, Paul Bauer, a 31-year veteran of the department.

On the afternoon of Feb. 13, 2018, Mr. Bauer chased Shomari Legghette — a felon described by his own lawyer as “a long time drug dealer who routinely wore body armor and carried a gun to protect himself” — into a stairwell. Mr. Legghette drew a 9-millimeter Glock and fired a fatal volley of bullets into the officer’s head, neck and chest.

The gun was traced to an Armslist post in 2017 and a prolific vendor on the platform: Thomas Caldwell, a military veteran from Wisconsin who, according to court documents, described his obsession with selling firearms as an “addiction.” The Glock was one of 13 weapons sold by Mr. Caldwell that law enforcement authorities recovered at crime scenes. (The gun used to kill Mr. Bauer was initially sold to someone else and eventually found its way into Mr. Legghette’s hands.)

In September 2018, Mr. Caldwell pleaded guilty to engaging in the business of selling guns without a license — one of a small number of such cases brought even before the change in the law — and was sentenced to just over three years in prison.

In an email, Mr. Caldwell did not address his own role but criticized the judge in his case, James D. Peterson, of the Federal District Court for the Western District of Wisconsin, for having what he viewed as an anti-gun bias.

“Hanging judge just didn’t care as long as the left-wing radicals won,” he wrote.

Numerous crimes have been linked to guns purchased through Armslist, among them the 2018 fatal shooting of a woman by her estranged husband near Appleton, Wis.; a 2012 mass shooting at a spa in Brookfield, Wis.; and the 2011 murder of a woman in the Chicago area. None of the purchasers underwent a background check.

“Imagine if the T.S.A. had two lines for security — one where you are screened and one where you aren’t,” said John Feinblatt, president of Everytown for Gun Safety, which has pushed to close the private sales loophole.

Many lawsuits targeting Armslist have been dismissed. Last month, the U.S. Court of Appeals for the Seventh Circuit upheld the prior dismissal of two suits — one brought by Mr. Bauer’s family — in Wisconsin. The court found that Armslist was not liable because it was not an arms dealer, but a marketplace.

Jonathan Gibbon, who runs Armslist, did not respond to requests for an interview.

But he noted in a legal motion in 2019 that users of the site might have legitimate reasons for avoiding federally licensed dealers, including “convenience” and the “philosophical” issue of “asking for governmental approval” to buy a gun.

In a recent podcast, Mr. Gibbon urged his users “to narc on actual criminals” they discovered on the site.

A majority of weapons sold by unlicensed gun dealers never end up being used in crimes.

Nobody knows for certain how many guns are sold outside the background check system. A 2015 survey of roughly 1,600 gun owners found that 12 and 22 percent of gun owners self-reported that they had obtained firearms without being screened.

Many recent mass shootings have involved guns bought with background checks through federally licensed dealers. From 1966 to 2019, 77 percent of the suspects in mass shootings lawfully obtained some of their weapons, according to a survey compiled by the National Institute of Justice.

And many unregulated sales still take place offline. Some are decidedly low-tech.

In May, a federal jury in Pennsylvania convicted an Amish dairy farmer named Reuben King of engaging in the business of selling firearms without a license after he sold nine guns to undercover investigators.

His sales floor was a barn on his property: Law enforcement authorities discovered around 600 long guns, many marked with price tags, arrayed on tables.

His lawyer, Joshua G. Prince, said that Mr. King mostly sold to other Amish people who could not buy from licensed dealers because their faith precluded them from sitting for the photographs needed to obtain the requisite government-issued ID. Mr. Prince argued unsuccessfully that the government had not established a “bright line” differentiating a casual trader from a profit-seeking dealer.

The Bureau of Alcohol, Tobacco, Firearms and Explosives brings a relatively small number of such cases each year. And even with the new changes to the law, prosecutors still have to prove that dealers willfully operated an illegal business, and they have been reluctant to seek indictments unless the evidence is overwhelming.

One recent example: In 2021, agents served Armani Morris, an unlicensed gun dealer operating from a city south of Dallas, with a cease-and-desist letter. He read it, but said he did not want to sign it.

In January, Mr. Morris pleaded guilty to running an illegal gun business and was sentenced to more than four years in prison after prosecutors presented evidence that he spent about $24,500 to purchase more than 50 firearms to resell for profit — including a 9-millimeter pistol equipped with a mechanism that allows it to operate as a machine gun.

Tom Chittum, a former top A.T.F. official, said there were “risks to drawing bright lines” around the number of sales an unlicensed dealer could make, which might encourage illegal dealers to scatter sales through surrogates moving three or four guns a year.

Others, including Senator Chris Murphy, a Connecticut Democrat who drafted the provision in the 2022 law, are pressing the Biden administration to set a low, specific threshold. “Everybody agrees those people should have to perform background checks,” he said.

But laws are only as effective as their enforcement. What is remarkable about the school shooting in St. Louis is not just what went wrong, but what went right.

On Oct. 8, about two weeks before he attacked the school, Mr. Harris was stopped from buying a gun at a licensed shop in St. Charles, just outside the city, the police said. Mr. Harris was listed in a prohibited category in the federal background check system: “Adjudicated mental defective/committed to a mental institution.”

His status was entered into the system in December 2021, according to three senior law enforcement officials who spoke on condition of anonymity.

Mr. Harris’s family had had him committed on occasion for mental health problems, the investigators said, one of the most common reasons for halting gun purchases during background checks.

It was at this point that Mr. Harris turned to Armslist, according to two of the senior officials, where he arranged to buy a semiautomatic rifle; the seller was not required under Missouri law to screen him, and the person was cleared of any wrongdoing. A lawyer for Armslist did not comment on the incident.

The authorities had one final opportunity to stop Mr. Harris. On Oct. 15, his mother, having discovered that her son had managed to obtain a gun, contacted the police.

The officers who responded removed the weapon. But the police held onto it for only about 48 hours, one of the senior officials said.

A police spokesman told reporters days after the shooting that the police had returned the gun to an unidentified adult known to the family who “was lawfully able to possess it.”

By that time, the police should have been aware that Mr. Harris was barred under federal law from buying or possessing a weapon.

The F.B.I. had sent local authorities, including the police in St. Louis, a required notification that Mr. Harris had failed the federal background check, with a boilerplate recommendation that the police contact the A.T.F. if any further “action” was required, according to law enforcement officials.

Somehow, the rifle ended up in Mr. Harris’s hands again.

Following the attack, a Police Department spokesman said officers had returned the gun because they had no legal authority to even “temporarily” confiscate it. Missouri has no “red flag” law allowing relatives or law enforcement to seek a court order to prevent an individual experiencing a mental health crisis from accessing firearms.

Missouri does prohibit people “currently adjudged mentally incompetent” from possessing a gun. But it is unclear whether the police — who recently declined to discuss details of the case, citing an ongoing investigation — contemplated using that statute.

Joe Kuczka, a son of the teacher killed in the shooting, said Mr. Harris’s family had apparently “tried to do the right thing.”

“They knew he had a mental health problem and tried to get the gun away from him,” he said. “But it didn’t work.”

Adam Goldman contributed reporting. Research was contributed by Susan C. Beachy, Kirsten Noyes, Jack Begg and Alain Delaquérière.