Illustration: Damon Dahlen/HuffPost; Photos: Getty
11/08/2019 05:45 EST | Updated 11/08/2019 12:22 EST

Facebook Is Making Millions Off A Nationwide Gun Permit Scam

Concealed Online customers could be breaking the law without even knowing it.

One of Facebook’s biggest political advertisers is running an elaborate scheme to trick people into believing that a legal “loophole” allows them to qualify for and purchase concealed-carry permits online. The multimillion-dollar ad operation actually sells handgun safety certificates rather than legitimate permits, and urges people to buy them right away before Democrats intervene.

Facebook’s lax ad policies — and America’s notoriously loose gun laws — are working in tandem to create a dangerous situation where misinformed buyers could unwittingly end up carrying concealed weapons illegally, law enforcement experts warn.

Concealed Online, a for-profit company based in California, exploits a Virginia law that lets non-residents apply for concealed-carry permits after completing a safety training online. Through its website, it gives its customers the video training and a test, then charges them up to $130 for a certificate of completion. 

Many don’t realize that they still have to apply to Virginia authorities for the actual permit, which is only valid in states with reciprocity laws. The company uses Facebook to hide this information and to run ads showing photos of permit cards alongside text such as “INSTANT DOWNLOAD” and “START CARRYING LEGALLY TODAY.” 

But the scam goes far beyond false advertising.

Facebook/Concealed Online
"A 2019 Time-saver Loophole Makes You Eligible to get a Carry Concealed Permit ONLINE," reads one of Concealed Online's 25,000 ads.

A HuffPost investigation found that Concealed Online has built two different versions of its website: One for people arriving there organically, and another far less transparent version for people routed there by the company’s tens of thousands of Facebook ads. 

Of 50 ads launched in October, more than one-in-three contain links enabling people to bypass either critical caveats (including the fact that the certificate is not a permit), the safety training that’s required by law, or both. Nearly one-in-five of the ads — which have been viewed millions of times — feature a shareable link that takes people directly from Facebook to a checkout page with the message, “Congratulations! You PASSED!” where they’re told to fill in their billing information in 15 minutes or less to get their certificates.

Concealed Online
Concealed Online has run ads that take customers directly from Facebook to a checkout page with a 15-minute countdown. These ads have been viewed millions of times.

HuffPost also found that Concealed Online has used Facebook’s geo-targeting ad technology to specifically reach people in New York, Maryland, Illinois, Oregon and California with language including, “BETTER BELIEVE IT! A 2018 ‘Timesaver Law’ Grants ALL CALIFORNIA RESIDENTS the Right to Qualify ONLINE for FREE to Carry Concealed!” and “Carry Legally in Your State.” 

But Virginia’s non-resident permit is not honored in any of those states. If a customer were to carry a concealed weapon there with their Concealed Online certificate or Virginia permit instead of the proper local license, they would be breaking the law.

“There’s certainly a danger that someone will download a certificate believing it’s a permit,” said Jacob Paulsen, president of a network of firearm safety instructors called Concealed Carry Inc. “When someone believes they have a permit and, in fact, they do not ... they could go out and carry a concealed firearm in public places, which in most places would be a crime,” added Paulsen, who suspects this is already happening. 

Law enforcement officers have similar concerns.

“If someone believes they have a legal document and that they have completed the test that’s necessary, obviously that’s going to cause an issue if we come into contact with them and they have something they’ve downloaded from the internet,” said Lt. James Sokolik of the Colorado Springs Police Department. “These are people who are attempting to follow the law and do the right thing, but may in fact be committing a crime unknowingly.”

It’s unclear just how many Facebook users living in states that don’t recognize Virginia’s non-resident permits have been duped by the company, though scoreshavecomplained about this online. It’s also unclear how many customers in eligible states have used their certificates to obtain concealed-carry permits without ever doing the safety training. 

The Better Business Bureau launched an investigation into Concealed Online in 2017 and gave it an “F” — the lowest possible rating — due to a litany of complaints about ads on Facebook and Facebook-owned Instagram that “allude to consumers being able to purchase a concealed carry weapons permit in states that do not recognize them.”

Better Business Bureau
Dozens of people have complained about Concealed Online to the Better Business Bureau. Many claim they were conned by misleading Facebook ads.

Facebook, which prohibits ads containing “deceptive, false, or misleading claims,” has long been aware of such complaints.Butupon reviews in 2018 and earlier this year, it ruled that Concealed Online’s ads did not go against its policy, and it has continued to cash the company’s massive checks. Concealed Online has run 25,000 ads and paid Facebook more than $6.4 million since late last spring, which is as far back as public ad-spending data goes.

Facebook conducted another review of Concealed Online’s ads after being contacted by HuffPost this week. It determined that the ads with a shareable link leading straight to a checkout page do violate Facebook’s policy against “unacceptable business practices.” Those direct-checkout ads will no longer be shown, a Facebook spokesperson said. 

But so far, it appears the tech giant has only taken action against a single ad. Concealed Online will remain a Facebook client and is free to keep running its many other problematic ads without penalty.

Via email to HuffPost, Concealed Online defended itself. It said that HuffPost has “a skewed negative view of our offering,” that the company’s service “far-exceeds industry standards” and that its website is “upfront and transparent in all funnels.” It also claimed that its direct-checkout ads were only targeted to Facebook users who had already taken the time to complete the half-hour training and pass the test without bothering to purchase their certificates.

But HuffPost was able to access the checkout page without doing the training or the test. One direct-checkout ad that was active for just two weeks last month was viewed up to 50,000 times in all 50 states. And when the Virginia State Police asked Concealed Online’s management about issuing certificates to people who hadn’t done the training, Concealed Online “assured state police that it is addressing the matter and will no longer allow for that to happen,” a representative for the law enforcement agency told HuffPost.

Concealed Online went on to claim in its email that it makes clear what services it provides on the certificate and throughout the website, adding: “We conspicuously display that we offer a course, and not a permit.” It declined to acknowledge that it has created a much less transparent version of its website that hides this information from Facebook users and that is riddled with sensational claims such as, “Secret factions in the U.S. government are making it harder for you to enjoy your Second Amendment rights” and “Remember ― all it takes is ONE politician to take it all away!”

Concealed Online
Left: The main version of Concealed Online's website. Right: The Facebook version of Concealed Online's website.

Concealed Online asserted that it advertises to people living in states that don’t honor Virginia’s non-resident permits because those customers could apply for permits to use while traveling. It did not answer why it targets them with ad language such as, “Carry Legally in Your State.”

“We’re opportunistic marketers, sure,” Concealed Online’s owner said in an interview about his firm’s ad spending last year with Wired, which granted him anonymity. (Concealed Online also declined to tell HuffPost who owns the company.)

But its marketing practices aren’t just “opportunistic.”While more than a third of the initial 50 Facebook ads HuffPost reviewed allow people to circumvent key disclosure information, each of the remaining ads leads to pages with disclosure text that’s far less conspicuous than what’s displayed when accessing Concealed Online’s website directly. 

As shown below, people starting out on the website would see the pop-up on the left, which explains that they must apply to the Virginia State Police and “satisfy all requirements” to get a permit. Those coming from Facebook would either see the one on the right — which entirely excludes that information — or no disclosure text at all.

Concealed Online
Concealed Online uses Facebook to direct potential customers to a less transparent version of its website.

The front page of Concealed Online’s website makes clear that the certificate isn’t an actual permit and features a section titled, “States that Honor Virginia’s Concealed Carry Permit.” But that’s hidden from people coming from Facebook. Instead, if those people scroll down the page that the Facebook ads send them to — past the misleading claim that it “doesn’t matter which state you live in” — they may notice text noting that “between 29 and 31 states” recognize Virginia’s non-resident permit.

At the very bottom, there are also a few small, grey-on-grey lines stating that the certificate is “not a license or permit to carry a concealed weapon in any state.”

Concealed Online
A crucial disclaimer on the Facebook version of Concealed Online's website is much more difficult to read and find than what's presented on the main website.

By maintaining a level of transparency on its front-facing website while shepherding the majority of its visitors to the far less transparent Facebook-only version (and in many cases, past any sort of disclosure language), Concealed Online has armed itself with a defense against the many customers who say they were conned by its deceptive Facebook ads.

In direct responses to such complainants, the company has repeatedly argued that its website “clearly outlines our service and what we provide,” and it has supported that claim by quoting passages of text from the website — text that Facebook customers may have never seen.

Concealed Online told HuffPost that many of its critical reviews were written by people who actually intended to criticize different companies. It also claimed that the Better Business Bureau offered to give the company a positive rating in exchange for payment; the Better Business Bureau denied this.

A customer complaint and partial response from Concealed Online are shown above.

In its Facebook ads, Concealed Online routinely and falsely claims that Democrats are about to imminently overturn Virginia’s concealed-carry law and urges consumers to act before it’s too late. It uses such tactics to create “a sense of urgency,” Concealed Online’s owner told WiredIt also lures people in by misleading them into believing that they can qualify for the permit without doing background checks or paperwork, with ad language such as, “No long lines. No forms. No b.s.!”

Facebook has designated Concealed Online as a “political advertiser,” which means its active and inactive ads are stored in the platform’s searchable, public ad library for seven years. Facebook debuted this tool last May while under pressure to increase transparency surrounding political ads in the wake of the 2016 election.

“Facebook is committed to transparency in advertising, and has built an Ad Library that now contains over 5 million ads so that people can see who’s behind an ad and report potential violations,” a company spokesperson told HuffPost.

But unlike the rest of Facebook’s one billion users, political advertisers don’t have to disclose their real identities to the public. As a result, we still don’t know much about Concealed Online or who’s behind its multimillion-dollar ad blitz. 

HuffPost found that Concealed Online is running near-identical Facebook ads to at least two other websites that provide the exact same online training and certification services. Those websites, Qualify USA and Qualify2Carry, have also built pages specifically for customers arriving from Facebook ads — pages that, aside from the URLs and titles, are indistinguishable from the one Concealed Online sends Facebook users to. All three websites even display the same verbatim list of exclusively positive reviews. (Concealed Online repeatedly declined to comment on this.)

Concealed Online features identical reviews to those posted on two other websites selling handgun competency certificates.

Qualify USA and Qualify2Carry, which have spent close to half a million dollars on Facebook ads in less than a year, are almost certainly operated by the same person or people as Concealed Online.But because Facebook grants its political ad clients anonymity, there’s no way to confirm who they are, or to know just how many pages they’re running to peddle this nationwide scam on the platform.

There’s also no way to hold them accountable.

The Honest Ads Act, introduced by Sen. Amy Klobuchar (D-Minn.) in 2017, called for higher standards of transparency for political advertisers on social media platforms, but the bill stalled in the Senate. So for now, without any real regulation or oversight, Facebook will continue to profit off opportunistic grifters exploiting its weak policies at the expense of its users. And the profits can be huge.

Since last spring, Concealed Online has spent more on Facebook ads than fellow political advertisers Sen. Kamala Harris (D-Calif.), Sen. Bernie Sanders (I-Vt.) and former Vice President Joe Biden ― each of whom seeks the Democratic presidential nomination. The company is trailing only slightly behind billionaire Tom Steyer, another Democratic presidential contender who’s waist-deep in an ad campaign that’s so expensive one political staffer likened it to “a wealth transfer” between Steyer and Facebook CEO Mark Zuckerberg.

Because Facebook is paid to target and amplify advertisers’ messaging, the platform should bear a level of responsibility for screening their content, said David Chipman, a senior policy advisor at the gun-control advocacy group Giffords.

“There’s a sense among consumers that [advertisers on Facebook] have been vetted to be safe,” noted Chipman. “Facebook needs to sit down and decide if they believe that profiting off facilitating untrained people carrying guns is good for this country.”